Split input/save/load atlas and update references

2026-04-12 10:12:10 -07:00 · 2026-04-12 10:12:10 -07:00 · 81316e6e49
commit 81316e6e49
parent b173c50c1a
13 changed files with 5301 additions and 4113 deletions
--- a/artifacts/exports/rt3-1.06/function-map.csv
+++ b/artifacts/exports/rt3-1.06/function-map.csv
@ -315,6 +315,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x0045f6d0,334,shell_input_register_action_binding_with_mode_specific_defaults,shell,cdecl,inferred,objdump + caller inspection + registry correlation,4,"Shared registration helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper first selects one mode-specific `(binding_code, companion_value)` pair from the caller's four fallback pairs according to shell mode dword `0x006d3c84`; when the selected binding code is not `0xff`, it re-enters `0x0045ed90` to resolve or create the target registry bucket, optionally updates an existing entry for the same companion discriminator `[entry+0x94]` through `0x0045f8a0`, or allocates and links a fresh entry from the pool owner at `0x006acd6c` and the monotonic id source `0x006acd68`. The new or updated record stores the action id, mode flags, callback pointer, localized label string, and the selected default pair before it is linked back into the per-action bucket family. Current grounded callers include the camera-view command registration block at `0x00460903..0x00460cac` and the world-view keyboard registration block at `0x00460720..0x004608e7`, which makes this the current shared action-binding registration helper rather than a camera-specific leaf.","objdump + caller inspection + registry correlation + allocation-pool correlation + mode-specific-default correlation"
 0x0045f8a0,315,shell_input_binding_registry_replace_existing_entry_by_action_bucket_and_mode_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection + registry correlation,4,"Updates one existing binding entry for a specific action bucket plus mode-mask discriminator. The helper first scans the requested live bucket at `0x006acd78..0x006ad960` for an entry whose stored mode mask `[entry+0x94]` matches the caller value in `EDX`; when found it copies the full record to a local stack frame, unlinks and releases the live record from both its bucket and the pool owner at `0x006acd6c`, then re-enters `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` with the preserved callback pointer, localized label pointer, default-pair payload, and the copied companion values while forcing the binding-code selector to `0xff`. Current grounded caller is the registration helper `0x0045f6d0`, which uses this path when a same-bucket same-mode entry already exists for the target action. This is therefore the safest current read for the existing-entry replacement helper rather than a generic free-and-realloc wrapper.","objdump + local disassembly + caller inspection + registry correlation + preserved-payload correlation"
 0x0045f9e0,598,shell_input_seed_default_binding_registry_entries_from_static_table,shell,cdecl,inferred,objdump + local disassembly + static-table inspection,4,"Seeds the shell input-binding registry from the static default table rooted at `0x005ecadc`. The helper walks `0x71` eight-byte rows, localizes each row label id at `+0x04`, decodes the packed row policy word at `+0x06` into the mode-specific default tuple expected by `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, and installs each resulting binding into the live registry. After the fixed table pass it appends a smaller manual post-table strip for adjacent shell commands such as the wrappers at `0x00441a00`, `0x00441940`, `0x00441980`, `0x00482b00`, `0x004408b0`, `0x00441ac0`, `0x004408d0`, and `0x00441af0`, using localized ids `0x0d4a` through the neighboring `0x0d53` band. Current grounded caller is the registry initializer `0x00461120`, which runs this helper after rebuilding the pool and queue roots. This is therefore the safest current read for the default binding seeder rather than a generic command-registration batch.","objdump + local disassembly + static-table inspection + post-table registration-strip correlation"
 0x00460fe0,52,shell_input_register_localized_binding_command_id_0xdb5_to_action_0x6b,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db5`, then installs one default binding row with action id `0x6b`, callback `0x00441cb0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits immediately beside the paired `0x0db6` half-step registration. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
 0x00461000,52,shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
 0x00461040,40,shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
 0x00461070,170,shell_input_binding_registry_destroy_all_roots_and_reset_globals,shell,cdecl,inferred,objdump + local disassembly + global-field correlation,4,"Destroys the live shell input-binding registry and clears all of its global roots. The helper first re-enters `shell_input_write_hotkeys_report_file` `0x0045f550` when the main pool owner at `0x006acd6c` is present, then releases the main pool owner `0x006acd6c`, the companion owner at `0x006acd70`, zeroes every bucket head/tail/count triple across `0x006acd78..0x006ad974`, and finally releases the temporary report queue owner at `0x006acd74` if it is still live. Current grounded caller is the setup helper `0x00461120`, which uses this as the hard reset before rebuilding the registry state. This is therefore the safest current read for the binding-registry teardown and global reset owner rather than a one-off file export command.","objdump + local disassembly + global-field correlation + teardown correlation + hotkey-report correlation"
@ -324,6 +325,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00420030,578,city_connection_bonus_exists_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan.","objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding"
 0x00420280,204,city_connection_bonus_select_first_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan.","objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation"
 0x004207d0,1053,city_site_format_connection_bonus_status_label,map,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. When the preview-global `0x0062be84` is armed or the city-side subtype field `[this+0x23e]` is nonzero the function falls back into the neighboring virtual-style formatter at `0x00455860`; otherwise it builds one visible text block from the base city label at `[this+0x356]`, optionally appends the numeric value in `[this+0x276]`, and can append localized id `207` `(Connected)` when the active linked world object and city class checks succeed. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` at `0x00420030` with three meaningful filter combinations: a deeper peer-reachability pass, an active-company-only pass using `scenario_state_get_selected_chairman_company_record` at `0x004337a0`, and a broader any-company pass. After those boolean note checks it also re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` to recover one representative matching peer site, resolves that peer's linked company through `placed_structure_query_linked_company_id` at `0x0047efe0`, and uses the selected company record when formatting the follow-on company-oriented text lane. That current grounded split is enough to tie `3869` `Connected By Another Station`, `3870` `Already Connected`, `3871` `Connected By Another Company`, `3872` `Already Connected by Another Company`, and `3873` `Not Connected` to this formatter boundary rather than to the station-detail overlay body. The helper also writes one caller-owned color field and label-priority scalar before returning style code `3`, so it currently reads as a world-label or hover-summary formatter for city connection-bonus state rather than a generic text helper.","objdump + caller inspection + RT3.lng strings + city-bonus note correlation + filter-combination decoding + peer-selector correlation"
 0x0043f610,13,world_clear_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared reset for the two preview globals at `0x005ee4fc` and `0x005ee500`. The helper writes `-1` into both lanes and returns. Current grounded callers are the shell-side preview clear and teardown paths in `StationDetail.win` at `0x00504a90` and `0x00505bf0`, where those globals hold the active `(station id, candidate id)` pair used by the world-side overlay scanner `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair reset helper.","objdump + caller inspection + local disassembly + preview-pair correlation"
 0x0043f620,20,world_store_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared setter for the same preview globals at `0x005ee4fc` and `0x005ee500`. The helper stores its two caller dwords into those lanes unchanged and returns. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, where the pair is the active `(station id, candidate id)` selection later consumed by `world_render_station_candidate_service_map_overlay` `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair setter.","objdump + caller inspection + local disassembly + preview-pair correlation"
 0x0043f640,3797,world_render_station_candidate_service_map_overlay,render,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner.","objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check"
 0x00439140,1086,simulation_frame_accumulate_and_step_world,simulation,cdecl,inferred,objdump + analysis-context,4,"Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup.","objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation"
 0x00433a40,82,shell_can_open_company_list_or_detail_panel_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,4,"Shared availability gate above the shell-side company-list and selected-company-detail lanes. The helper reads scenario toggle `[0x006cec78+0x4aef]`; when that dword is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`, otherwise it returns `1`. Current grounded callers are the direct shell command branches `0x004405b3` and `0x0044062c`, plus the broader shell-strip and page-side handlers `0x004de2e3` and `0x004de3ae`, all of which open company-list or selected-company-detail panels only on success. This is therefore the safest current read for the company list/detail availability gate rather than a generic scenario-action blocker.","objdump + caller inspection + shell-detail correlation + modal-path correlation"
@ -332,6 +335,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00434db0,91,shell_can_open_detail_panel_mode_0x0b_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the safest current read for the mode-`0x0b` availability gate rather than a tighter family name we have not yet recovered.","objdump + caller inspection + shell-detail correlation + modal-path correlation"
 0x00434e20,128,shell_can_open_detail_panel_mode_0x06_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the safest current read for the mode-`0x06` availability gate rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation"
 0x00433b80,69,scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Runs a small dispatcher of optional collection-side refresh hooks, but only when global mutation depth `0x0062be40` has fallen back to zero. On the active path it conditionally refreshes four live collection families through shell-state-controlled gates: the placed-structure collection at `0x006cec20` through `0x00481430`, the sibling placed-structure helper family at `0x0062b26c` through `0x00413860`, the train-side collection at `0x006cfcbc` through `0x004b2a90`, and the route-entry collection at `0x006cfca8` through `0x004931e0`. Current grounded callers include the periodic maintenance branch at `0x0040a914`, the placed-structure finalize path at `0x0040f6b4` after it decrements `0x0062be40`, and several shell or editor mutation branches around `0x0049d3a8` and `0x00508f97/0x0050900a`. This is therefore the safest current read for the zero-depth optional collection-refresh dispatcher rather than a single collection owner.","objdump + local disassembly + caller correlation + zero-depth-dispatch correlation + collection-refresh correlation"
 0x00433da0,367,shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay,shell,cdecl,inferred,objdump + caller inspection + overlay-control correlation,3,"Shared owner beneath the paired shell commands `0x00441260` and `0x004412a0` for the mode-`0x19` overlay family. The helper takes one caller-supplied presenter-state boolean and one variant selector, restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across the detail-panel control band `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and then forwards the same variant into world helper `0x0043a0a0`. Current grounded callers are the two registered shell commands that derive the presenter-state boolean from `[0x006d4024+0x114216] == 1` and pass variant `0` or `1`, which makes this the safest current read for the shared mode-`0x19` variant-open and overlay-refresh owner rather than another anonymous control restyler.","objdump + caller inspection + overlay-control correlation + mode-0x19 correlation + detail-panel transition correlation"
 0x00439820,91,world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared world-view helper beneath the local controller strip. The function samples five nearby heights through `0x00534490` at the current eye X/Z pair `[this+0x1c/+0x24]` and four axis-offset probes, keeps the highest sampled clearance, rounds and expands that limit through `0x0052d0c0` plus fixed scalar margins, and then compares the result against current eye height `[this+0x20]`. When the smoothed or clamped target exceeds the current eye height it republishes the eye triplet through `0x0052d1e0`; when local smoothing latch `[this+0x60]` is live it also uses gain `[this+0x34e]` and cached scalar `[this+0x34a]` before that republish. Current grounded callers are the shell-input controller path `0x0043a1d4`, the camera-restore and step buckets at `0x0043c967`, `0x0043cdd4`, `0x0043d0a6`, and the neighboring motion branches `0x0043e4d5` and `0x0043f427`, so this is the safest current read for the local clearance-ring clamp and republish helper rather than a generic terrain-height query.","objdump + caller inspection + local disassembly + world-view correlation + local-clearance correlation + eye-triplet correlation"
 0x0043a0a0,76,world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view owner reached directly from the mode-`0x19` shell strip. The helper stores the inverse of its caller-supplied variant selector into presenter dword `[0x006d4024+0x114216]`, seeds four controller scalars through `0x0052d140` on the live world-view root `0x0062be68`, calls that same object's vtable slot `+0x00`, and then sets dirty byte `[world_view+0x65] = 1`. The seeded scalar quadruple is either `(1.0, 1.0, 0.0, 0.0)` or `(0.7, 1.0, 0.0, 0.0)` depending on the selected mode-`0x19` variant. Current grounded caller is `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`, so this is the safest current read for the world-view-side variant latch plus controller-blend seed owner rather than a generic shell flag setter.","objdump + caller inspection + local disassembly + world-view correlation + mode-0x19 correlation + controller-band correlation"
 0x0043a1a0,61,world_view_store_two_scaled_controller_inputs_and_mark_projection_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view helper over the same local controller strip. The helper scales its two caller floats by `100.0`, forwards them together with current controller dword `[this+0x0c]` into `0x0052d180`, forces controller scalar `[this+0x34e] = 1.0`, and then re-enters `0x00439820` to refresh the dependent view-projection state. Current grounded caller is `shell_world_view_apply_one_normalized_input_pair_from_shell_frame` `0x00516837`, which makes this the safest current read for the two-input controller setter plus projection-dirty publish rather than a higher-level camera mode owner.","objdump + caller inspection + local disassembly + world-view correlation + controller-input correlation + projection-refresh correlation"
 0x0043a1e0,890,world_view_service_controller_transient_offsets_and_selection_handle,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader world-view-side service owner above the same controller strip. When activation dword `[this+0x38e]` is nonzero, the helper derives time-varying transient offsets into `[this+0x3a6/+0x3aa/+0x3ae]` from the current timer fields `[+0x392/+0x396]` and several fixed scalar thresholds, updates or clears one selection-like handle at `[this+0x3b2]` through `0x00531790` and `0x005317b0`, and can drop the activation dword plus all three offsets back to zero when the transient expires. On the live path it also republishes the accumulated offset-adjusted controller position through `0x0052d180` and restores controller gain `[this+0x34e] = 1.0`. Current grounded callers are the recurring simulation-frame path `0x0043916c`, the selection-side refresh strip at `0x0043bd1a`, and the neighboring motion branch at `0x0043e2a4`, so this is the safest current read for the controller transient-offset and selection-handle service owner rather than a static constructor or one-shot callback.","objdump + caller inspection + local disassembly + world-view correlation + transient-offset correlation + selection-handle correlation"
 0x0043a560,64,world_view_release_controller_selection_handle_and_reset_embedded_controller_base,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Teardown-side sibling for the same world-view controller family. The helper temporarily restores one local vtable root at `[this]`, releases selection-like handle `[this+0x3b2]` through `0x005317b0(0)` when it is still live, clears the matching presenter-side owner slot through `0x0052d3e0`, and then tail-jumps into the embedded controller-base reset at `0x0052d570`. This is the safest current read for the controller-family release and base-reset helper rather than a generic shell singleton destructor.","objdump + local disassembly + caller inspection + world-view correlation + controller-reset correlation + selection-handle correlation"
 0x0043a5a0,421,world_view_construct_reset_controller_state_and_seed_keyboard_bindings,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Broader world-view constructor or reset owner above the same controller strip. The helper first resets the embedded controller base through `0x0052d5a0`, clears a large local scalar and handle band rooted at `[this+0x8a..+0x38e]`, seeds a few fixed defaults such as `[this+0x38a] = -999.0f` and `[this+0x34e] = 1.0f`, and then tail-jumps into `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`. The resulting boundary is strong enough to treat this as the real world-view reset and keyboard-binding seed owner rather than a small camera-only helper.","objdump + local disassembly + caller inspection + world-view correlation + reset-owner correlation + keyboard-binding correlation"
 0x0043ac30,235,world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Load-side world-view owner above the embedded controller snapshot loader. The helper first releases any pending helper handle from `[this+0x3b2]` through `0x005317b0`, clears presenter owner slot through `0x0052d3e0`, and resets the local controller strip through `0x0043a5a0`. It then loads one stored camera-view snapshot from the caller stream through `0x0052d750`, conditionally reads either `8` or `10` extra `0x30`-byte rows into `[this+0x10e]` according to startup-side scalar `[0x006cec78+0x46c34]`, consumes one trailing `0x14`-byte block, reseeds the four controller blend scalars through `0x0052d140(0, 0, 1.0, 0.7)`, calls vtable slot `+0x10`, and finally normalizes the heading lane `[this+0x10]`. Current evidence is strongest for a camera-snapshot load owner with one optional extra-row band rather than a generic stream-reader wrapper.","objdump + caller inspection + local disassembly + world-view correlation + stream-load correlation + controller-base correlation"
 0x0043bde0,2037,world_view_refresh_dependent_projection_visibility_and_presentation_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader dependent-refresh owner beneath the same world-view family. After re-entering `0x00439be0`, the helper derives one large band of projection, visibility, and presentation-side scalars from the current focus and eye triplets `[this+0x04..+0x24]`, current controller defaults `[+0x38/+0x3c/+0x40/+0x44/+0x4c]`, world-side mode gates, and several fixed threshold tables. Along that path it calls `0x0052cec0`, `0x00484af0`, `0x00533100`, `0x0043a940`, and repeated world-cell validity checks through `0x00534e50`, and can set dirty byte `[this+0x65]` when the resulting bounds or visibility envelopes move outside tolerated ranges. Current grounded callers are the camera-restore path `0x0043caee`, the heading and zoom-step paths `0x0043cb1d/0x0043cddb`, the shell-input controller service `0x00516842`, and several neighboring motion branches, so this is the safest current read for the world-view dependent projection and presentation refresh owner rather than a smaller math helper.","objdump + caller inspection + local disassembly + world-view correlation + projection-refresh correlation + presentation-scalar correlation"
 0x0050f740,6,shell_has_live_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper returns the live-flag dword at `0x006d3ae4`, which is set during `shell_open_or_focus_trainbuy_window` at `0x00512c50` and cleared after that family tears the singleton down. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, building-detail, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation"
 0x0050f750,11,shell_mark_trainbuy_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_trainbuy_window`. The helper stores `1` into `0x006d3adc`, which current nearby call patterns treat as the `Trainbuy.win` refresh or service request latch once the live singleton family rooted at `0x006d3ac8` exists. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is consumed on the message-`0` service path inside the family handler at `0x00512202` through the `0x00512c09` branch.","objdump + caller inspection + nearby-family correlation + singleton correlation + service-path inspection"
 0x0050f760,45,shell_trainbuy_window_query_selected_locomotive_id,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`.","objdump + caller inspection + strings correlation + selected-row correlation"
@ -387,8 +399,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004a5280,1664,aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation"
 0x004a5900,1728,aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan.","objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation"
 0x004a6630,892,aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation"
 0x004a77b0,24,train_resolve_linked_route_object_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny train-side resolver over linked route-object id `[train+0x41]`. The helper treats `-1` as empty, otherwise resolves that id through collection `0x0062ba84` via `0x00518140` and returns the live linked route object pointer. Current grounded callers are broad and consistent: the whistle command `0x00441870`, the multiplayer train-apply and callback families at `0x0046d780`, `0x0046e250`, and `0x00470bb0`, the train list renderers around `0x004e7670`, and many neighboring simulation-side train helpers. This is therefore the safest current read for the shared train-to-linked-route-object resolver rather than a metrics-owner-only helper.","objdump + local disassembly + caller inspection + linked-route-object correlation + train-family correlation"
 0x004a77d0,51,train_query_linked_route_object_metric_pair_or_default_10f,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small train-side wrapper above the linked route-object metric helper `0x0041add0`. When linked route-object id `[train+0x41]` is live, the helper resolves that route object through collection `0x0062ba84` and tail-calls `0x0041add0` with the original two out-float pointers. When the train has no linked route object, it instead writes `10.0f` to both caller out-float slots and returns. Current evidence is strongest for a generic two-float linked-route metric pair rather than a narrower semantic name, but the default path and ownership boundary are now explicit.","objdump + local disassembly + caller inspection + linked-route-object correlation + two-float-out-parameter correlation"
 0x004a7810,183,train_refresh_linked_route_object_steam_emitter_enable_flags,simulation,thiscall,inferred,objdump + local disassembly + caller inspection + effect-family correlation,3,"Iterates the linked route-object row band rooted at `[route+0x316]` / count `[route+0x31a]` after resolving the train's linked route object through `[train+0x41]`. For each `0xc0`-stride row it probes the optional emitter definition at `[row+0x60]`, uses `effect_name_matches_literal_steam` `0x004749a0` to separate the literal `steam` family, and then either clears row byte `[row+0x1d8]`, resets scalar `[row+0xcc]` to `1.0f`, and re-enters `0x00554920`, or sets `[row+0x1d8] = 1` on the non-steam or missing-emitter branch. This is the safest current read for the linked-route-object steam-emitter enable-state refresh rather than a broader train visual owner.","objdump + local disassembly + caller inspection + effect-family correlation + linked-route-object correlation + row-band correlation"
 0x004a9460,65,train_current_route_context_uses_strict_reachability_mode,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open.","objdump + caller xrefs + callsite inspection + route-context correlation"
 0x004a94b0,381,train_finalize_aux_route_entry_buffer_preserving_subflags,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,3,"One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open.","objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation"
 0x004ad7a0,595,train_trigger_crash_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Broader train-side crash owner reached both from the cheat-code selector branch in `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and from the direct shell command strip around `0x00441810`, where localized id `365` warns `There is no train available to crash!` when no candidate train survives. The helper first enforces the usual crash-side global gates: it rejects when shell byte `[0x006cec78+0x4c8e]` is already set, when world or shell latches under `0x006cec74` block the action, or when the train already carries a nonzero operating mode at `[train+0xe8]`. On the active path it resolves the current linked route object through `[train+0x41]`, marks route field `[route+0x33e]`, enables the shared three-selector and selector-`5` train-visual effect families through `train_visual_toggle_three_selector_effect_slots_and_reseed_shared_anchors` `0x0045cc90(1)` and its selector-`5` sibling `0x0045d1e0(1)`, clears several transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and then walks the linked route-object chain to drive byte `[train+0xf4]` plus the paired visual refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It finishes by writing crash mode `0x11` into `[train+0xe8]`, seeding scalar `[train+0xec] = 0x46924000`, rebuilding the local event payload through `0x004a9360`, and, when the crashing train belongs to the currently selected company, publishing both a shell-side notice through `0x004554e0` and the follow-on company update through `0x00423fd0`. Current neighboring caller `0x004af9e8` also treats this body as the crash-side branch opposite `0x004ada00`, so the safest current read is the shared train crash-state, effect, and owner-notification owner rather than a generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + train-visual correlation + crash-command correlation + route-state correlation"
 0x004ada00,543,train_trigger_breakdown_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Breakdown-state sibling of `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0`. The helper is reached from the direct shell command strip around `0x004418a0`, where localized id `366` warns `There is no train available to break down!`, and from the neighboring train-state branch at `0x004af9f7`. It enforces the same crash-side global gates and the same `[train+0xe8] == 0` requirement, but on the active path it marks route field `[route+0x342]`, enables the selector-`5` and selector-`2` train-visual effect families through `0x0045cf40(1)` and `0x0045d1e0(2)`, clears the same transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and drives the same linked route-object byte `[train+0xf4]` plus refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It then writes breakdown mode `0x12` into `[train+0xe8]`, seeds the same scalar `[train+0xec] = 0x46924000`, rebuilds the local event payload through `0x004a9360`, and, when the affected train belongs to the currently selected company, publishes the shell-side notice through `0x004554e0` and the paired company follow-on through `0x00423fe0`. Current neighboring caller `0x004af9f7` uses this body as the direct opposite branch of `0x004ad7a0`, so the safest current read is the shared train breakdown-state, effect, and owner-notification owner rather than another generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + breakdown-command correlation + train-visual correlation + route-state correlation"
 0x004ab980,760,train_set_route_operating_mode_and_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open.","objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation"
 0x004b2b80,29,train_route_list_count_live_site_reference_entries,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,4,"Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter.","objdump + caller xrefs + route-entry inspection + callsite inspection"
 0x004b2c10,656,train_route_list_validate_reachability_and_station_pair,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan.","objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split"
@ -457,6 +474,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004768c0,53,chairman_profile_owns_all_company_shares,simulation,thiscall,inferred,objdump + caller inspection,4,"Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`.","objdump + caller inspection + ownership-predicate correlation"
 0x00436710,163,scenario_state_sum_issue_opinion_terms_raw,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar.","objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation"
 0x00437a60,41,world_toggle_pause_or_restore_game_speed,simulation,thiscall,inferred,objdump + strings,3,"Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`.","objdump + RT3.lng strings"
 0x00437d70,736,shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats,shell,thiscall,inferred,objdump + local disassembly + static-table decode + RT3.lng strings,4,"Broader shell-side cheat owner reached from the registered command wrapper `shell_command_dispatch_scenario_followon_0x437d70_if_active` `0x00441340`. After the usual single-profile gate through `0x004349a0`, the helper increments shell counter `[0x006d401c+0xc60]`, opens the callback-driven modal rooted at `RT3.lng` id `2922` `Do I detect a cheater in the house?\\n\\nEnter code (or <ESC> to cancel):` through `0x005193f0 -> 0x004c98a0`, and then scans the fixed 26-entry cheat table at `0x005ee2c8`. Current grounded case coverage is real: selector `0` dispatches winner or loss outcome modes through `0x004367c0` using labels `3618/3619/3620/3622`; selector `1` jumps out to `0x004d676c`, where it clears the selected-company stat bands rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`; selector `2` posts one caller-supplied float delta into the selected company through `company_add_delta_into_stat_series_current_slot_and_optional_cash_totals` `0x0042a080`; selector `3` posts one signed integer delta into the selected chairman profile through `profile_entry_add_signed_integer_delta_into_qword_field_0x154` `0x00476050`; selector `4` resolves one locomotive record by primary or alias stem through `0x00461c00` and applies it to every train owned by the selected company through `0x004aefb0`; selector `5` walks the live territory collection and forces access-rights byte `1` through `company_set_territory_access_rights_byte` `0x00424030`; selector `6` toggles scenario byte `[state+0x4c8f]`; selector `7` runs the train-wide branch through `0x004ad7a0(1)`; and selectors `8/9/10` toggle scenario bytes `[state+0x4c8e/+0x4c8d/+0x4c8c]`. The same table also contains later labeled rows `3634` `Orca` and alias-only names `Katie..Seymour`, but their selector values lie above the visible jump-table bound `0x0a`, so current evidence only supports treating them as unreached or separately handled tail entries rather than active cases in this owner.","objdump + local disassembly + static-table decode + RT3.lng strings + cheat-table correlation + selected-company/profile mutation correlation"
 0x00448aa0,28,world_sample_companion_float_grid_value_by_cell,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny float-raster sampler over the companion world grid rooted at `[this+0x1605]`. The helper uses width field `[this+0x15d9]`, flattens the caller-supplied cell coordinates with an extra `+1` row stride, reads one `float` from that raster, and returns it in `st(0)`. Current grounded callers include `world_compute_transport_and_pricing_grid` `0x0044fb70`, the flagged-cell sample collector `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, the projected-rectangle helper `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, and several neighboring shell or presentation branches, so this is the safest current read for the shared companion float-grid sampler rather than a transport-only helper.","objdump + caller inspection + field correlation + float-raster correlation"
 0x00448af0,206,world_query_compact_grid_flag_bitset_membership_by_mode,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Boolean compact-bitset query over three neighboring world-grid flag banks. The helper uses dimensions `[this+0x215d/+0x2161]` to flatten the caller-supplied cell coordinates into one bit index, rejects out-of-bounds cells, and then checks one or more compact bitset banks depending on the caller mode argument: mode `0` checks both `[this+0x2139]` and `[this+0x213d]`, mode `1` checks `[this+0x213d]` only, mode `2` checks `[this+0x2139]` only, and mode `3` checks `[this+0x2141]` only. It returns `1` when any selected bank contains the bit and `0` otherwise. Current grounded callers include the post-load `319` cleanup lane inside `world_run_post_load_generation_pipeline` `0x004384d0`, the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the projected-runtime scratch builder `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`, several neighboring world-scan or presentation branches around `0x004512b5..0x00451393`, and later world-side routes or scenario handlers, so this is the safest current read for the shared compact grid-flag-bitset membership query rather than one specific road- or route-only gate.","objdump + caller inspection + field correlation + compact-bitset correlation + post-load-cleanup correlation"
 0x00448c20,132,world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small secondary-raster mutator over one world cell. After rejecting cells whose current secondary class already lies in subset `1/4` through `world_secondary_raster_query_cell_class_in_set_1_4` `0x00534e50`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `4` when the old class was `2`, or to `1` otherwise. It then notifies the shell-side world presentation through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and several shell-side map-editing or painting branches around `0x004f9c17` and `0x004fbcc9`, so this is the safest current read for the shared class-`1/4` demotion helper rather than a more player-facing terrain brush.","objdump + caller inspection + field correlation + secondary-raster correlation"
@ -524,12 +542,76 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00440c10,12,shell_select_camera_view_8,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `8` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460bb7` ties this wrapper to localized command id `3488`, the `Select Camera View 8` slot.","objdump + command-registration correlation + wrapper inspection"
 0x00440c20,12,shell_select_camera_view_9,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `9` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c19` ties this wrapper to localized command id `3490`, the `Select Camera View 9` slot.","objdump + command-registration correlation + wrapper inspection"
 0x00440c30,9,shell_select_camera_view_0,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `0` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c7b` ties this wrapper to localized command id `3492`, the `Select Camera View 0` slot.","objdump + command-registration correlation + wrapper inspection"
 0x00440e00,274,shell_command_step_active_window_subject_forward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Paired shell command owner for the forward-step action registered at `0x45ffae` with action id `0x22` and localized label id `0x0d65`. The helper first prefers live `StationDetail.win` singleton `0x006d16d8`, where it re-enters `shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class` `0x00505e30`. Failing that it prefers the live building-detail singleton `0x006cfd04` and re-enters `0x004b6fc0`, then the live company-detail singleton `0x006cfe4c` when no custom modal is active through `shell_has_live_custom_modal_dialog` `0x004c8680`, where it re-enters `shell_company_detail_select_next_active_company` `0x004c3540`, and finally the sibling live singleton `0x006d3b20`, where it re-enters `0x00514880`. When no supported live window family is active but scenario state `0x006cec78` exists, it builds one contextual notice through localized ids `0x017a/0x017b`, validates the modal path through `0x0045f3d0`, and publishes that notice through `0x004554e0`. This is therefore the broad forward-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation"
 0x00440f20,274,shell_command_step_active_window_subject_backward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Backward-step sibling of `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00`, registered at `0x45ffdf` with action id `0x21` and localized label id `0x0d66`. The helper walks the same live window-family priority chain: `StationDetail.win` through `shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class` `0x00505e40`, then the building-detail singleton `0x006cfd04` through `0x004b6fd0`, then the company-detail singleton `0x006cfe4c` through `shell_company_detail_select_previous_active_company` `0x004c3550` when no custom modal is active, and finally the sibling singleton `0x006d3b20` through `0x00514890`. When none of those families is live but scenario state `0x006cec78` exists, it builds and conditionally publishes the paired contextual notice through localized ids `0x017c/0x017d`, `0x0045f3d0`, and `0x004554e0`. This is therefore the broad reverse-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation"
 0x00441040,131,shell_open_or_focus_train_detail_for_current_or_first_owned_train,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff1b` with action id `0x54` and localized label id `0x0d62`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current train-subject id from `[detail+0x78]` and validates it against the live train collection `0x006cfcbc`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned trains through `company_count_owned_trains` `0x004264c0`, and falls back to the first owned-train id through `0x00426520`. Once a valid train id survives it forwards `(train_id, 2)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct train-detail opener or refresher for the current subject with first-owned-train fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + train-detail correlation + first-owned-train fallback correlation"
 0x004410d0,138,shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff7d` with action id `0x53` and localized label id `0x0d64`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current station-subject id from `[detail+0x80]` and validates it against the live placed-structure collection `0x006cec20`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned linked stations through `company_count_linked_transit_sites` `0x00426590(0)`, and falls back to the first owned linked-station id through `0x00426620(1, 0)`. Once a valid station id survives it forwards `(station_id, 5)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct station-detail opener or refresher for the current subject with first-owned-station fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + station-detail correlation + first-owned-station fallback correlation"
 0x00441160,50,shell_command_dispatch_live_world_followon_by_query_0x450150,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling beneath the same command table. The helper requires active scenario state `0x006cec78` plus the live world root `0x0062c120`, re-enters query helper `0x00450150`, and then dispatches one of two world-root follow-ons: `0x00453370` when that query returns zero, or `0x00453780` when it returns nonzero. The registration block at `0x460286` ties this body to localized label id `0x0d73` and command id `0x47`. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + world-root followon correlation"
 0x004411a0,52,shell_command_dispatch_live_route_store_followon_by_query_0x4934a0_zero,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling over the live route-store root `0x006cfca8`. The helper requires active scenario state `0x006cec78` plus a live route-store owner, re-enters `0x004934a0(0)`, and then dispatches one of two route-store follow-ons: `0x00491880` when that query returns nonzero, or `0x004932a0` when it returns zero. The registration block at `0x4602b7` ties this body to localized label id `0x0f01` and the same command id `0x47` family. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + route-store followon correlation"
 0x00441240,21,shell_command_toggle_shared_world_preview_global_0x62be84,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + global-state correlation,2,"Tiny registered shell command that flips global dword `0x0062be84` between `0` and `1`. The same global is already grounded on the station-detail candidate-service preview side and on the city-site connection-bonus label formatter, so this command currently reads as a shared world-preview-global toggle rather than a detail-window-local helper. The registration block at `0x4602e8` ties it to action id `0x4e` and localized label id `0x0d74`.","objdump + command-registration correlation + local disassembly + global-state correlation + shared-preview-global correlation"
 0x00441260,49,shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Registered shell command beneath action id `0x09` and localized label id `0x0d70`. The helper first rejects while sibling singleton `0x006d3b4c` is live, then requires active scenario state `0x006cec78` and the main shell presenter root `0x006d4024`. It derives one boolean from presenter field `[root+0x114216] == 1`, passes that boolean together with variant selector `0` into `0x00433da0`, and that shared helper in turn restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across detail-panel controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the variant into world helper `0x0043a0a0`. Current evidence is strong enough for the mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation"
 0x004412a0,49,shell_command_open_detail_panel_mode_0x19_variant_1_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Variant-`1` sibling of `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`, registered under the same action id `0x09` family with localized label id `0x0d71`. The helper enforces the same `0x006d3b4c` / scenario-state / presenter-root gates, derives the same presenter boolean from `[0x006d4024+0x114216] == 1`, and then re-enters `0x00433da0` with variant selector `1`, which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the selected variant into world helper `0x0043a0a0`. Current evidence is strong enough for the paired mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation"
 0x004412e0,85,shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-state correlation,3,"Registered shell command beneath action id `0x45` and localized label id `0x0d75`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then accepts either when shell-state probe `0x00435480` succeeds or when shell flag `[0x006cec74+0x1df]` is already nonzero through `0x00482840`. On the active path it re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` with stack flag `1` and then writes shell dwords `[0x006cec74+0x1df/+0x1e3] = 0/0` through `0x00482850`, which also triggers the follow-on refresh helper `0x004354a0`. Current evidence is strong enough for the shell-state-band and year-threshold refresh owner shape, but not yet for a tighter user-facing command name.","objdump + command-registration correlation + local disassembly + shell-state correlation + year-threshold-band correlation"
 0x004411e0,31,shell_command_toggle_presenter_flag_0x114276_if_present,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + presenter-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d79`. The helper probes the main shell presenter root at `0x006d4024` and, when that root is live, flips the dword at `[presenter+0x114276]` between `0` and `1`. Current evidence is only strong enough for the direct toggle and owner boundary, not for a tighter user-facing semantic name for that presenter-side latch.","objdump + command-registration correlation + local disassembly + presenter-root correlation + toggle-latch correlation"
 0x00441200,52,shell_command_send_message_0xcb_to_control_0x9858_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-message correlation,2,"Small registered shell command beneath action id `0x5a` and localized label id `0x0d7b`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then forwards shell message `0xcb` with control id `0x9858` plus three zero trailing arguments into the shared shell runtime at `0x006d401c` through `0x00538e00`. Current evidence is strong enough for the message-injection owner shape, but not yet for a tighter user-facing command name for control `0x9858`.","objdump + command-registration correlation + local disassembly + shell-message correlation + active-scenario correlation"
 0x00441340,15,shell_command_dispatch_cheat_code_modal_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + cheat-owner correlation,2,"Tiny registered shell command beneath action id `0x00be` and localized label id `0x0d7c`. The helper requires active scenario state `0x006cec78` and then tail-calls `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70`. This is therefore the direct command-table entry for the cheat-code modal owner rather than a generic scenario follow-on.","objdump + command-registration correlation + local disassembly + cheat-owner correlation"
 0x00441360,68,shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + focus-handoff correlation,3,"Registered shell command beneath action id `0x47` and localized label id `0x0db3`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, requires live collection root `0x0062b244`, then queries selector `0x0040b2d0(0, 1)`. When that selector returns a nonzero subject id, the helper forwards `(1, 3, subject_id)` into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`. Current evidence is strong enough for the focus-handoff owner shape, but not yet for a tighter user-facing verb or subject family name.","objdump + command-registration correlation + local disassembly + focus-handoff correlation + selector-correlation"
 0x00441790,111,shell_resolve_focused_or_fallback_train_owned_by_selected_company,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Shared current-train resolver beneath the shell-side train command strip. The helper first probes the live world-view owner at `0x0062be68`, and when a focused subject exists through `[view+0x60]` plus vtable slot `+0x6c`, it resolves the corresponding live train from collection `0x006cfcbc` by id `[subject+0x390]`. It then requires that train's owner company id `[train+0x51]` to match the current scenario-selected company through `scenario_state_get_selected_chairman_company_id` `0x004337a0`; otherwise it falls back to `0x005130f0` and repeats the same ownership test on that fallback train. Success returns the live train pointer; failure returns null. Current grounded callers are the adjacent shell command leaves `0x00441810`, `0x00441870`, and `0x004418a0`, so this is the safest current read for the focused-or-fallback owned-train resolver rather than a broader world-view query.","objdump + local disassembly + caller inspection + world-view correlation + selected-company correlation + train-command-strip correlation"
 0x00441810,79,shell_command_crash_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x43` and localized label id `0x0d77` `Current train crashes`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`. When no train survives it opens the simple shell modal rooted at localized id `365` `There is no train available to crash!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the resolved train into `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0(1)`.","objdump + command-registration correlation + local disassembly + RT3.lng strings + crash-owner correlation"
 0x00441870,34,shell_command_mark_current_or_fallback_owned_train_whistle_request,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,2,"Registered shell command beneath action id `0x57` and localized label id `0x0d76` `Current train whistles`. The helper resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`; when that succeeds it resolves the train-side visual owner through `0x004a77b0` and writes request dword `1` into `[owner+0x33a]`. Failure is silent and returns `0`. Current evidence is strong enough for the whistle-request owner shape even though the deeper user-facing meaning of `[owner+0x33a]` remains open.","objdump + command-registration correlation + local disassembly + RT3.lng strings + train-visual-owner correlation"
 0x004418a0,79,shell_command_break_down_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x42` and localized label id `0x0d78` `Current train breaks down`. The helper enforces the same active-scenario and single-profile gate as the crash sibling `0x00441810`, resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`, and when no train survives opens the simple shell modal rooted at localized id `366` `There is no train available to break down!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the train into the sibling failure-state owner `0x004ada00(1)`. Current evidence is strongest for the breakdown-command wrapper above that sibling train-state body rather than a generic shell modal leaf.","objdump + command-registration correlation + local disassembly + RT3.lng strings + failure-state sibling correlation"
 0x00441900,53,shell_command_toggle_overview_window_page_0_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the `Overview.win` page-toggle strip. The helper probes the shell detail-panel controller at `0x006d0818`; when current mode `[detail+0x8c]` already equals `9` and current overview page `[detail+0x90]` already equals `0`, it closes that page by forwarding `(-1, 0)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Otherwise it requests mode `9`, page `0` through the same owner. Current evidence is strong enough for the page-toggle shape, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
 0x00441940,52,shell_command_toggle_overview_window_page_1_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x73` and localized label id `0x0d4b`. The helper mirrors `0x00441900`, but it tests for `Overview.win` mode `9` page `1` at `[0x006d0818+0x90]`; a same-page hit closes through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, otherwise it requests mode `9`, page `1`. This is the safest current read for the second `Overview.win` page-toggle command rather than another anonymous detail-manager wrapper.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
 0x00441980,52,shell_command_toggle_overview_window_page_2_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x74` and localized label id `0x0d4c`. The helper mirrors the adjacent page-toggle siblings, but it tests for `Overview.win` mode `9` page `2`; same-page hits close through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, while every other case requests mode `9`, page `2`. This is the safest current read for the third `Overview.win` page-toggle command rather than another generic shell leaf.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
 0x004419c0,52,shell_command_toggle_overview_window_page_3_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the same `Overview.win` page-toggle strip. The helper tests the live detail manager for mode `9`, page `3`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `3`. Current evidence is strong enough to keep this as the fourth overview-page toggle, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
 0x00441a00,52,shell_command_toggle_overview_window_page_4_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x72` and localized label id `0x0d4a`. The helper tests the live detail manager for mode `9`, page `4`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `4`. This is the current safest read for the fifth overview-page toggle command rather than a more semantic page-name claim.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
 0x00441ac0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_0_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d4f`. The helper requires active scenario state `0x006cec78`, rejects when shell counter `[0x006d401c+0xc64]` is already positive, and then forwards three zero stack arguments into `shell_map_file_entry_coordinator` `0x00445ac0`. Current evidence is strong enough for the wrapper shape and gate conditions, but not yet for the exact player-facing verb mapped onto that zero-triplet coordinator call.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation"
 0x00441af0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_1_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d51`. The helper mirrors `0x00441ac0`, but forwards stack flags `(0, 1, 0)` into `shell_map_file_entry_coordinator` `0x00445ac0` after the same active-scenario and shell-idle gate. Current evidence is strong enough for the wrapper shape and flag triplet, but not yet for the exact user-facing command name for this coordinator variant.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation"
 0x00441b20,39,shell_command_clamp_world_dword_0x168d_not_below_0x1689_if_world_live,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + world-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d72`. The helper requires live world root `0x0062c120`, compares dwords `[world+0x1689]` and `[world+0x168d]`, and rewrites `[world+0x168d]` so it is never below `[world+0x1689]`. Current evidence is only strong enough for that direct clamp and owner boundary, not for a tighter semantic name for this world-side scalar pair.","objdump + command-registration correlation + local disassembly + world-root correlation + clamp correlation"
 0x00441b50,358,shell_command_toggle_editor_map_mode_with_one_shot_warning_modals,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Broader registered shell command sibling above the editor-map-mode setter `0x00482e50`. The helper requires active scenario state `0x006cec78` and the live shell-state root `0x006cec74`, then branches on current editor-map mode lane `[shell+0x68]`. When editor-map mode is already active it uses one-shot latch `0x0062be88` to optionally publish localized modal `0x017e` through `0x005193f0 -> 0x004c98a0`; when editor-map mode is inactive it instead opens warning `0x0b6e` if the active-profile-count gate `0x004349a0` exceeds `1`, or uses one-shot latch `0x0062be8c` to optionally publish modal `0x0b24`. After those gates it computes target mode `([shell+0x68] == 0)` and forwards that boolean into `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`. Current evidence is strong enough to treat this as the real editor-map-mode toggle command with one-shot warning modals rather than another anonymous scenario-side follow-on.","objdump + command-registration correlation + local disassembly + caller inspection + editor-map-mode correlation + warning-modal correlation"
 0x00441cb0,111,shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6b` and localized label id `0x0db5`. The helper requires active scenario state `0x006cec78`, rejects when the active-profile-count gate `0x004349a0` exceeds `1`, clears shell dwords `[0x006cec74+0x233]` and `[+0x124]`, adds `0.5` to startup-side scalar `[0x006cec78+0xbfa]`, then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` before refreshing the live view owner at `0x0062be68` through `0x00439a80`. Current evidence is strongest for a paired half-step raise on the startup selected-year presentation scalar rather than a tighter player-facing command name.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation"
 0x00441d20,111,shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6d` and localized label id `0x0db6`. The helper mirrors `0x00441cb0`, but subtracts `0.5` from startup-side scalar `[0x006cec78+0xbfa]` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` and refreshing the live view owner through `0x00439a80`. It shares the same active-scenario gate, active-profile-count gate, and shell dword clears `[0x006cec74+0x233]` and `[+0x124]`. This is the current safest read for the paired half-step lower command rather than a stronger user-facing label claim.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation"
 0x00441d90,135,shell_build_percent_status_payload_clamped_0_to_100,shell,cdecl,inferred,objdump + local disassembly + caller inspection + status-publisher correlation,3,"Shared percentage-status payload builder used by the save or load progress strip. The helper divides one caller float by one caller integer, multiplies by fixed scalar `100.0f`, rounds through `0x005a10d0`, clamps the result to at most `100`, and then packages that percentage into the small status payload built through `0x0051b700`, `0x005193f0`, and `0x00518de0`, returning the final shell text handle rooted at `0x0062c0d8`. Current grounded callers include the repeated progress-notice loop inside `shell_map_file_world_bundle_coordinator` `0x00445de0` and the adjacent throttled progress callback `0x00441e20`, so this is best read as the shared percent-status payload builder rather than a one-off modal helper.","objdump + local disassembly + caller inspection + status-publisher correlation + save-load-progress correlation"
 0x00441e20,155,shell_progress_callback_publish_incremental_percent_status_until_target,shell,cdecl,inferred,objdump + caller inspection + local disassembly + progress-callback correlation,3,"Shared incremental progress callback above `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90`. The helper first checks global progress latches `0x0062bec8`, `0x0062becc`, and `0x0062c118`; when the caller target count has not advanced it returns immediately, and when the target equals `0x64` it instead advances `0x0062becc` by `0x14` and clears `0x0062c118`. Otherwise it increments `0x0062c118`, derives one intermediate percentage from the caller target divided by `3`, scaled by `100.0`, offset by current base `0x0062becc`, and then re-enters `shell_build_percent_status_payload_clamped_0_to_100` before publishing the resulting status through `0x00538c70` and servicing the shell frame through `0x00482160`. Current grounded owner correlation is the callback installation at `0x00442960`, which writes this function into global `0x00d93988` before entering a longer staged work loop, plus the same save or load progress family around `0x00445de0`. This is the safest current read for the throttled percent-status callback rather than another direct shell command leaf.","objdump + caller inspection + local disassembly + progress-callback correlation + staged-work correlation + shell-status correlation"
 0x00441ec0,107,shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2,map,cdecl,inferred,objdump + local disassembly + caller inspection + tagged-bundle correlation,2,"Small tagged-bundle helper in the adjacent map-bundle and companion-image strip. On the save-side branch it writes one caller dword through `global_indexed_slot_table_write_bytes` `0x00531030` and then emits tagged headers `0x2ee0`, `0x03c2`, and `0x2ee1` through `0x00531340`; on the load-side branch it mirrors the same triplet through `0x005a276f` after opening the incoming staged object. Current grounded callers are the two companion-image file siblings `0x00441f70` and `0x004420f0`, where it serializes the selector byte at `[record+0x09]`, the payload size lane `[record+0x04]`, and the copied dword at `[record+0x00]` beside the external `_A.tga/_A.jpg` file path. This is the safest current read for the shared companion-image tag strip rather than a generic slot-table header helper.","objdump + local disassembly + caller inspection + tagged-bundle correlation + companion-image correlation"
 0x00441f70,384,shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Broader companion-image load helper paired with `0x004420f0`. The helper derives an extensionless stem from the caller path through `support_copy_string_stem_before_first_dot` `0x0051dde0`, appends either `_A.tga` or `_A.jpg` according to selector byte `[record+0x09]`, opens the resulting path in mode `r+b`, streams the file through `0x005a1b05` into a temporary `0x200`-byte loop buffer, and then mirrors the loaded bytes through `0x005a276f` before writing the companion-image selector tags through `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`. Current grounded caller is the broader save or load coordinator strip around `0x00445983`, and the sibling overlay-surface owner `0x00535430` later consumes the same global fallback descriptor rooted at `0x0062bed4/0x0062bed8`. This is the safest current read for the companion-image file import path rather than a generic external file loader.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation"
 0x004420f0,476,shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Write-side sibling of `0x00441f70` for the same companion-image family. The helper derives an extensionless stem from the caller destination path, appends either `_A.tga` or `_A.jpg` by selector byte `[record+0x09]`, tries to open that file in mode `r+b`, and when no existing file is present allocates or reuses the global staging buffer rooted at `0x0062bed4/0x0062bed8` before streaming bytes from the source handle in `0x200`-byte chunks. On the existing-file path it writes the same chunks through `0x005a276f`; on completion it clears the temporary typed cache through `0x0053c900`, copies the final companion path into the caller out-buffer, and returns. Current grounded caller is the save-side branch at `0x00443d1c`, which immediately follows this helper by writing the paired tagged headers `0x2ee0/0x2ee1`. The later world-presentation fallback path `0x00535430` also consumes the same global staging descriptor, so this is the safest current read for the companion-image export path rather than a generic file-copy helper.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation"
 0x00450150,7,world_query_preview_mode_0x15_latch_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny getter for the shared world-side preview-mode latch byte `[this+0x21c5]`. The helper returns that byte unchanged as a boolean-like integer. Current grounded callers are the shell command strip at `0x00441173`, which chooses between the enter and exit siblings `0x00453370` and `0x00453780`, and the TrackLay destructor path at `0x0050db8d`, which only re-enters `0x00453510` when this latch is clear while world mode `[world+0x2175]` still equals `0x15`. This is therefore the safest current read for the direct mode-`0x15` preview-latch query rather than a broader world-mode predicate.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation"
 0x00450160,816,world_recompute_mode3_preview_normalization_window_0x2195_0x2199,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Mode-`3` prepass beneath the shared world preview rebuild owner `0x00450520`. The helper walks the live secondary-grid cells rooted at `[this+0x2129]` across world dimensions `[+0x2145/+0x2149]`, skips blocked class lanes when cell byte `[cell+0xe6]` carries bit `0x01` without `0x04`, and scores each surviving cell either with fixed `200.0f` or with `0x0042c960(remainder(id, 0x35))` against the current primary preview id `[this+0x2179]`. It tracks min, max, average, and one farther qualifying score through `0x0042b350`, then writes the resulting float window into `[this+0x2195]` and `[this+0x2199]`, clamping the final scale lane to at least `1.0f`. Current grounded caller is the shared active preview or tool overlay rebuild owner `0x00450520`, which invokes this prepass only when current world preview mode `[this+0x2175]` equals `3`. This is the safest current read for the mode-`3` normalization-window recompute helper rather than a broader map-load statistic pass.","objdump + caller inspection + local disassembly + mode-3 correlation + normalization-window correlation"
 0x00450490,144,world_query_mode3_preview_cell_best_matching_six_byte_list_color,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small per-cell query beneath the same mode-`3` world preview family. The helper indexes one secondary-grid cell from `(x, y)` through `[this+0x2129]`, reads the six-byte entry list described by count dword `[cell+0xeb]` and pointer `[cell+0xef]`, and searches for the strongest matching entry when the caller-supplied selector id matches the row's leading `u16` or when that selector id is `0`. When any match is found it returns the shared tagged color lane `[0x006cec78+0x66ba] | 0x2c000000`; otherwise it returns zero. Current grounded callers are the mode-`3` pixel cases inside `world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds` `0x00450520`, where this helper acts as the local linked-site or service-list color query rather than as a top-level roster scan.","objdump + caller inspection + local disassembly + mode-3 correlation + per-cell list correlation + tagged-color correlation"
 0x00450520,4074,world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared rebuild owner for the world-side preview or tool-mode family rooted at `[this+0x2175]`, `[+0x2179..+0x2191]`, and transient surface root `[this+0x478]`. The helper first rejects when no active mode is set, runs the mode-`3` normalization prepass `world_recompute_mode3_preview_normalization_window_0x2195_0x2199` `0x00450160` when required, derives the current world-cell rectangle and float scale from the active mode table at `0x005ee5e0/0x005ee5e4`, clamps the active sub-rectangle against the live world dimensions and shell presentation caps, reuses or rebuilds the transient overlay surface through `0x00532490`, `0x00534f80`, and `0x005323f0`, then fills that surface by switching over the active mode and computing one packed color per cell. The per-mode pixel cases mix checkerboard fallbacks with several grounded world queries, including mode-`3` helper `world_query_mode3_preview_cell_best_matching_six_byte_list_color` `0x00450490`, the secondary-grid and overlay classifiers `0x00534e10/0x00534e50/0x00534e90/0x00534ec0/0x00534f00/0x00534f40`, terrain and grid queries `0x00448af0`, `0x00448f00`, `0x00448f30`, and one scalar ramp through `0x0051dfc0`. After rasterizing the active rectangle it publishes the active mode byte through `0x00532510`, refreshes the overlay live flag through `0x00532460`, and pushes the normalized preview bounds back through `0x00532520` and `0x005324e0`. Current grounded callers include the shared wrappers `0x00452d80`, `0x00452db0`, `0x00452f20`, `0x00452f60`, and `0x00452fa0`, plus the mode-`0x15` entry or clear siblings `0x00453370` and `0x00453510`. This is therefore the safest current read for the shared active preview or tool overlay rebuild owner rather than any one window family's private raster pass.","objdump + caller inspection + local disassembly + active-mode correlation + overlay-surface correlation + normalized-bounds correlation + paint-tool correlation"
 0x00452d30,68,world_clear_aux_preview_mode_0x2171_and_overlay_companion_live_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small shared clear path inside the world-side preview or tool-mode family. When auxiliary preview mode dword `[this+0x2171]` equals `1`, the helper also clears optional flag dword `[this+0x219d]` and decrements the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when flag `[this+0x21a1]` is still set. It then zeroes `[this+0x2171]` unconditionally and tail-jumps into `world_presentation_clear_overlay_companion_block_live_flag` `0x00532360`. Current grounded callers are the mode-`0x15` entry or clear owners `0x00453370` and `0x00453510`, plus the shell-side cleanup paths in `BuildingDetail.win` at `0x004bc1f1` and `StationDetail.win` at `0x00504a90/0x00505bf0`. This is therefore the safest current read for the auxiliary preview-mode clear helper rather than a generic overlay reset.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + overlay-companion correlation"
 0x00452ca0,137,world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared setter beside the same world-side preview family. The helper stores the caller mode into auxiliary preview dword `[this+0x2171]`, conditionally arms optional companion flag `[this+0x219d]` when the caller mode is `1`, and increments the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when live flag `[this+0x21a1]` is already set at that moment. It then chooses one of three coarse tile-size lanes (`0x40`, `4`, or `1`) from the auxiliary preview mode and forwards those dimensions plus live world size `[0x0062c120+0x2155/+0x2159]` into `0x00532310` to reseed the local overlay-companion grid. Current grounded callers are `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which passes mode `1`, and `shell_change_height_window_construct` `0x004bcb50`, which passes mode `6`. This is therefore the safest current read for the auxiliary preview-mode setter and companion-grid reseed helper rather than a station-detail-only preview latch.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + companion-grid correlation"
 0x00452d80,33,world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny setter in the same world-side preview family. The helper stores one caller dword into `[this+0x217d]` and, when current mode `[this+0x2175]` is already nonzero, re-enters `0x00450520(0)` to rebuild the active preview or tool state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which forwards the current station-detail row through this helper after staging the candidate id. This is the safest current read for the direct scalar setter plus active-mode refresh rather than a more semantic station-only helper.","objdump + caller inspection + local disassembly + preview-scalar correlation"
 0x00452db0,88,world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared linked-site id setter beneath the same world-side preview family. The helper first unregisters the previous linked site through `0x00413620` when current mode `[this+0x2175]` equals `3` and old id `[this+0x2181]` is nonzero, stores the caller id into `[this+0x2181]`, then registers the new id through `0x00413750` when mode `3` is still active and the new id is nonzero. When any preview or tool mode is already active it finally re-enters `0x00450520(0)` to rebuild that mode. Current grounded callers are the linked-peer action branches at `0x0040e5b1`, `0x0040e65d`, and `0x0040e97d`, plus `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses it while arming the current station preview. This is therefore the safest current read for the preview-family linked-site setter and mode-3 rebind owner rather than a plain id store.","objdump + caller inspection + local disassembly + linked-site correlation + mode-3 rebind correlation"
 0x00452e10,136,placed_structure_collection_dispatch_virtual_slot_0x0c_or_0x10_by_optional_subject_and_linked_peer_gate,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Collection-side dispatch helper over every live placed structure in `0x0062b26c`. For each record it chooses between vtable slot `+0x0c` and `+0x10`. When the caller mode arg is not `-1`, slot `+0x0c` is chosen if either the optional subject id resolves through vtable slot `+0x80` plus `0x004129d0` or the structure already satisfies `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`; otherwise the helper falls back to slot `+0x10`. Current grounded callers are the world preview-mode owners `0x00453370`, `0x00453510`, and the broader mode-switch body `0x00452fa0`, which use this helper while entering, leaving, or changing the same site-aware preview states. This is the safest current read for the collection-wide virtual dispatch gate rather than a narrower route-builder helper.","objdump + caller inspection + local disassembly + placed-structure-collection correlation + linked-peer gate correlation"
 0x00452ea0,117,world_refresh_preview_flag_0x21a1_from_world_view_float_and_presenter_counters,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small flag-refresh helper in the same world-side preview family. The helper samples float `[0x0062be68+0x20]` from the live world-view owner against one fixed threshold, normalizes the result to boolean flag `[this+0x21a1]`, and only mutates the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when companion enable dword `[this+0x219d]` is already nonzero and the sampled boolean changed. Current grounded caller is the nearby world-view follow-on at `0x0043c5f6`, which invokes this helper before the later local owner refresh path at `0x0043b350`. This is the safest current read for the view-scalar-driven preview-flag updater rather than a broader camera or zoom-mode owner.","objdump + caller inspection + local disassembly + world-view correlation + preview-flag correlation + presenter-counter correlation"
 0x00452f20,48,world_refresh_active_preview_mode_from_four_dword_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small active-mode refresh wrapper over the same preview or tool-mode family. The helper copies four caller dwords into a local parameter block and forwards that block into `0x00450520`, leaving the current mode selector unchanged. Current grounded callers are the world-facing preview publish tails at `0x00436164`, `0x004f7958`, `0x004fb4c4`, `0x004fc4a0`, `0x004fc61a`, and `0x004fd4dc`, where it is used as the parameter-block refresh step rather than a top-level mode switch. This is the safest current read for the four-dword active-mode refresh wrapper.","objdump + caller inspection + local disassembly + parameter-block correlation"
 0x00452f60,51,world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared primary-id setter in the same world-side preview family. The helper stores one caller dword into `[this+0x2179]`; when current mode `[this+0x2175]` equals `3` it first re-enters `0x00452e10` with that same id to update the placed-structure collection dispatch, and when any mode is active it then re-enters `0x00450520(0)` to rebuild the current preview state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses this helper to stage the candidate id before syncing the station row and linked-site id. This is the safest current read for the primary-id setter plus mode-3 dispatch refresh rather than a station-only helper.","objdump + caller inspection + local disassembly + primary-id correlation + mode-3 collection correlation"
 0x00452fa0,704,world_switch_preview_or_tool_mode_and_seed_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared mode-switch owner for the world-side preview or tool family rooted at `[this+0x2171..+0x2191]`. The helper first releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles the current mode's presenter counters and placed-structure bindings for the grounded families `3`, `6`, and `7`, and then seeds the caller-supplied parameter block into `[this+0x217d/+0x2181/+0x2185/+0x2189/+0x218d/+0x2191]` together with primary scalar `[this+0x2179]` and target mode `[this+0x2175]`. It finishes by re-entering `0x00450520` on that new state and then replaying the mode-specific side binds such as `0x00413750` for mode `6` and `0x00413620/0x00413750/0x00452e10` for mode `3`. Current grounded callers include `PaintRegion.win`, `PaintSound.win`, and `PaintTerritory.win` constructors and message handlers at `0x004f539f`, `0x004f549e`, `0x004f5784`, `0x004fcd10`, and `0x004fcf30`, plus the linked-peer action branches around `0x0040e60a`, `0x0040e9c2`, and `0x00464f8f`. This is therefore the safest current read for the shared world-side preview or tool mode switch owner rather than a single window-family helper.","objdump + caller inspection + local disassembly + mode-switch correlation + parameter-block correlation + paint-tool correlation + linked-peer action correlation"
 0x00453370,405,world_enable_preview_mode_0x15_latch_and_enter_if_idle,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared world-side owner for entering the preview-capable mode `0x15`. The helper first rejects when latch byte `[this+0x21c5]` is already nonzero; otherwise it sets that latch and only continues when current mode `[this+0x2175]` is still `0`. On the active path it releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles prior shell-presenter counters for the neighboring mode families `3` and `7` plus optional flag pair `[this+0x219d/+0x21a1]`, adjusts the shared presenter count lane `[0x006d4024+0x11426e]` from the mode table at `0x005ee5e8/0x005ee6e4`, seeds mode `0x15` into `[this+0x2175]`, clears the local scalar band `[+0x2179..+0x2189]`, seeds both timeout-like dwords `[+0x218d/+0x2191] = 0x1869f`, and re-enters `0x00450520` before tailing through `0x00452d30` according to shell field `[0x006cec74+0x12c]`. Current grounded caller is the shell command strip at `0x00441182`, which dispatches here when active scenario plus world state exist and the same preview latch is still clear. This is the safest current read for the mode-`0x15` preview-latch entry owner rather than a generic world reset.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation"
 0x00453510,621,world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared teardown-or-reseed owner for the same world-side preview-mode family rooted at mode byte `[this+0x2175]` and latch `[this+0x21c5]`. The helper first reconciles the auxiliary preview byte `[this+0x2171]` through the small clear tail at `0x00452d30`, then tears down the current mode state through `0x00532360`, `0x00532500`, and `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, clears the current mode dword `[this+0x2175]`, and decrements the same shell-presenter counter families used by the entry sibling for prior modes `3` and `7` plus optional flags `[this+0x219d/+0x21a1]`. When preview latch byte `[this+0x21c5]` is still set, it then replays the same mode-`0x15` reset strip against the live world root `0x0062c120`, re-seeding `[world+0x2175] = 0x15`, the scalar band `[+0x2179..+0x2191]`, and the later `0x00450520 -> 0x00452d30` tail. When that latch is clear it returns with the mode fully torn down. Current grounded callers include the shell-side linked-peer action branch at `0x0040e94c`, the route or preview wrappers at `0x00449467` and `0x00464f2d`, many shell tool-window destructors such as `0x004f3b50`, `0x004f50fa`, `0x004f5784`, and `0x0050db9c`, plus the explicit latch-clear sibling `0x004537a0`. This is therefore the safest current read for the shared preview-mode clear-or-reseed owner rather than a one-window destructor helper.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation + tool-window teardown correlation"
 0x00453780,38,world_disable_preview_mode_0x15_latch_and_clear_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny paired exit helper for the same world-side preview-mode family. When latch byte `[this+0x21c5]` is nonzero the helper clears that latch and, if current mode `[this+0x2175]` still equals `0x15`, tail-jumps into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`; otherwise it returns immediately. Current grounded callers are the shell command strip at `0x0044118a` and the neighboring settings-side wrapper at `0x004ff90c/0x004ff94a`, which use it as the direct preview-mode unlatch path when the same mode-`0x15` latch is already active. This is the safest current read for the paired latch-clear helper rather than another generic world-mode toggle.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation"
 0x004422d0,96,shell_status_stack_push_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status lanes into one `5`-byte slot selected by the current depth: shell dwords `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. Current grounded callers include the heavier wrappers `0x004423a0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation"
 0x00442330,112,shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five status lanes from the selected `0x0062be90` slot back into shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, and returns. Current grounded callers include the higher wrapper `0x004423d0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation"
 0x004423a0,48,shell_status_stack_push_and_service_active_tracklay_and_stationplace_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher wrapper over the same shell/startup status-band stack. It first re-enters `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`, then, when the live TrackLay.win tool object at `0x006d1a8c` is present, calls `0x0050e070`, and when the live StationPlace.win tool object at `0x006d1720` is present, tail-jumps into `0x00507a50`. Current grounded callers include the city-connection route builder `0x00402cb0`, the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the neighboring collection-side world branch `0x0046b9f0`, so this is the safest current read for pushing the shared status band and then bracketing active world-tool windows rather than another generic shell transition helper.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation"
 0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded callers include the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, the neighboring save-load path `0x00446d40`, and the collection-side world branch `0x0046b9f0`, so this is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation"
 0x00442400,930,shell_setup_load_selected_profile_bundle_into_payload_record,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads the smaller startup payload and preview-surface chunks rooted at ids `0x0001` and `0x03c2`, while the map-style side reads the larger setup payload chunks rooted at ids `0x0004`, `0x2ee0`, and `0x2ee1`, with the exact chunk mix gated by the parsed bundle-header word in the local scratch. Current grounded caller is `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`.","objdump + local disassembly + caller inspection + chunk-family correlation"
 0x004425d0,139,shell_setup_validate_selected_profile_bundle_and_stage_launch_profile,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs.","objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation"
 0x00442660,209,shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks,shell,cdecl,inferred,objdump + caller inspection + local disassembly + status-notice correlation,2,"Shared progress-sample notice helper in the surrounding save or load strip. The helper measures the current byte counter through `0x00530b70`, derives one rounded kilobyte delta against previous counter `0x0062c11c`, formats that delta through `%5d`, measures elapsed ticks against `0x0062bed0` through `0x0051d890`, formats the elapsed field through `% 4d`, and then packages both fields plus the caller-supplied status stem into the shared shell text builder `0x005193f0 -> 0x00518de0 -> 0x0051d680`. It finally updates `0x0062c11c` to the current byte counter. Current grounded callers include the bundle-service strip at `0x00413469/0x004134b4` and the save-side progress path inside `shell_map_file_world_bundle_coordinator` around `0x00445098`, so this is the safest current read for the shared byte-delta and elapsed-time progress notice helper rather than a one-off formatter.","objdump + caller inspection + local disassembly + status-notice correlation + save-load-progress correlation"
 0x00442740,128,shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Short companion helper in the same save or export strip. The function allocates a temporary `0x40000`-byte RGBA copy of the embedded preview pixel block rooted at `[record+0x03c2]`, constructs one temporary `0xec`-byte surface-like owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, and then forwards the caller path seed plus fixed selector `0x46` into `0x00542f50`, storing the returned dword into payload field `[record+0x18]`. It finally releases the temporary owner through `0x00542c90 + 0x0053b080`. Current grounded caller is the save-side bundle branch at `0x00445925`, immediately after tagged setup-preview payload export and before the shared progress notice path, so this is the safest current read for the temporary-surface query helper rather than a generic image copier.","objdump + caller inspection + local disassembly + surface-family correlation + save-side bundle correlation"
 0x004427c0,624,shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Broader companion-payload rewrite owner in the same save or export strip. The helper copies the caller path into a local buffer, strips its extension through `support_strip_extension_in_place` `0x0051df90`, appends the fixed `%1.tmp` suffix, opens the source file, allocates one full-size heap buffer, and reads the file body through `0x005a1b05`. It then installs `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` into global `0x00d93988`, forwards the source tail plus destination tail rooted at `+0x03ce` into `0x00553000`, and writes the rewritten output back through `0x005a276f`, preserving the leading `0x03ce` bytes and the trailing untouched source bands around the transformed middle region. On completion it updates payload dword `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x00443cd3`, which enters this helper only when payload byte `[record+0x66c9]` is set before deriving the external `_A.tga/_A.jpg` companion path. This is the safest current read for the temporary-path companion-payload rewrite owner rather than a generic file copy helper.","objdump + caller inspection + local disassembly + companion-image correlation + tmp-path correlation + progress-callback correlation"
 0x00442900,304,shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Sibling companion-payload rewrite owner in the same save or export strip. The helper takes the live payload record in `EAX` plus one caller path on the stack, reads the whole source file into a temporary heap buffer, installs progress callback `0x00441e20` in `0x00d93988`, and then rewrites the middle payload band through `0x00553000` using the stored file offsets in `[record+0x18/+0x1c]`. It writes the rebuilt output in four spans through `0x005a276f`: the leading `0x03ce` bytes, the transformed middle payload, the untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. On completion it stores the caller path back into `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x004459dd`, reached after companion-image import `0x00441f70` when payload byte `[record+0x66c9]` is set, so this is the safest current read for the offset-driven companion-payload rewrite sibling rather than another generic file copier.","objdump + caller inspection + local disassembly + companion-image correlation + progress-callback correlation + save-side bundle correlation"
 0x00442a40,31,locomotive_policy_issue_id_is_in_primary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Small range-membership predicate in the locomotive-policy strip. The helper returns true only for issue ids in the two disjoint bands `0x0f1..0x15f` and `0x1c9..0x1da`, and false everywhere else. Current grounded callers are the stream-load path `0x0042ddd0`, the stream-save inverse path `0x00430feb`, the scenario availability-owner path `0x0043160b`, the setup-side terrain or candidate branch `0x004d6125`, and the neighboring primary forward mapper `0x00442a85`, so this is the safest current read for the primary locomotive-engine-family issue-band membership test rather than a generic range helper.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation"
 0x00442a5f,38,locomotive_policy_issue_id_is_in_secondary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Sibling range-membership predicate in the same locomotive-policy strip. The helper returns true only for issue ids in the disjoint bands `0x160..0x1c4` and `0x1db..0x1f6`, and false everywhere else. Current grounded callers are the same stream-load and stream-save pair `0x0042ddde` and `0x00431000`, plus the neighboring secondary forward mapper `0x00442aac`, so this is the safest current read for the secondary locomotive-engine-family issue-band membership test rather than another anonymous range check.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation"
 0x00442a85,23,locomotive_policy_map_primary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + editor-policy correlation,3,"Primary forward mapper in the locomotive-policy strip. The helper treats the caller value as one compact engine-family or policy index, leaves `0` unchanged, maps `1..0x6f` into issue ids `0x0f1..0x15f`, maps `0x70..` into issue ids `0x1c9..0x1da` by inserting a fixed gap `0x69`, and then bounds the result against the upper limit `0x1db`. Current grounded callers are `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, the stream-load branch `0x0042de19`, and the neighboring primary row resolver `0x00442a9c`, so this is the safest current read for the forward map from the primary locomotive engine-family index space into raw issue ids rather than a plain arithmetic shim.","objdump + caller xrefs + local disassembly + editor-policy correlation + locomotive-policy correlation"
 0x00442a9c,16,locomotive_policy_resolve_primary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Primary row resolver over the fixed issue table rooted at `0x00610398`. The helper first maps the caller through `locomotive_policy_map_primary_engine_family_index_to_issue_id` `0x00442a85`, then multiplies that issue id by stride `0x6e`, adds the table base `0x00610398`, stores the resulting row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the shell-side formatter strip at `0x00462449`, which uses the returned row to resolve the primary localized issue-name path. This is the safest current read for the primary issue-row resolver rather than a generic table indexer.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation"
 0x00442aac,23,locomotive_policy_map_secondary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + caller correlation,3,"Secondary forward mapper in the same locomotive-policy strip. The helper leaves index `0` unchanged, maps `1..0x65` into issue ids `0x15f..0x1c4`, maps higher indices into issue ids `0x1db..0x1f6` by inserting fixed gap `0x16`, and bounds the result against the upper limit `0x1f7`. Current grounded callers are the stream-load branch `0x0042de19`, the locomotive scalar owner `0x00461a06`, and the neighboring secondary row resolver `0x00442ac3`, so this is the safest current read for the secondary locomotive-engine-family index-to-issue-id map rather than another plain arithmetic helper.","objdump + caller xrefs + local disassembly + caller correlation + locomotive-policy correlation"
 0x00442ac3,16,locomotive_policy_resolve_secondary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Secondary row resolver over the same fixed issue table rooted at `0x00610398`. The helper maps the caller through `locomotive_policy_map_secondary_engine_family_index_to_issue_id` `0x00442aac`, multiplies the resulting issue id by stride `0x6e`, adds the base `0x00610398`, stores the row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the sibling shell-side formatter strip at `0x004624ae`, where it resolves the alternate localized issue-name row. This is the safest current read for the secondary issue-row resolver rather than a generic pointer arithmetic stub.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation"
 0x00442ad3,14,locomotive_policy_map_primary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442a85` in the same locomotive-policy strip. The helper subtracts base issue id `0x0f0`, and when the resulting compact index rises above `0x6f` it removes the inserted gap `0x69` to recover the original primary engine-family or policy index. Current grounded caller is the stream-save path `0x00430ff2`, which uses this inverse map when serializing the primary issue band back into the compact save-side index space. This is the safest current read for the primary issue-id-to-index inverse rather than a free-standing subtractive helper.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation"
 0x00442ae1,14,locomotive_policy_map_secondary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442aac` in the same locomotive-policy strip. The helper subtracts base issue id `0x15f`, and when the resulting compact index rises above `0x65` it removes the inserted gap `0x16` to recover the original secondary engine-family or policy index. Current grounded caller is the stream-save path `0x00431007`, which uses this inverse map when serializing the secondary issue band back into the compact save-side index space. This is the safest current read for the secondary issue-id-to-index inverse rather than another subtractive arithmetic stub.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation"
 0x00442ba0,143,shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100,shell,thiscall,inferred,objdump + caller inspection + local disassembly + payload-export correlation,3,"Concrete live-payload export helper in the setup and map-bundle strip. The helper copies the full live payload record from `[this+0x66be]` into the caller buffer, forces the leading validity byte to `1`, patches the exported world dimensions from `[0x0062c120+0x2155/+0x2159]` into offsets `+0x01/+0x05`, mirrors three shell-side state bytes from `[0x006d4024+0x11471a]`, `[0x006d4024+0x11471e]`, and `0x0062bec4` into offsets `+0x09..+0x0b`, and then normalizes the embedded pixel block at `+0x03c2` through `0x0047a120` with fixed dimensions `0x100 x 0x100`. Current grounded callers are the save-side setup export path at `0x00444f42`, which immediately forwards the resulting record into the companion-image tag strip `0x00441ec0`, and the slot-table bundle serializer at `0x00446312`, which emits the same copied record under tags `0x2ee0/0x03c2/0x2ee1`. This is the safest current read for the live setup-preview payload exporter rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + payload-export correlation + companion-image correlation + bundle-tag correlation"
 0x00442c30,3600,shell_apply_scenario_name_specific_post_load_world_and_object_fixups,shell,thiscall,inferred,objdump + caller inspection + local disassembly + scenario-string correlation,4,"Broad post-load fixup owner reached from `world_entry_transition_and_runtime_bringup` at `0x00444b50`. The helper compares the caller-supplied scenario title against many fixed `.rdata` names including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, `Central Pacific`, and `Orient Express`, with several branches further gated by setup payload byte `[this+0x66de]`. Matching branches then perform targeted live-world and collection edits: they mutate object-state dwords and bytes inside collections rooted at `0x0062be18`, `0x0062bae0`, and `0x006ada80`; retune selected float and scalar fields; copy paired ten-dword record blocks when specific name or class pairs match; patch secondary-raster bits through the fixed table `0x005ee508..0x005ee5cc`; update one later collection at `0x0062b268`; and inject several scenario-specific text lines into the shell-owned band `[this+0x4f30]` through repeated `0x0051e5d0`. This is the safest current read for the scenario-name-specific post-load fixup owner rather than a generic string-dispatch helper.","objdump + caller inspection + local disassembly + scenario-string correlation + live-world mutation correlation + post-load-fixup correlation"
 0x0044c450,96,world_rebuild_all_grid_cell_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation sweep inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The helper walks the full live world grid rooted at `[this+0x2129]` through dimensions `[this+0x2145/+0x2149]`, resolves each cell pointer, and re-enters `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` on every cell record. Current grounded caller is the later world-entry tail at `0x444b24`, immediately after `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0` and before the route-style link rebuild at `0x468300`, so this is the current safest read for the world-wide grid-cell cargo-service-bitset refresh wrapper rather than another generic world-grid loop.","objdump + local disassembly + caller inspection + world-grid correlation + cargo-service correlation"
 0x0044c4b0,192,world_clear_and_reseed_region_center_world_grid_flag_bit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub.","objdump + local disassembly + caller inspection + region-grid correlation"
 0x0044c570,256,world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Small secondary-raster mutation helper beneath the later marked-cell scan and overlay-cache family. After clamping the caller cell coordinates against the current secondary-grid dimensions, the helper resolves the byte raster rooted at `[this+0x2135]` using row stride `[this+0x2155] + 1` and only proceeds when the target byte has no bits in mask `0x3e` and the parallel class predicate `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` also reports false. On the admit path it widens cached min/max bounds `[this+0x21c6..+0x21d2]`, increments the marked-cell count `[this+0x21d6]`, and then rewrites the target raster byte with `(byte & 0xc3) | 0x02`, i.e. it preserves the outer two bits and the low bit while forcing the masked class field to `0x02`. Current grounded caller is the later radial mutation branch at `0x0044e8e7`, and the written bounds/count fields are the same ones later scanned by `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, so this is the safest current read for the small secondary-raster cell-marker helper rather than another generic bounds updater.","objdump + caller xrefs + local disassembly + secondary-raster correlation + marked-cell-bound correlation"
@ -763,6 +845,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004614d0,40,runtime_object_vtable_wrapper_query_local_companion_float_relief_score_at_rounded_coords,map,thiscall,inferred,objdump + local disassembly + wrapper correlation,2,"Tiny virtual-style wrapper over `world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias` `0x0044afa0`. It rounds the current object's normalized secondary and primary coordinates through `0x00455810`, `0x00455800`, and `0x005a10d0`, then forwards the resulting cell pair plus world root `0x0062c120` into `0x0044afa0`. Current evidence grounds it only as the table-local wrapper over the heavier world-scalar query, not the owning subtype name.","objdump + local disassembly + wrapper correlation + world-scalar-query correlation"
 0x00461500,39,runtime_object_query_flag_byte_0x42_with_class0_true_fallback_when_mode_gate_inactive,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query on the same virtual-family boundary as `0x004614d0`. The helper first checks shell mode gate `0x004338c0` on scenario root `0x006cec78`; when that gate is active it returns byte `[this+0x42]` directly. When the gate is inactive it returns literal `1` only for class-0 records with `[this+0x23e] == 0`, and otherwise falls back to the same byte `[this+0x42]`. Current evidence is strong enough only for that structural fallback rule, not for a tighter semantic name for the flag or owning subtype.","objdump + local disassembly + mode-gate correlation + field inspection"
 0x00461650,120,map_load_geographic_label_database,map,cdecl,inferred,ghidra-headless,3,Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context.,ghidra + rizin + llvm-objdump + strings
 0x00461c00,126,locomotive_collection_resolve_entry_by_primary_or_alias_stem,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared string resolver over the live locomotive collection at `0x006ada84`. The helper walks every live locomotive row, first compares the caller text against the primary stem at `[entry+0x34]`, then against the alias or secondary stem at `[entry+0x53]`, and returns the first matching live row pointer through the collection accessors `0x00518380/0x00518140`. Failure returns null. Current grounded caller is the cheat-code owner `0x00437d70`, where selector `4` resolves stems like the hidden locomotive cheat aliases before applying them to every train owned by the selected company through `0x004aefb0`. This is therefore the safest current read for the primary-or-alias locomotive stem resolver rather than a more specific dialog helper.","objdump + local disassembly + caller inspection + locomotive-stem correlation + cheat-branch correlation"
 0x00461c80,30,locomotive_entry_query_linked_era_name_ptr,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small accessor over one live locomotive entry. The helper resolves linked era id `[loco+0x72]` through the era collection at `0x0062ba88` and, on success, returns the raw era-name pointer at `[era+0x45]`; missing era ids return null. Current grounded callers are the locomotives-availability and recipe-side editor families around `0x004cd641`, `0x004cdaf2`, `0x004cf16c`, `0x004cf1f2`, `0x004cf2ed`, `0x004cf3f0`, the world-entry rehydrate lane at `0x004478de`, and the smaller shell-side branch at `0x00438d5f`, so this is the safest current read for the linked-era name-pointer accessor rather than a display-only helper.","objdump + local disassembly + caller inspection + era-collection correlation + locomotive-editor correlation"
 0x00461ca0,35,locomotive_entry_format_linked_era_name_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Formatting companion to `locomotive_entry_query_linked_era_name_ptr` `0x00461c80`. The helper resolves linked era id `[loco+0x72]` through the same era collection at `0x0062ba88` and, on success, forwards the era-name pointer `[era+0x45]` into `0x0051c920`; missing era ids return null. Current grounded callers are the train-upgrade news formatter `0x00409300` and the neighboring company-side upgrade branch at `0x00409903`, where it supplies the old and new locomotive-era display names embedded in localized news id `2897`.","objdump + local disassembly + caller inspection + era-name formatting correlation + train-upgrade-news correlation"
 0x00461cd0,298,locomotive_collection_select_best_era_matched_non_electric_fallback_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Fallback locomotive chooser beneath `company_select_preferred_available_locomotive_id` `0x004078a0`. The helper walks the live locomotive collection, explicitly skips records whose engine-type dword `[record+0x10]` is `2`, and then scores the remaining records from the linked era record at `[record+0x72]`: the current grounded score uses the absolute distance from the current scenario year to the era start field `[era+0x105]`, adds `500` when the era has not started yet, adds `50` when the current year has passed the era-end field `[era+0x109]`, and adds `2000` when the linked approval helper `0x0041d550` rejects the era or engine family for the current context. The lowest-penalty locomotive id wins, so the current best read is an era-matched non-electric fallback rather than a general preferred-locomotive chooser. Current grounded caller is `company_select_preferred_available_locomotive_id` `0x004078a0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + fallback-choice correlation"
 0x00461e00,262,locomotive_collection_refresh_runtime_availability_overrides_and_usage_state,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime refresh over the live locomotive pool at `0x006ada84`. The helper guards itself with reentrancy latch `0x006ada88`, walks every live locomotive record, resolves the linked era record through `[loco+0x72]`, and combines the locomotive-side requirement bytes `[loco+0x30/+0x31/+0x32]` with the active scenario-state availability toggles at `[0x006cec78+0x4c97..+0x4c99]`. When the current locomotive or its linked era passes those gates it upserts one boolean availability override through `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` `0x004350b0`; it then immediately queries the resulting named override through `scenario_state_query_named_locomotive_availability_record_value` `0x00435030` and stores that value into `[loco+0x7b]`. When the collection sweep finishes it tails into `0x00436af0` to rebuild the dependent locomotive-side scalar band. Current grounded callers are the world-entry rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and the startup or restore-side upsert family that also re-enters this helper through `0x004350b0`, so this is the safest current read for the collection-wide locomotive runtime-availability refresh rather than a single dialog-owned toggle helper.","objdump + caller xrefs + local disassembly + locomotive-availability correlation + scenario-state override correlation + reentrancy-latch correlation"
 0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless,4,Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20.,ghidra + rizin + llvm-objdump + strings
@ -911,6 +996,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004853c0,740,shell_apply_graphics_preset_bundle,shell,cdecl,inferred,ghidra-headless,4,Applies one table-driven graphics preset bundle to the shell settings object. It derives a preset tier from shell state and runtime capability probes then writes per-setting values through repeated 0x00485060 calls refreshes dependent runtime state through 0x00484d70 optionally saves game.cfg through 0x00484910 and updates several display capability flags under 0x006d4024.,ghidra + rizin + llvm-objdump
 0x00485060,635,shell_set_graphics_option_with_fanout,shell,thiscall,inferred,ghidra-headless,4,Writes one graphics option value into the shell settings arrays at [this+0xac] and coordinates grouped fanout updates. Primary preset selectors recursively expand into dependent option ids 1 through 16 using preset remap tables at 0x00621250 through 0x00621358. The function compares the new normalized value against the previous setting invokes 0x00484d70 when a runtime refresh is needed and persists game.cfg through 0x00484910 once the update batch completes.,ghidra + rizin + llvm-objdump
 0x00485760,2746,vehicle_visual_init_running_gear_and_smoke_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a larger vehicle visual bundle covering running-gear assets smoke effects and attachment-audio objects. The routine fills indexed road-wheel visual arrays from RoadWheelR and RoadWheelL asset strings creates direct MuzzleSmoke and ExhaustSmoke sprite emitters at [this+0x216] and [this+0x21a] and then creates five fixed attachment objects at [this+0x3cc] through [this+0x3dc] for diesel1 tracks german88 turret and mantlet audio assets before registering them on the owner.,ghidra + rizin + llvm-objdump + strings
 0x004858e0,1677,vehicle_visual_build_exhaust_running_gear_track_and_mantlet_attachment_children,bootstrap,thiscall,inferred,objdump + local disassembly + rdata literal inspection,2,"Broader vehicle-side child-builder under `vehicle_visual_init_running_gear_and_smoke_effects` `0x00485760`. The helper formats and allocates one attachment child for `%1_ExhaustSmoke.3dp`, one payload record for `%1_MuzzleFlash.3dp`, then builds and registers a larger running-gear strip including `%1_RoadWheelL%2.3dp`, `%1_RoadWheelR%2.3dp`, `%1_IdlerWheelL.3dp`, `%1_IdlerWheelR.3dp`, `%1_DriveWheelL.3dp`, `%1_DriveWheelR.3dp`, `%1_TrackL.3dp`, `%1_TrackR.3dp`, and `%1_MantletLight1.3dp`. Along that path it publishes child handles through `0x0052d8a0/0x0052d9a0`, derives local triplet bands through `0x0052e780`, and uses `0x0052db10/0x0052dc00` to materialize and threshold-bucket grouped packet rows on the two running-gear child roots at `[this+0x232]` and `[this+0x236]`. Current evidence is strongest for the exhaust, wheel, track, and mantlet attachment-child builder rather than the top-level vehicle visual constructor itself.","objdump + local disassembly + rdata literal inspection + vehicle-visual correlation + grouped-subrecord correlation"
 0x004883f0,325,scenario_text_export_append_numbered_entry,scenario,cdecl,inferred,ghidra-headless,4,Formats and appends one numbered translation entry into the scenario-text export buffer. It duplicates the source text applies the export wrapper template through helper formatters and appends the finished block through 0x531030 while updating the running non-comment word count at 0x006cfca0.,ghidra + rizin + llvm-objdump + strings
 0x004886e0,3796,scenario_text_export_build_language_file,scenario,cdecl,inferred,ghidra-headless,4,Builds one MAPS\\%s.lng scenario-text export for the active map and returns the non-comment word count. It writes translator guidance and section headers then walks map briefing territory city geographic-label station company and event collections appending numbered entries through 0x004883f0 before finalizing the output buffer.,ghidra + rizin + llvm-objdump + strings
 0x00487450,153,shell_open_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,3,Allocates and shows the dedicated TigerTank shell viewer object when no viewer is active. It samples shell-owned placement data allocates a 0x434-byte object initializes it through 0x00485760 with the TigerTank title and stores the resulting viewer pointer in 0x006cfc8c.,ghidra + rizin + llvm-objdump + strings
@ -1035,7 +1121,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00504590,468,shell_station_detail_present_scenario_station_connection_triplet_popup,shell,cdecl,inferred,objdump + local disassembly + caller inspection + format-string correlation,3,"Formats and presents the scenario-latched `StationDetail.win` popup beneath action controls `0xb3b7` and `0xb3b8`. After validating the current station from detail-manager state `0x006d0818+0x90`, the helper walks the selected station's per-destination table rooted at `[station+0x30]`, skips invalid or self station ids, copies each other station name into the local text buffer, and then appends three per-destination scalar lanes from the current station's five-byte-stepped metric arrays. Active lanes format through the local `%1 : ` and ` %5.2f` helpers at `0x005d16f0` and `0x005d16e8`, while missing lanes fall back to `N/C` at `0x005d16e0`; the stacked result is then published through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16e8`. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610` when scenario latch `[0x006cec74+0x1db]` is set, so the safest current read is a scenario-side station connection triplet popup rather than an ordinary haul or candidate-service branch.","objdump + local disassembly + caller inspection + format-string correlation + scenario-latch correlation"
 0x00504770,786,shell_station_detail_present_to_from_haul_stats_popup,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats and presents the `StationDetail.win` hauled-traffic popup for one of the two `To` or `From` summary widgets. The helper validates the current station from detail-manager state `0x006d0818+0x90`, resolves the selected station record through `0x006cec20`, and then chooses the localized direction strings `676` `...hauled TO this station.` or `679` `...hauled FROM this station.` plus the singular or plural `load` and `loads` labels `677/678` based on the triggering control id `0xb3f6` versus `0xb3f7`. It formats the current-year and lifetime load and value totals through the station haul-stat helpers at `0x0047d7e0` or `0x0047d7f0`, then presents the final popup text through the shell message-box path at `0x00538c70`. Current grounded owner is the neighboring `To` or `From` summary-widget builder at `0x00505150`.","objdump + RT3.lng strings + caller inspection + hauled-traffic popup correlation"
 0x00504a90,70,shell_station_detail_clear_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Clears the active candidate-service preview owned by `StationDetail.win`. The helper first resets the shared `(placed-structure id, candidate id)` pair at `0x005ee4fc` and `0x005ee500` through `0x0043f610`, then tears down the local station-detail preview latch at `[this+0x7c]` and decrements the sibling global refcount `0x0062be84` when that preview was armed. When the live world owner at `0x0062c120` is in the matching preview-capable mode gate rooted at `[+0x2171]` and `[+0x2175]`, it tails into the neighboring world-side clear path at `0x00452d30`. Current grounded callers are the station-detail selection reset branches around `0x00504bca`, `0x00504bda`, and the later cleanup family at `0x00505bff` and `0x00505c0a`.","objdump + caller inspection + world-preview correlation"
-0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `0x00452f60`, `0x00452d80`, `0x00452db0`, and `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation"
+0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active` `0x00452f60`, `world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero` `0x00452d80`, `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active` `0x00452db0`, and `world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid` `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation"
 0x00504ba0,796,shell_station_detail_update_candidate_service_entry,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Updates one candidate-service entry inside `StationDetail.win`. With zero in the first stack slot the helper either re-arms the globally remembered candidate through `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` or clears the current preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`. On the ordinary nonzero path it validates the current station from detail-manager state `0x006d0818+0x90`, rejects disallowed modifier combinations from `0x006d4018+0xa8c`, resolves the candidate from `0x0062ba8c`, and then either updates the hover anchor at `0x006d16fc/0x006d1700` or re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` to format the visible entry text. Current grounded text lanes use localized ids `681`, `682`, and `2813` for the loads-available, current-price, and average-profit explanation strings, plus ids `688` and `689` for the nearby-structure jump text. This is the clearest shell-side owner above the active candidate-service preview pair and the station-detail candidate service readout.","objdump + RT3.lng strings + caller inspection + service-preview correlation"
 0x00504bea,722,shell_station_detail_format_candidate_local_service_summary,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the candidate-local-service summary lane inside `StationDetail.win`. The helper validates the current station id from the detail manager through collection `0x006cec20`, resolves the candidate record through `0x0062ba8c`, and when the ordinary station-detail path is active it re-enters `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` before querying `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`. It then formats the visible candidate text using localized ids `681` `%1: Loads available: %2`, `682` `Current Price: %1`, and the explanatory text `2813` `Prices shown are the average profit per load for delivering %1 from %2 to that station...`; neighboring branches also use localized ids `688` and `689` for the nearby-structure jump affordance. This now looks like the shell-side candidate-service readout above the same local service metric lane used by the station freight and express summaries.","objdump + RT3.lng strings + caller inspection + service-query correlation"
 0x00505150,796,shell_station_detail_build_to_from_haul_summary_widget,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Builds one of the two `To` or `From` hauled-traffic summary widgets inside `StationDetail.win`. The helper chooses the localized heading `686` `To` or `687` `From` from its first argument, paints a bounded 10-step summary strip from the supplied float lane and the paired station haul-stat queries at `0x0047d7e0` or `0x0047d7f0`, and formats the one-line direction-specific labels and totals through the same `load` or `loads` family later used by the popup callback. On first build it also registers the matching control id `0xb3f6` or `0xb3f7` through callback `shell_station_detail_present_to_from_haul_stats_popup` at `0x00504770`, so the same widget owns both the visible `To` or `From` strip and the click-through stats popup. Current grounded caller is the larger station-detail refresh pass at `0x00506610`, which constructs the `To` and `From` widgets back to back.","objdump + RT3.lng strings + caller inspection + control registration correlation"
@ -1043,6 +1129,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00505760,1159,shell_station_detail_refresh_candidate_service_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the visible candidate-service row lane inside `StationDetail.win`. The helper counts currently active candidate-service entries through `placed_structure_count_candidates_with_local_service_metrics` at `0x0047e330`, resolves each visible row candidate through the neighboring ordinal helper at `0x0047e620`, and then colors and formats the row from the candidate-local-service metrics, the candidate display name, and the same localized strings `681`, `682`, and `2813` used by `shell_station_detail_update_candidate_service_entry`. It registers the per-row click path through callback `shell_station_detail_update_candidate_service_entry` at `0x00504ba0`, keeps the selected and hovered candidate ids in the globals `0x006d16f8` and `0x006d16f4`, and toggles the current preview highlight as rows are rebuilt. Current grounded caller is the broader station-detail refresh pass at `0x00506610`.","objdump + RT3.lng strings + caller inspection + candidate-service row correlation"
 0x00504ec0,644,shell_station_detail_refresh_class_3_or_4_train_service_matrix,shell,thiscall,inferred,objdump + local disassembly + caller inspection + RT3.lng string-id correlation,3,"Alternate `StationDetail.win` refresh branch for selected station classes `3` and `4`. After validating the current station and republishing the station name through helper root `0x006d16e4`, the helper rebuilds a five-row by two-column train-service matrix: the column headers come from localized ids `684` `Trains Serviced` and `685` `Trains Maintained`, the per-row category labels resolve through the world-side lookup table at `0x006cec78+0x46a84` plus `0x0053de00/0x00552560`, and the underlying counts come from the station-side integer lanes at `0x0047d800`. When the detail view is not already marked live it also rebuilds the shared popup-capable haul widget lane and reuses `shell_station_detail_present_to_from_haul_stats_popup` `0x00504770` as the click-through callback. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610`, which routes class-`3/4` stations into this helper instead of the ordinary nearby-structure, haul-summary, and candidate-service strip.","objdump + local disassembly + caller inspection + RT3.lng string-id correlation + class-3-4-branch correlation"
 0x00506610,688,shell_station_detail_window_refresh_controls,shell,cdecl,inferred,objdump + local disassembly + caller inspection + child-helper correlation,4,"Broad refresh owner for the shell-side `StationDetail.win` family. The helper first validates the currently selected station id from detail-manager state `[0x006d0818+0x90]`, resolves the live station from collection `0x006cec20`, and publishes the upper summary lane through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16ec`. When scenario-side latch `[0x006cec74+0x1db]` is set it re-enters `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` for the paired action controls `0xb3b7` and `0xb3b8`; otherwise it checks the resolved candidate class byte `[candidate+0x8c]`, routes classes `3` and `4` into `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and for the ordinary branch it publishes the station name, rebuilds the nearby-structure jump lane through `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470`, rebuilds the `To` and `From` hauled-traffic widgets through `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150`, rebuilds the candidate-service rows through `shell_station_detail_refresh_candidate_service_rows` `0x00505760`, and finally marks the detail view live through `0x006d16f0 = 1`. Current grounded callers are the constructor-side control wiring under `shell_station_detail_window_construct` `0x005068c0` and the paired action-control callbacks on `0xb3b7/0xb3b8`, so this is the safest current read for the main StationDetail refresh owner rather than a narrower popup callback.","objdump + local disassembly + caller inspection + child-helper correlation + StationDetail control correlation"
 0x00505e50,766,shell_station_detail_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller inspection + control-range correlation,4,"Primary message dispatcher for the shell-side `StationDetail.win` panel rooted at singleton `0x006d16d8`. The helper validates the current selected station from the detail-manager state under `0x006d0818+0x90`, mirrors that station into live world latch `[0x006cec78+0x4cba]` on the message-`0` setup branch, clears or preserves the active candidate-service preview state under `0x006d16f8/0x006d16fc/0x006d1700`, and can leave the panel through `shell_detail_panel_transition_manager` `0x004ddbd0` when the selected station is no longer valid. The message-`0xca` branch owns two concrete row families: candidate-service controls `0xb4dc..0xb5a3`, which either hand off into the `Overview.win` lane through `0x004ddbd0(..., 9, ...)` plus `0x004f4970` when Ctrl is held or else re-arm or clear the world preview through `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` and `0x00504a90`; and nearby-structure controls `0xb40a..0xb413`, which resolve site ids through `0x0047dc90/0x0047dcb0`, transition the detail manager with mode `0x0a`, and optionally recenter the world view through `0x00433900` plus the target object's vtable `+0x5c` callback when no modal overlay is active. The message-`0x3ea` branch refreshes the dirty dynamic rows through `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`, then restyles control `0xb3f8` from selected-station byte `[station+0x5c9]` and re-arms the active preview if one is selected. The message-`0xcb` action band owns the paired navigation or selector toggles on `0xb3b3/0xb3b4`, the tutorial-gated back or escape branch beneath localized id `0xe8c`, and the lower `0xb3b5..0xb3bf` class-gated action dispatch that first checks selected-company ownership through `0x00504390/0x005043f0`, then resolves linked site and candidate class state through `0x0047de00`, `0x0040cec0`, and `0x0047fd50` before re-entering the world-side action helper strip under `0x00419590`. This is the current grounded owner above the already-mapped refresh helper `shell_station_detail_window_refresh_controls` `0x00506610`, not just one narrow control callback.","objdump + local disassembly + caller inspection + control-range correlation + StationDetail message-branch correlation"
 0x0050c500,426,shell_present_chairmanship_takeover_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player chairmanship-takeover outcome presenter used by the special election path. The helper resolves the target company from `0x006d1a0c`, chooses localized title id `626` `New Chairman Takes Over!!!` or `627` `Chairmanship Takeover Fails!!!`, formats the tally labels `628` `Votes in favor` and `629` `Votes Against`, and renders the final result dialog through the shell presentation callback rooted at `0x006d1a34`. Current grounded caller is `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` at `0x0050c940` on the single-player branch.","objdump + RT3.lng strings + caller inspection + takeover-result dialog correlation"
 0x0050c940,880,shell_resolve_chairmanship_takeover_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the special chairman's election, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the takeover of company `0x006d1a0c` by chairman profile `0x006d1a0e`, accumulates the affirmative share count into `0x006d1a30`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_chairmanship_takeover_vote_outcome_dialog` at `0x0050c500`; in multiplayer it formats localized id `3082` `Takeover attempt of '%1' by '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it transfers chairmanship through `0x00428a30`; on failure it stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.","objdump + RT3.lng strings + caller inspection + takeover-vote resolution correlation"
 0x0050ccc0,709,shell_company_detail_attempt_chairmanship_takeover_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` chairmanship-takeover flow against the currently selected company. The helper reads the caller's current share ownership in the target company, rejects insufficient holdings through localized id `623`, rejects recent failed takeover cooldown cases through id `624`, and otherwise opens the special chairman's election confirmation under id `625`. The grounded single-player path seeds the local takeover-election state at `0x006d1a08..0x006d1a38` and launches the follow-on election helper at `0x0050c940`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + takeover-election correlation"
@ -1065,6 +1152,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00507620,656,shell_station_pick_window_construct,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Constructs the shell-side `StationPick.win` helper window. The constructor binds the list control `0x80ea`, the scroll or selector controls `0x80e8` and `0x80e9`, publishes the helper at `0x006d1718`, and then populates the visible station rows from collection `0x006cec20`. The same family feeds the selected station id through `0x00622ae8`, normalizes list and scroll messages through `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event` `0x005075c0`, and returns the chosen id to the caller when the modal opener closes. Current grounded callers put this helper under the `StationList.win` selector branch rather than under the startup-company flow.","objdump + strings + caller inspection + helper correlation + StationPick normalization correlation"
 0x005076c0,501,shell_station_pick_window_populate_station_rows,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Populates the visible row set for the shell-side `StationPick.win` helper. The helper iterates collection `0x006cec20`, filters entries through `0x0047fd50`, sorts them by the display-name field at `[entry+0x46b]`, and publishes the resulting station names through the helper list control `0x80ea`. It also mirrors the chosen station ids back into the helper-local scratch arrays, updates one status lane through control event `0xaf`, and refreshes the visible row count through control event `0x66`. Current grounded caller is `shell_station_pick_window_construct` at `0x00507620`.","objdump + strings + caller inspection + collection iteration"
 0x005078c0,192,shell_station_pick_window_open_modal_and_return_selected_station_id,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Modal StationPick helper opener above `shell_station_pick_window_construct` `0x00507620`. If the live station collection `0x006cec20` is empty the helper returns `-1` immediately. Otherwise it allocates one `0x78`-byte helper object through `0x0053b070`, constructs the `StationPick.win` window, stores the live helper at `0x006d1718`, optionally nudges one presentation float at `[helper+0x05]` when caller flag `CL` is nonzero, brackets the modal show path through `0x00483450`, `0x00538f10`, `0x004834a0`, and `0x005389c0`, then destroys the helper, clears `0x006d1718`, and returns the selected station id from `0x00622ae8`. Current grounded caller is the side-selector branch inside `shell_station_list_window_handle_message` `0x005071e0`.","objdump + caller inspection + local disassembly + modal-helper correlation"
 0x00505bf0,188,shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly + helper-root correlation,3,"Primary `StationDetail.win` destructor rooted at vtable `0x005d1748`. The helper first restores that same vtable, clears the active candidate-service preview pair through two calls into the world-side reset helper `0x0043f610`, drops the local preview latch `[this+0x7c]` together with sibling refcount `0x0062be84`, optionally re-enters the world-side preview clear path `0x00452d30` when the live world owner at `0x0062c120` is still in the matching preview-capable mode gate, releases the five shell helper handles at `0x006d16dc`, `0x006d16e0`, `0x006d16e4`, `0x006d16e8`, and `0x006d16ec` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d16d8`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current grounded caller is the shell detail-panel teardown side at `0x004dd9fa`.","objdump + vtable scan + local disassembly + helper-root correlation + preview-teardown correlation"
 0x00505cb0,382,shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class,shell,fastcall,inferred,objdump + local disassembly + caller inspection + collection-walk correlation,3,"Direction-driven station-selection helper beneath the `StationDetail.win` family. The first register argument in `ECX` is a signed step direction, and the helper first validates the current selected station from detail-manager state `0x006d0818+0x90`, resolves that station's owner through `0x0047efe0`, and gets its current live-slot position in collection `0x006cec20`. It then walks the live station collection circularly by the requested direction until it finds another entry that passes the same station-or-transit-site class allowlist `0x0047fd50` and shares the same linked company id. When a match is found it releases the current global iteration root through `record_collection_release_global_iteration_root_0x6acd40_if_present` `0x004557b0`, republishes the selected station into the shell detail-panel family through `0x004dd8a0`, and, when no modal overlay is active under `[0x0062be68+0x60]`, recenters the world view through `shell_world_view_center_on_object_with_mode_specific_zoom_policy` `0x00433900` before tail-calling the target object's vtable `+0x5c` callback. This is the current grounded owner for StationDetail next-or-previous station stepping rather than a generic collection iterator.","objdump + local disassembly + caller inspection + collection-walk correlation + owner-filter correlation"
 0x00505e30,10,shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `+1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the broader shell command branch at `0x00440e0f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation"
 0x00505e40,8,shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `-1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the paired shell command branch at `0x00440f2f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation"
 0x004d4500,88,shell_ensure_editor_panel_window,shell,cdecl,inferred,objdump + analysis-context,4,Ensures the shell-side EditorPanel.win helper window rooted at 0x006d07b4 exists. When the panel is absent it allocates a 0x7c-byte window object seeds the vtable at 0x005d0cb8 binds the EditorPanel.win resource through 0x0053fa50 publishes the object to the shell runtime through 0x00538e50 event 0x1e and then runs the shared panel-open helper at 0x004d4160.,objdump + analysis-context + strings
 0x004dc670,368,shell_file_options_dialog_construct,shell,thiscall,inferred,objdump + strings,4,Constructs the shared shell file-options dialog rooted at fileopt.win. The helper clears the three downstream branch flags at 0x006d07f8 0x006d07ec and 0x006d07f0 binds the fileopt.win resource through 0x0053fa50 publishes the object to the shell runtime and populates several mode-dependent labels and status text before user input is handled.,objdump + strings
 0x004dc7d0,14,shell_has_file_options_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared shell file-options dialog rooted at `0x006d0800`. The helper returns `1` when the live `fileopt.win` object is present and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this check now sits beside the `LoadScreen` and custom-modal probes.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
@ -1493,6 +1584,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00482d10,110,runtime_query_cached_local_exe_version_float,simulation,thiscall,inferred,objdump + local disassembly,3,"Returns one cached local executable version as a float-like `major + minor/100` value. On first use the helper queries the version-info resource of the literal stem `RT3.EXE` at `0x005cec18` through `0x0055d9c0`, splits the returned packed dword into low and high 16-bit words, converts them into one float as `hi + lo/100.0`, caches the result at `0x006cec5c`, and returns that cached value on later calls. The sibling formatter `0x00482d80` and the rounded hundredths query `0x00482e00` both consume the same source, which now makes this the clearest current owner for the local `1.03/1.04/1.05/1.06`-style version float rather than a gameplay progress value.","objdump + local disassembly + version-resource correlation"
 0x00482d80,128,runtime_query_cached_local_exe_version_string,simulation,thiscall,inferred,objdump + local disassembly + string inspection,3,"Returns one cached local executable version string formatted from the same `RT3.EXE` version-info source used by `0x00482d10`. On first use the helper queries the packed local version dword through `0x0055d9c0`, formats it with the literal pattern `%d.%02d` at `0x005ced5c`, allocates one small shell string object at `0x006cec24`, and returns that cached string on later calls. Current grounded callers include `multiplayer_session_event_publish_registration_field` `0x0046a6c0` and the later shell text path at `0x00503254`, which makes this the clearest current local version-string owner.","objdump + local disassembly + string inspection + caller xrefs + version-resource correlation"
 0x00482e00,70,runtime_query_hundredths_scaled_build_version,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared rounded hundredths-scaled build-version query used by route, company, train, and world-side logic. In the ordinary local path the helper consults the cached local executable version float from `runtime_query_cached_local_exe_version_float` `0x00482d10`, adds the fixed offset `0.0001`, multiplies by `100.0`, and rounds the result through the CRT helper at `0x005a10d0`, which makes the local outputs line up with integer build values such as `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`. When the multiplayer-side runtime rooted at `0x006cd8d8` is active, or when the local scenario-state gate at `0x004349a0` reports a later mode, it instead delegates to the multiplayer companion path at `0x0046a4b0`, which can reuse a cached network-side integer at `0x006cd96c` or scan live session-peer version fields before falling back to the same local executable-version path. Current grounded callers include the city-connection route builder `0x00402cb0`, the auxiliary tracker pair-metric dispatcher `0x004a65b0`, and numerous neighboring world-side maintenance branches. This is no longer best-read as a gameplay progress or era index: the recovered threshold pattern is a shared executable or session build-version gate.","objdump + caller xrefs + local disassembly + multiplayer-fallback correlation + version-resource correlation + threshold-correlation"
 0x00482e50,271,shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shell-state owner beneath `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` and the setup-mode selector `0x00502c00`. The helper writes the caller-supplied boolean into editor-map mode field `[this+0x68]`, then splits its refresh side effects by that target mode. When the target mode is `0` it re-enters `0x004d44a0` and `0x004dfda0` when the detail-panel controller `0x006d0818` is live, refreshes the active world root through `world_compute_transport_and_pricing_grid` `0x0044fb70` when `0x0062c120` exists, and then re-enters `shell_apply_graphics_option_runtime_effects` `0x00484d70` with mask `0x0d` and stack flag `1`. When the target mode is nonzero it instead re-enters `shell_ensure_editor_panel_window` `0x004d4500` before the same `0x00484d70(0x0d, 1)` tail. Current evidence is strong enough to treat this as the real editor-map-mode setter plus dependent detail-panel, world, and graphics refresh owner.","objdump + local disassembly + caller inspection + editor-map-mode correlation + side-effect correlation"
 0x00483680,17,shell_command_cycle_display_resolution_forward,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,2,"Small registered shell command beneath action id `0x78` and localized label id `0x0d52`. The helper fixes forward step `+1` in `ECX` and tail-calls `shell_cycle_display_resolution_and_publish_status` `0x00483780`. Current evidence is strong enough for the command-wrapper role and step direction, but not yet for a tighter player-facing label beyond the display-resolution cycle.","objdump + command-registration correlation + local disassembly + caller inspection + wrapper correlation"
 0x00483780,527,shell_cycle_display_resolution_and_publish_status,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Broader display-resolution cycle owner reached from the small forward and backward wrappers at `0x00483680`, `0x00483990`, and `0x004839a0`. The helper requires live shell presenter root `0x006d4024`, reads the current display mode through the active mode table and the paired width-bucket tables at `0x00620e64` and `0x00620e7c`, derives one bounded six-step cycle from the caller-supplied signed step in `ECX`, selects the next supported resolution pair, and applies that requested size through `0x005206b0`. It then formats and publishes a status string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, refreshes dependent presentation state through `0x004625b0`, persists the graphics config through `0x00484910(1)`, and re-enters the neighboring shell follow-on `0x004821d0`. Current evidence is strong enough to treat this as the shared display-resolution cycle-and-apply owner rather than a narrower presenter-only math helper.","objdump + local disassembly + caller inspection + display-mode-table correlation + status-publish correlation"
 0x00483990,8,shell_cycle_display_resolution_forward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `+1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain forward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation"
 0x004839a0,8,shell_cycle_display_resolution_backward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `-1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain backward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation"
 0x004839b0,37,shell_setup_query_file_list_uses_map_extension_pattern,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns whether the current `Setup.win` file-list scan should enumerate the map-family extension pattern `*.gm*` instead of the saved-game pattern `*.smp`. The helper checks the live shell state rooted at `0x006cec74`: it requires the broad setup/file gate at `[shell+0x1bf]`, then returns true when either `[shell+0x68]` is nonzero or the current setup-side mode flag at `[this+0x6c]` equals `1`. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, where the result chooses the search literal at `0x005c9d14` versus `0x005c9d1c`.","objdump + literal inspection + caller correlation + setup-file-root correlation"
 0x004839e0,37,shell_setup_query_file_list_root_dir_name,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns the root directory name used by the current `Setup.win` file-list scan. When `[this+0x6c] == 2` it returns the literal `data\\tutorial` at `0x005ca338`; otherwise it returns `maps` at `0x005ced78` when `[this+0x68]` is nonzero or `[this+0x6c] == 1`, and falls back to `saved games` at `0x005ced80` for the ordinary setup-side load family. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which formats the returned root through the literal `%s\\` at `0x005c9d10`.","objdump + literal inspection + caller correlation + setup-file-root correlation"
 0x00433260,400,shell_setup_filter_candidate_file_by_dataset_and_payload_flags,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Filters one candidate `Setup.win` filename against the current dataset id and the small payload-flag family recovered from the staged bundle. Editor-map mode short-circuits to success immediately through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`; otherwise the helper builds one rooted path from `shell_setup_query_file_list_root_dir_name` `0x004839e0`, opens the candidate bundle through `0x00530c80`, reads the small chunk family `0x2ee0/0x3c2` through `0x00531150/0x00531360`, and then applies dataset-specific acceptance rules to three recovered flag bytes. The current split is tighter now: dataset `10` requires the sandbox-side payload-flag family, dataset `9` requires a different nonzero payload-flag family, dataset `8` stays on the plain non-sandbox path, and dataset `12` adds one literal stem check through `0x005c9cf8` before the later payload-flag gate. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which uses this helper as the real extension-and-payload filter beneath the file-backed setup lists.","objdump + local disassembly + caller correlation + setup-dataset correlation + payload-flag gating correlation"
@ -1719,7 +1815,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00529fd0,793,shell_build_cell_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the animated-quad cell sweep over the grid returned by 0x00533e30 depending on the boolean mode argument. It gates on configuration bytes [this+0x29+0x5f] or [this+0x29+0x60] walks candidate-cell offsets from [this+0x374f] selects the primary list at [cell+0x1c] or alternate list at [cell+0x20] initializes the layout-state vertex24 table once through 0x0054bb70 streams each list through 0x00567c70 or 0x00567ce0 and then commits the accumulated span through 0x00545c50 before restoring presentation state.,ghidra + rizin + llvm-objdump
 0x0052a2f0,736,shell_build_ranked_overlay_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds a ranked secondary vertex24 overlay pass over the cell grid returned by 0x00533e50 and two object collections at [this+0x85] and [this+0x81]. It computes a per-frame packed tint from the current shell brightness gathers and sorts candidate items by priority field [item+0x1d9] binds the layout-state vertex24 table and emits accepted items through 0x00524780 and 0x00554e70 before committing the span.,ghidra + rizin + llvm-objdump
 0x0052a5d0,1784,shell_build_ranked_object_billboard_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the sibling ranked object-overlay pass gated by config byte [this+0x29+0x5e]. It merges candidates from the object collections at [this+0x85] and [this+0x81] sorts them by priority field [item+0x1d9] prepares billboard basis state through 0x00566670 and emits accepted entries through 0x00554e70 before committing the vertex24 span.,ghidra + rizin + llvm-objdump
-0x0052dd00,864,shell_expand_segment_record_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one active presentation-batch record into three transformed 0x20-byte segment records inside the caller-provided buffer; each output record is two vec3 blocks at +0x00 and +0x0c plus scalar slots at +0x18 and +0x1c. The selected batch record supplies a source-array pointer at +0x04 a source-count at +0x0c and 0x4c-byte packed source entries that carry four point sources plus three scalar pairs for the emitted triplet.,ghidra + rizin
+0x0052dd00,864,runtime_object_emit_materialized_group_packet_rows_as_segment_record_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared segment-record emitter beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. Starting from the currently selected group header `[this+0x14/+0x3a/+0x21]`, the helper resolves the active materialized row payload at `[row+0x35]`, the current packet source span from `[record+0x04/+0x08/+0x0c]`, and one shell-presenter-derived count through `0x0051f090`, then emits `count*3` transformed `0x20`-byte segment records into the caller-provided buffer while advancing the output-count accumulator. In the nonnegative `[this+0x69]` branch each output record carries two vec3 blocks at `+0x00` and `+0x0c` plus scalar slots at `+0x18` and `+0x1c`; in the negative branch it emits the same triplet family with the reduced scalar form. Current grounded caller is the layout-state presentation owner `0x005490b0`, so this is the safest current read for emitting materialized group packet rows as one segment-record window rather than a shell-only batch expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + segment-record-window correlation"
 0x0053f000,238,mouse_cursor_select_shape_id_load_handle_and_refresh_shell_presentation,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Core `MouseCursor.cpp` selector over one requested cursor-shape id. The helper normalizes negative ids to zero, optionally short-circuits when the requested id already matches `[this+0x04]`, refreshes the local elapsed-tick latch `[this+0x24]` through `0x0051d890`, toggles cursor visibility through `0x0051e810` on the special `0 -> nonzero` and `nonzero -> 0` transitions, lazily loads the corresponding native cursor handle into table `0x00ccba60` through `0x0053ee90`, publishes that handle through the USER32 cursor-set import, resolves one shell presentation payload through `0x0053d110` when the requested id is nonzero, releases the previous payload through `0x0053c000`, and then stores the new payload at `[this+0x00]` plus the selected id at `[this+0x04]`. Current grounded callers include shell modal setup `0x004c98a0`, several detail-panel mode publishers, and the rest of the mouse-cursor owner family, so this is the safest current read for the live cursor-shape selector plus presentation refresh owner.","objdump + caller inspection + local disassembly + source-string correlation + cursor-handle-table correlation"
 0x0053f0f0,115,mouse_cursor_enter_hidden_or_captured_mode_and_clear_selection,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Mode-transition branch in the `MouseCursor.cpp` owner family. When local state `[this+0x18]` is still clear, the helper first pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, then calls one zero-argument USER32 import, marks `[this+0x18] = 1`, clears `[this+0x14]`, seeds `[this+0x08] = 1`, mirrors shell latch `[0x006d4024+0x11473e] = 1`, and, when a non-`-1` cursor id is active, forces cursor visibility down through `0x0051e810(0)` before re-entering `0x0053f000(-1, 0, 0)`. Current grounded callers are the graphics-backend service branches `0x004ffb64`, the coarse mouse-cursor service `0x0053f400`, and the local constructor sync at `0x0053f330`, so the safest current read is a hidden-or-captured mode entry branch rather than a generic state toggle.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
 0x0053f170,159,mouse_cursor_begin_pending_release_from_hidden_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Release-side mode-transition branch in the `MouseCursor.cpp` owner family. When `[this+0x14]` is still clear, the helper conditionally forwards the shell window handle through one one-argument USER32 import when graphics mode byte `[0x006d4024+0x114226]` is active, pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, re-enters `0x0053f000(0, 0, 0)` to clear the live cursor selection, clears `[this+0x18]`, sets `[this+0x14] = 1`, zeroes shell latches `[0x006d4024+0x11473a/+0x11473e]`, and, when local byte-flag dword `[this+0x08]` is nonzero, raises cursor visibility back through `0x0051e810(1)`. Current grounded callers are the graphics-backend service-and-repaint branch `0x004ffafb`, the coarse mouse-cursor service `0x0053f400`, and the local inside-view watcher `0x0053f450`, so this is the safest current read for the begin-release transition out of the hidden mode.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
@ -1732,7 +1828,44 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x0053f400,80,mouse_cursor_service_coarse_global_mode_latches,shell,cdecl,inferred,objdump + caller inspection + local disassembly + family correlation,3,"Coarse service branch over the global `MouseCursor.cpp` mode latches `0x00ccbb18/0x00ccbb1c/0x00ccbb24/0x00ccba58/0x00ccba5c`. The helper decrements countdown `0x00ccbb24`, and when that reaches zero it dispatches either into `0x0053f0f0` or `0x0053f170` from the pending global owners, then mirrors the surviving globals back into shell latches `[0x006d4024+0x11473e/+0x11473a]`. Current grounded caller is the frame updater `0x0053f4e0`.","objdump + caller inspection + local disassembly + family correlation + shell-latch correlation"
 0x0053f450,134,mouse_cursor_refresh_inside_active_view_and_toggle_visibility_hint,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Small view-sensitive refresh in the `MouseCursor.cpp` family. The helper samples the current `cursor inside active view` predicate through `shell_input_cursor_inside_active_view` `0x0054f540`, compares that boolean against local state `[this+0x08]`, and on changes updates the same state plus toggles cursor visibility through `0x0051e810(0/1)` when hidden mode `[this+0x18]` is active. On the fallback path it also consults the global shell-side cursor owner at `0x00ccbb20` and, when the global `ShowCursor` refcount is positive, refreshes the coarse elapsed-tick latch `[this+0x24]` or re-enters `0x0053f000(1, 1, 0)`. Current grounded callers are `mouse_cursor_update_frame_state` `0x0053f4e0` and the shell camera action helper `0x004e0780`, so this is the safest current read for the inside-view watcher plus visibility hint owner.","objdump + caller inspection + local disassembly + source-string correlation + inside-view correlation"
 0x0053f4e0,739,mouse_cursor_update_frame_state,shell,thiscall,inferred,ghidra-headless,4,Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0.,ghidra + rizin + llvm-objdump + strings
-0x0052e060,537,shell_expand_vertex24_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Sibling emitter for the same active presentation-batch record family; expands each 0x4c-byte packed source entry into three 0x18-byte vertex24 records in the caller-provided buffer. Each emitted record stores a vec3 at +0x00 a style dword from [this+0x43] at +0x0c and scalar slots at +0x10 and +0x14 while the output-count accumulator advances by count*3.,ghidra + rizin
+0x0052e060,537,runtime_object_emit_materialized_group_packet_rows_as_vertex24_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Vertex24-emission sibling to `0x0052dd00` beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. The helper resolves the same selected group header, active materialized row payload at `[row+0x35]`, and packet source span from `[record+0x04/+0x08/+0x0c]`, then emits `count*3` transformed `0x18`-byte vertex24 records into the caller-provided buffer while advancing the output-count accumulator. Each emitted record stores one vec3 at `+0x00`, style dword `[this+0x43]` at `+0x0c`, and scalar lanes at `+0x10/+0x14`, with the same nonnegative-versus-negative `[this+0x69]` split used by `0x0052dd00`. Current grounded caller is the shell-side presentation branch `0x00528821`, so this is the safest current read for emitting materialized group packet rows as one vertex24 window rather than a shell-only triplet expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + vertex24-window correlation"
 0x0052cd20,21,embedded_view_controller_copy_eye_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny copy helper over the embedded world-view controller base. The function copies the current eye triplet `[this+0x1c/+0x20/+0x24]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the world-view wrapper `0x00527e5e`, which uses it together with the focus-triplet sibling `0x0052cd40`, so this is the safest current read for the packed eye-triplet copy helper rather than a broader serializer.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052cd40,21,embedded_view_controller_copy_focus_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Packed focus-triplet sibling to `0x0052cd20` over the same embedded controller base. The helper copies the current focus triplet `[this+0x04/+0x08/+0x0c]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the same world-view wrapper `0x00527e6a`, so this is the safest current read for the packed focus-triplet copy helper rather than another generic memcpy leaf.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052cd60,28,embedded_view_controller_copy_eye_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out eye-triplet copy helper over the embedded world-view controller base. The function writes current eye lanes `[this+0x1c/+0x20/+0x24]` into three separate caller out-pointers. Current grounded callers include the world-view wrappers `0x00524089`, `0x00528226`, `0x00528384`, `0x00529508`, `0x00529c02`, `0x0052a79a`, the local helper strip around `0x0052bb01`, and sibling controller-bridge calls inside `0x00548382/0x005484de`, so this is the safest current read for the split eye-triplet export helper rather than a subtype-specific query.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052cd80,28,embedded_view_controller_copy_focus_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out focus-triplet sibling to `0x0052cd60` over the same embedded controller base. The function writes current focus lanes `[this+0x04/+0x08/+0x0c]` into three separate caller out-pointers. Current grounded callers include world-side and setup-side branches `0x0042ac39`, `0x0042ad67`, `0x00487483`, `0x0052ad16`, `0x0052bad3`, and sibling controller-bridge calls inside `0x0054836c/0x005484c8`, so this is the safest current read for the split focus-triplet export helper rather than a generic outparam block.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052cda0,28,embedded_view_controller_copy_aux_triplet_0x2c_0x34_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small auxiliary-triplet export helper over the embedded controller base. The function writes lanes `[this+0x2c/+0x30/+0x34]` into three separate caller out-pointers. Current grounded caller is the neighboring layout-state bridge `0x00548398`, so this is the safest current read for exporting the auxiliary cached triplet at `+0x2c..+0x34` rather than a named world coordinate without broader owner evidence.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052cdc0,22,embedded_view_controller_store_aux_triplet_0x2c_0x34,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter companion to `0x0052cda0` over the same controller base. The helper stores three caller dwords into auxiliary triplet `[this+0x2c/+0x30/+0x34]`. Current grounded callers are the setup-side world-view branches `0x004592ef` and `0x00459b7b`, so this is the safest current read for the auxiliary-triplet store helper rather than a broader camera-mode owner.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052cde0,48,embedded_view_controller_set_dirty_latch_0x64_and_optionally_snapshot_focus_eye_heading_distance_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Dirty-latch helper over the embedded controller base. The function stores the caller boolean into byte `[this+0x64]`; when the boolean is zero it also snapshots the current heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the cached companion band `[this+0x44/+0x48/+0x38/+0x3c/+0x40/+0x4c]`. Current grounded caller is `0x0052c2ef`, so this is the safest current read for the primary dirty-latch and cached focus-eye-orientation snapshot helper rather than a generic flag setter.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052ce20,54,embedded_view_controller_set_dirty_latch_0x65_and_optionally_snapshot_focus_heading_distance_band_0x72_0x86,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Secondary dirty-latch helper over the same controller base. The function stores the caller boolean into byte `[this+0x65]`; when that boolean is zero it snapshots heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the secondary companion band `[this+0x72/+0x76/+0x7a/+0x7e/+0x82/+0x86]`. Current grounded caller is the later owner branch `0x0052cc5d`, so this is the safest current read for the secondary dirty-latch and cached snapshot helper rather than a generic mode toggle.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052ce60,5,embedded_view_controller_raise_dirty_latch_0x64,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny leaf over the embedded controller base that only sets dirty byte `[this+0x64] = 1`. Current evidence grounds it as a direct dirty-latch raiser and does not yet justify a broader semantic name.","objdump + local disassembly + controller-base correlation"
 0x0052ce70,43,embedded_view_controller_refresh_shell_presenter_scalar_0x6a_and_consume_dirty_latch_0x64,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small shell-state synchronization helper over the same controller base. The function compares cached scalar `[this+0x6a]` against current shell presenter dword `[0x006d4024+0x114222]`, raises dirty byte `[this+0x64]` and stores the new shell scalar when they differ, then returns the prior dirty state and clears `[this+0x64]` back to zero. Current grounded caller is `0x0052c29c`, so this is the safest current read for the shell-scalar refresh plus dirty-latch consume helper rather than a generic poll routine.","objdump + caller inspection + local disassembly + controller-base correlation + shell-scalar correlation"
 0x0052cea0,19,embedded_view_controller_copy_heading_pitch_pair_to_two_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny heading/pitch export helper over the embedded controller base. The function copies lanes `[this+0x10/+0x14]` into two caller out-pointers. Current grounded caller is the later support branch `0x00566700`, so this is the safest current read for the heading-pitch pair copy helper rather than a broader serializer fragment.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052cec0,49,embedded_view_controller_sample_owner_height_at_current_eye_xz,shell,thiscall,inferred,objdump + local disassembly,1,"Small owner-height query helper beneath the same controller base. The function scales current eye X/Z lanes `[this+0x1c/+0x24]` through the recurring world-unit constants, then forwards the resulting pair into owner handle `[this+0x6e]` through `0x00534490`. Current evidence grounds it as the direct sampled-height query at the controller's current eye X/Z position.","objdump + local disassembly + controller-base correlation + sampled-height correlation"
 0x0052cf00,436,embedded_view_controller_query_owner_height_peak_over_clamped_xy_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Broader owner-height extent query over the embedded controller base. The helper clamps the caller-supplied X and Y extent floats against lower bound `2.0` and against owner-derived width and height limits from `0x00533970/0x00533980`, samples an initial owner height through `0x00534490`, and then walks a rectangular neighborhood in repeated world-unit steps to keep the highest sampled height, returning that peak float. Current grounded callers are the current-eye wrapper `0x0052d0dc`, the world-view clamp owner `0x0045211f`, and the later support branch `0x0053037f`, so this is the safest current read for querying the peak sampled owner height across one clamped XY extent pair rather than a generic math loop.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation"
 0x0052d0c0,33,embedded_view_controller_query_owner_height_peak_over_current_eye_xz_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Current-eye wrapper over `0x0052cf00` in the embedded controller base. The helper scales current eye X/Z lanes `[this+0x1c/+0x24]` into owner-space extents and forwards them into the broader peak-height query `0x0052cf00`. Current grounded callers are the world-view clamp owners `0x00439942` and `0x0043ceec`, so this is the safest current read for the current-eye peak-height wrapper rather than a separate terrain query family.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation"
 0x0052d0f0,64,embedded_view_controller_query_normalized_scalar_band_contains_xy_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small range predicate over normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]` in the embedded controller base. The helper returns `1` only when the caller-supplied XY pair lies inside that stored scalar rectangle and `0` otherwise. Current grounded callers are the world-side branch `0x0045211f` and the later support branch `0x0053037f`, so this is the safest current read for the normalized-band containment predicate rather than a generic compare helper.","objdump + caller inspection + local disassembly + controller-base correlation + normalized-rect correlation"
 0x0052d140,29,embedded_view_controller_store_four_blend_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter over the embedded world-view controller base. The helper copies four caller-supplied dwords into scalar lanes `[this+0x50/+0x54/+0x58/+0x5c]` unchanged. Current grounded callers are the mode-`0x19` variant seed owners `0x0043a0a0`, `0x0043ace3`, the setup-side world-view branches `0x00459139`, `0x00459982`, and the later world-side owner `0x005208ad`, so this is the safest current read for the four-scalar controller-blend setter rather than a higher-level mode owner.","objdump + caller inspection + local disassembly + controller-band correlation"
 0x0052d180,91,embedded_view_controller_store_focus_triplet_and_mark_dirty_if_changed,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core focus-triplet setter beneath the embedded world-view controller base. The helper compares the incoming focus XYZ against the current stored triplet `[this+0x04/+0x08/+0x0c]`; when any component moves beyond the small epsilon at `0x005dd1c0` it sets dirty byte `[this+0x64] = 1`. It then stores the new triplet into `[+0x04/+0x08/+0x0c]`. Current grounded callers are the shell-input controller path `0x0043a1c3`, the transient-offset service `0x0043a54b`, the local clamp helper `0x00439820`, setup-side world-view branches `0x004592b8/0x00459b61`, and the runtime-object support strip `0x0052d440/0x0052bf65`, so this is the safest current read for the focus-triplet setter plus dirty-latch update rather than a generic vec3 copy.","objdump + caller inspection + local disassembly + controller-base correlation + dirty-latch correlation"
 0x0052d1e0,67,embedded_view_controller_store_eye_triplet_and_refresh_vertical_delta,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Eye-triplet setter beneath the same embedded controller base. The helper stores the caller eye XYZ into `[this+0x1c/+0x20/+0x24]`; when owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the new X/Z pair and writes the resulting vertical delta `eye_y - sampled_height` into `[this+0x66]`, otherwise it copies the eye Y lane directly into `[this+0x66]`. Current grounded callers are the local clearance-ring clamp `0x00439820`, the setup-side controller owners `0x00459139/0x004592b8/0x00459afe`, and the helper itself's paired rebuild path `0x0052d440`, so this is the safest current read for storing the eye triplet and refreshing the sampled vertical delta rather than a generic world-position setter.","objdump + caller inspection + local disassembly + controller-base correlation + vertical-delta correlation"
 0x0052d230,115,embedded_view_controller_query_focus_to_eye_distance_heading_and_pitch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pure query helper over the same controller base. Starting from the current focus triplet `[this+0x04/+0x08/+0x0c]` and eye triplet `[this+0x1c/+0x20/+0x24]`, the function can write the straight-line distance, one heading-like angle, and one pitch-like angle into up to three caller out-pointers. Current grounded caller is the world-side wrapper `0x0052fa59`, which consumes these as a bundled camera-state query, so this is the safest current read for the focus-to-eye distance and angle extractor rather than a standalone math primitive.","objdump + caller inspection + local disassembly + controller-base correlation + polar-query correlation"
 0x0052d2b0,178,embedded_view_controller_serialize_focus_eye_and_orientation_triplets,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared serializer for the embedded controller base. The helper writes the current focus triplet `[this+0x04/+0x08/+0x0c]`, distance or view-height lane `[this+0x18]`, heading and pitch lanes `[this+0x10/+0x14]`, and eye triplet `[this+0x1c/+0x20/+0x24]` into the caller stream through repeated `0x00531030` writes, followed by one fixed zeroed `0x14`-byte trailer. Current grounded caller is `world_view_store_camera_view_slot_snapshot` `0x00439ac0`, so this is the safest current read for the controller-base snapshot serializer rather than a generic stream writer.","objdump + caller inspection + local disassembly + camera-view correlation + controller-base correlation"
 0x0052d3e0,21,embedded_view_controller_clear_presenter_owner_slot_if_self,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny presenter cleanup leaf beneath the embedded controller base. When the live shell presenter exists and its owner slot `[0x006d4024+0x28]` still points at `this`, the helper clears that slot to null. Current grounded callers are the controller release owners `0x0043a58d` and `0x0043ac5c`, so this is the safest current read for the conditional presenter-owner clear helper.","objdump + caller inspection + local disassembly + presenter-owner correlation"
 0x0052d400,69,embedded_view_controller_rebuild_focus_triplet_from_eye_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Inverse rebuild helper for the same embedded controller base. Starting from the current eye triplet `[this+0x1c/+0x20/+0x24]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance or view-height lane `[this+0x18]`, the function reconstructs the implied focus triplet on the stack and then stores that triplet through `0x0052d180`. Current grounded caller is the world-view camera-restore branch `0x0043c960`, which adjusts heading before re-entering this helper, so this is the safest current read for rebuilding focus from eye-orientation-distance rather than another trig primitive.","objdump + caller inspection + local disassembly + controller-base correlation + focus-triplet correlation"
 0x0052d450,117,embedded_view_controller_rebuild_eye_triplet_from_focus_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core rebuild helper for the embedded controller base. Using the stored focus triplet `[this+0x04/+0x08/+0x0c]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance lane `[this+0x18]`, the function recomputes the eye triplet into `[this+0x1c/+0x20/+0x24]` by applying the usual trig decomposition. When owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the rebuilt X/Z pair and refreshes vertical delta `[this+0x66]`; otherwise it copies the rebuilt eye Y lane there directly. Current grounded callers are the controller reset or clamp helpers `0x0052d5bf`, `0x0052d646`, and the world-view side branch `0x0043e4ce`, so this is the safest current read for rebuilding the eye triplet from focus, orientation, and distance rather than a generic trig helper.","objdump + caller inspection + local disassembly + controller-base correlation + eye-triplet correlation"
 0x0052d4d0,143,embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small display-rect materializer beneath the embedded world-view controller base. The helper samples the active shell display width and height pair from `[0x006d4024+0x34 + [0x006d4024+0x11421e]*0x15]`, multiplies those two display metrics by the stored normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]`, rounds the four products through `0x005a10d0`, and writes the resulting integer rectangle corners through the caller out-pointers. Current grounded caller is the layout-state bridge `0x005482e0`, so this is the safest current read for materializing one active-display rect from the controller's normalized scalar band rather than a generic scaling helper.","objdump + caller inspection + local disassembly + controller-base correlation + display-rect correlation"
 0x0052d570,27,embedded_view_controller_rebind_base_vtable_and_clear_presenter_owner_slot,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny base-reset leaf for the embedded controller object. The helper restores the base vtable root `0x005dd1c8` at `[this]` and clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`. Current grounded callers are the world-view release path `0x0043a595`, the setup-side teardown path `0x00458258`, the world-side cleanup branches `0x00520d43` and `0x0052bfd3`, so this is the safest current read for the base-vtable rebind and presenter-owner clear leaf.","objdump + caller inspection + local disassembly + controller-base correlation"
 0x0052d5a0,144,embedded_view_controller_reset_scalar_bands_defaults_and_dirty_latches,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader initializer for the embedded controller base. The helper clears owner handle `[this+0x6e]`, sampled vertical delta `[+0x66]`, heading `[+0x10]`, several transient scalar lanes `[+0x44/+0x48/+0x60]`, focus and eye triplets `[+0x04..+0x0c]` and `[+0x38..+0x40]`, re-enters `0x0052d450`, seeds default scalar lanes such as `[+0x14]=0.2`, `[+0x18]=100.0`, `[+0x28]=100`, `[+0x30/+0x58/+0x5c]=1.0`, `[+0x4c]=100.0`, dirty byte `[+0x64]=1`, and sentinel `[+0x6a]=-1`, then copies the rebuilt heading or pitch defaults into `[+0x72/+0x76]` and `[+0x86]`. Current grounded callers are the world-view reset owner `0x0043a5a3`, the local constructor `0x0052d6d9`, and the later rebuild paths `0x0052d6d9/0x0052d869`, so this is the safest current read for the embedded controller-base reset and default seeding owner rather than a generic constructor stub.","objdump + caller inspection + local disassembly + controller-base correlation + reset-owner correlation"
 0x0052d640,131,embedded_view_controller_clamp_distance_against_sampled_eye_height_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Distance-clamp helper for the embedded controller base. The function first rebuilds the current eye triplet through `0x0052d450`, compares owner-derived metric `vtable[+0x0c]` against eye height `[this+0x20]`, and when the current distance or view-height lane `[this+0x18]` is too large it computes one reduced value from the current height gap, pitch sine, and the sampled vertical offset, stores the clamped result back into `[this+0x18]`, and rebuilds the eye triplet again through `0x0052d450`. Current grounded callers are the world-view heading and zoom-step paths `0x0043cb16/0x0043cc16`, the controller seed path `0x0043ce3a`, the motion wrapper `0x0043d09f`, and the local constructor `0x0052d744`, so this is the safest current read for the distance clamp and eye-triplet rebuild helper rather than a generic projection recompute.","objdump + caller inspection + local disassembly + controller-base correlation + distance-clamp correlation"
 0x0052d6f0,90,embedded_view_controller_seed_focus_distance_owner_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor-side seed helper for the embedded controller base. The function stores one caller-supplied owner handle into `[this+0x6e]`, seeds the focus triplet into `[this+0x04/+0x08/+0x0c]`, seeds distance or view-height lane `[this+0x18]` plus its copy `[this+0x4c]`, mirrors shell presenter scalar `[0x006d4024+0x114222]` into `[this+0x6a]`, derives one bucket-like value from `0x51f070(1)` into `[this+0x28]`, and then tail-calls `0x0052d640` to rebuild the eye triplet and apply any needed clamp. Current grounded callers are the world-view owner `0x0043ce0e` and the stream-load branches `0x0052d7da/0x0052d889`, so this is the safest current read for the seeded controller-base setup helper rather than a generic stream-load leaf.","objdump + caller inspection + local disassembly + controller-base correlation + seed-owner correlation"
 0x0052d750,260,embedded_view_controller_load_focus_eye_and_orientation_snapshot_from_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-load companion to the camera-view snapshot serializer `0x0052d2b0`. The helper first clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`, then reads the stored focus triplet `[+0x04/+0x08/+0x0c]` and distance lane `[+0x18]` through repeated `0x00531150` calls, resolves one owner handle from that focus or distance tuple through shell presenter helper `0x0051f090`, and re-enters `0x0052d6f0` to seed the controller base. After that it loads heading and pitch lanes `[+0x10/+0x14]`, eye triplet `[+0x1c/+0x20/+0x24]`, and consumes the trailing zeroed `0x14`-byte trailer. Current grounded caller is the world-view stream-load owner `0x0043ac30`, so this is the safest current read for loading one embedded controller snapshot from a stream rather than a generic byte-reader block.","objdump + caller inspection + local disassembly + stream-load correlation + camera-view correlation + controller-base correlation"
 0x0052d860,50,embedded_view_controller_construct_reset_and_seed_from_focus_distance_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor wrapper for the same embedded controller base. The helper rebinds base vtable `0x005dd1c8`, re-enters `0x0052d5a0` to reset and seed defaults, and then forwards one caller-supplied owner handle, focus triplet, and distance lane into `0x0052d6f0`. Current grounded callers are the placed-structure and world-side builders `0x004581ff` and `0x0052087e`, so this is the safest current read for the reset-plus-seed constructor wrapper rather than another raw allocator tail.","objdump + caller inspection + local disassembly + controller-base correlation + constructor-wrapper correlation"
 0x0052d8a0,170,runtime_object_register_relative_child_in_owned_list_field_0x75,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x75]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, optionally rewrites the incoming child object's anchor triplet `[child+0x1e2/+0x1e6/+0x1ea]` into coordinates relative either to current group-anchor `[this+0x14]` or to this object's own anchor when state bit `0x10` is still clear, sets bit `0x10` in the child state byte `[child+0x20]`, and then pushes the child through `0x00556e10`. Current grounded callers include the placed-structure specialization builders `0x0045b6f0`, `0x0045b760`, `0x0045c310`, the vehicle-side branches `0x00485933..0x00485ddb`, and the effect-side builders `0x0045b96b`, `0x0045c39c`, and `0x0045da83..0x0045e305`, so this is the safest current read for registering one relative child object in owned list `[this+0x75]` rather than a subtype-specific builder.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + relative-anchor correlation"
 0x0052d950,71,runtime_object_register_record_in_owned_list_field_0x79_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x79]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the specialization payload publishers `0x00474f3e`, `0x00485f30`, and `0x00486029`, so this is the safest current read for registering one record in owned list `[this+0x79]` with a copied group anchor rather than a bare list append.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation"
 0x0052d9a0,79,runtime_object_register_record_in_owned_list_field_0x7d_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling owned-list registration helper over list root `[this+0x7d]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the placed-structure specialization publishers `0x00456ad4`, `0x00456b80`, `0x00456c5a`, `0x00457047`, `0x0045b141`, `0x0045b14f`, `0x0045e305`, and the vehicle-side helpers `0x0048597a`, so this is the safest current read for registering one record in owned list `[this+0x7d]` with a copied group anchor rather than a subtype-specific payload constructor.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation"
 0x0052da70,32,runtime_object_refresh_dependent_handle_0x0c_if_flag_0x40_and_owner_live,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small dependent-handle refresh helper beneath the broader `0x23a` runtime-object family. When owner pointer `[this+0x04]` is live and state byte `[this+0x20]` still carries bit `0x40`, the helper clears that bit, rebuilds one dependent handle through `0x00533bc0`, and stores the result into `[this+0x0c]`. Current grounded callers are the nearby world-side support strips `0x00421415` and `0x00461300`, so this is the safest current read for the `0x40`-bit dependent-handle refresh leaf rather than a generic flag clear.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + dependent-handle correlation"
 0x0052daa0,67,runtime_object_select_grouped_subrecord_by_clamped_index,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared grouped-subrecord selector over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live, the helper clamps the caller-requested index against the current group count from the selected `0x45`-byte group header `[group+0x14]`, stores the resulting cursor into `[this+0x21]`, updates active subrecord pointer `[this+0x18]` to the corresponding `0x45`-byte payload row under `[group+0x0c]`, and returns whether the requested index was already in range. Current grounded callers are the world-side wrappers `0x0042aba0`, `0x00455c73`, `0x00528721`, and `0x0052941f`, so this is the safest current read for the explicit grouped-subrecord select helper rather than a generic array index setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation"
 0x0052db10,224,runtime_object_store_scalar_0x69_mark_transform_dirty_and_materialize_group_packet_rows,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader grouped-subrecord materialization helper beneath the same `0x23a` runtime-object family. The function stores one caller-supplied scalar into `[this+0x69]`, sets dirty bit `0x02` in state byte `[this+0x20]`, raises byte `[this+0x8d]`, resolves the currently selected group header from `[this+0x14]` and group index `[this+0x3a]`, and then walks every `0x45`-byte row in that group. For each row it caches the active row pointer in globals `0x00cc3b58/0x00cc3b6c`, lazily allocates row-local payload storage when `[row+0x35]` is still null, copies the row's packed source span there, zero-fills the trailing companion area, and advances to the next row. Current grounded callers are the vehicle-side visual builders `0x00485a1d` and `0x00485a68` plus the shell-side presentation branch `0x005287af`, so this is the safest current read for storing scalar lane `[+0x69]` and materializing the current group's packet rows rather than a pure allocator helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + packet-row correlation"
 0x0052dc00,240,runtime_object_bucket_materialized_group_packet_rows_by_four_float_thresholds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Companion grouped-row helper immediately above `0x0052db10` in the same `0x23a` runtime-object family. When byte latch `[this+0x8d]` is live and local bucket byte `[this+0x5b]` is still below `2`, the function increments that bucket, stores one caller float into threshold lane `[this+0x69 + bucket*4]`, resolves the currently selected `0x45`-byte group, and then walks every materialized row payload at `[row+0x35]`. For each copied entry it compares the entry's two stored floats against the four caller-supplied threshold bounds and, on success, writes the current bucket byte into the compact trailing byte band of the copied row payload. Current grounded callers are the vehicle-side visual builders `0x00485a8c`, `0x00485ab0`, `0x00485ad4`, and `0x00485af8`, so this is the safest current read for bucketing the materialized group packet rows by threshold windows rather than a generic float clamp.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + threshold-bucket correlation"
 0x0052eb20,51,shell_read_optional_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.,ghidra + rizin
 0x0052eb60,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
 0x0052eb70,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper also returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
@ -1849,12 +1982,82 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x0053a440,14,shell_set_geographic_label_item_alpha,bootstrap,thiscall,inferred,ghidra-headless,4,Stores an 8-bit alpha input into the high-byte color field at [this+0x5b] for the current geographic-label item before frame or text emission.,ghidra + rizin + llvm-objdump
 0x0053a960,723,shell_emit_geographic_label_text_span,bootstrap,thiscall,inferred,ghidra-headless,4,Builds and emits one geographic-label text span for the current cell item. The helper calls the item vtable at +0x10 to materialize a null-terminated display string up to 0x12c bytes computes placement from item float fields and shell service state checks visibility through the shell bundle and forwards the resolved text payload into the presentation path through 0x005519f0. The item family aligns with gpdLabelDB and 2DLabel.imb rather than the parallel city assets.,ghidra + rizin + llvm-objdump
 0x00543f10,853,layout_state_bind_presentation_asset_bundle,bootstrap,thiscall,inferred,ghidra-headless,4,Initial bind-time asset loader for the layout state's presentation node at [this+0x25df]; pulls a fixed presentation bundle through the node vtable at +0x5c and +0x60 including standalone assets stored around 0x2643 0x2647 0x264b 0x264f 0x2653 0x265b 0x265f and 0x2663 plus a 64-entry asset bank at 0x31ab while advancing an internal asset-offset cursor at [this+0x2543].,ghidra + rizin
 0x00544290,195,layout_state_publish_local_descriptor_0x352f_from_integer_span_pair,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local descriptor-publish helper in the layout-state family. The helper derives one normalized span scalar from the caller's two integer inputs, combines that value with local scalar lanes `[this+0x25eb/+0x25ef/+0x25f3]`, builds one `0x100`-byte descriptor rooted at `[this+0x352f]` through `0x0056e41a`, stores one derived shell-scaled scalar into `[this+0x36f9]`, and publishes that descriptor through node slot `+0x94` on the bound presentation node `[this+0x25df]` for selector `3`. Current grounded callers are the neighboring rect and span owners `0x00548120`, `0x00548180`, and `0x005482e0`, so this is the safest current read for publishing local descriptor `[+0x352f]` from an integer span pair rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
 0x00544360,208,layout_state_reset_local_descriptor_0x34ef_to_identity_and_publish,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Identity-reset companion to `0x00544290` in the same layout-state family. The helper zeroes the local `0x100`-byte descriptor block rooted at `[this+0x34ef]`, seeds the four diagonal scalar lanes `[+0x34ef/+0x3503/+0x3517/+0x352b]` to `1.0f`, and publishes that block through node slot `+0x94` on the bound presentation node `[this+0x25df]`. Current grounded callers include the neighboring rect and span owners `0x00548120` and a wider set of shell presentation rebuild paths such as `0x00524d05`, `0x00528805`, `0x00529dab`, and `0x0054d93a`, so this is the safest current read for resetting local descriptor `[+0x34ef]` to identity and publishing it rather than a standalone memset wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
 0x00544cb0,64,layout_state_publish_property_pair_0x0d_0x0e_for_selector3,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small property-pair publisher in the same layout-state family. The helper forwards one caller-supplied byte value into bound-node property groups `0x0d` and `0x0e`, both for selector `3`, through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural property-pair publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00544cf0,48,layout_state_clear_property_pair_0x0d_0x0e_for_selector2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny clear sibling to `0x00544cb0` in the layout-state family. The helper writes `0` into bound-node property groups `0x0d` and `0x0e` for selector `2` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural clear helper description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00544d20,96,layout_state_set_property_pair_0x0d_0x0e_for_selector1_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small arming helper over the same layout-state property strip. The helper first clears bound-node property groups `0x0d` and `0x0e` for selector `1`, then republishes both groups with literal value `1` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural selector-`1` property-pair arm description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00544d80,32,layout_state_publish_property_0x3c_packed_dword,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny packed-property setter over the bound presentation node `[this+0x25df]`. The helper forwards one caller-supplied dword into property `0x3c` through node vtable slot `+0xc8`. Current evidence only supports this structural packed-dword publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00544da0,48,layout_state_publish_property_0x3c_with_cached_rgb_and_alpha_byte,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small color-pack sibling to `0x00544d80` in the layout-state family. The helper reads cached RGB lanes from `[this+0x25a3]`, masks them down to `0x00ffffff`, combines that value with one caller-supplied alpha byte in the high lane, and publishes the packed result into property `0x3c` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-RGB-plus-alpha publisher description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00544dd0,32,layout_state_publish_property_group_0x0b_for_selector_with_value,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny grouped-property publisher over the same bound node. The helper forwards its two caller-supplied dwords as selector and value into property group `0x0b` through node vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural grouped-property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00544df0,320,layout_state_apply_capability_and_mode_gated_property_strip_0x1d_0x13_0x14_0x12,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader property-strip owner in the layout-state family. The helper first checks shell capability byte `[0x006d4024+0x11422e]` and publishes property `0x1d` on the bound node `[this+0x25df]`, then conditionally seeds fixed property pair `0x13 = 5` and `0x14 = 6` when state byte `[this+0x83c+0x21]` is live. After that it derives one per-slot mode value from state dword `[this+0x83c+0x29]` and local slot count `[this+0x258f]`, publishes property `0x13` across every active slot, and finally publishes property `0x12` across the same slot span with the derived mode selector. Current grounded caller is the neighboring layout-state owner branch `0x0052bc18`, so this is the safest current read for the capability and mode-gated `0x1d/0x13/0x14/0x12` property-strip owner rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
 0x00544f30,208,layout_state_apply_slot_range_property_strip_0x15_0x1a_0x11_0x10,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Broader slot-range property-strip owner adjacent to `0x00544df0` in the same layout-state family. The helper derives one active slot range from the caller's signed start byte and the current slot count `[this+0x258f]`, optionally clears property `0x15` down to zero and raises property `0x1a = 1` when the caller's boolean flag is set, then walks the active slot range publishing property groups `0x11` and `0x10` with one derived mode value. That derived mode depends on both the caller flag and state byte `[this+0x83c+0x1e]`. Current evidence only supports this structural slot-range property-strip description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00545000,32,layout_state_clear_property_0x89,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the layout-state family. The helper writes literal `0` into property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00545020,32,layout_state_publish_property_0x89_from_state_byte_0x22,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small sibling publisher to `0x00545000`. The helper reads byte `[this+0x83c+0x22]` and forwards that value into bound-node property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-byte property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00545040,64,layout_state_publish_property_0x89_from_state_byte_0x22_and_notify_slot_0,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Notify-style sibling over the same cached state byte `[this+0x83c+0x22]`. The helper first publishes that byte into property `0x89` through node slot `+0xc8`, then forwards the same value into node slot `+0xb8` with selector `0`. Current evidence only supports this structural publish-plus-notify description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00545080,32,layout_state_clear_property_0x0e,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the same layout-state strip. The helper writes `0` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x005450a0,32,layout_state_set_property_0x0e_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny sibling setter to `0x00545080`. The helper writes literal `1` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property-set description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x005450c0,32,layout_state_copy_cached_local_block_0x24f0_to_out_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small cached-block exporter in the layout-state family. The helper copies the fixed `0x33`-byte local block rooted at `[this+0x24f0]` into one caller-supplied output buffer through a straight `rep movs` copy. Current evidence only supports this structural cached-block export description.","objdump + local disassembly + layout-state correlation + cached-block correlation"
 0x005450e0,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_with_mid_clamp,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Three-outparam local scalar exporter in the layout-state family. The helper reads float lanes `[this+0x2517]`, `[this+0x251b]`, and `[this+0x251f]`, negates all three, scales the third lane through the same constant used by neighboring layout-state math, and writes them to three separate outparams. The middle exported scalar is then clamped up to `0.5f` when the negated source would fall below that floor. Current evidence only supports this structural negated-triplet export description.","objdump + local disassembly + layout-state correlation + local-scalar correlation"
 0x00545130,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_to_vec3_with_mid_clamp,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Packed-output sibling to `0x005450e0` in the same layout-state family. The helper writes the same negated local scalar triplet derived from `[this+0x2517/+0x251b/+0x251f]` into one caller-supplied contiguous three-float buffer, again scaling the third lane and clamping the middle lane up to `0.5f`. Current grounded caller is the neighboring layout-state owner branch `0x0052bbb7`, so this is the safest current read for the packed vec3 export sibling rather than another generic copy helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-scalar correlation"
 0x00545180,640,layout_state_build_default_preset_table_0x840_from_angular_sweep,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Default preset-table builder in the same layout-state family. The helper walks `0x90` fixed records of size `0x33` rooted at `[this+0x840]`, deriving one normalized vector pair, several companion float lanes, and three byte-scaled threshold lanes from an angular sweep that starts at `-0xa8c0` and advances by `0x258` per row. Current grounded caller is the default-cache bootstrap path `0x0054be29`, which only invokes this builder when global dirty byte `0x00ccd820` is still clear; otherwise that owner copies preset rows from global cache `0x00ccbb68`. So the safest current read is a generated default preset-table builder rather than a generic trig helper.","objdump + caller inspection + local disassembly + layout-state correlation + preset-table correlation + default-cache correlation"
 0x00545400,32,layout_state_store_preset_row_float_0x23_in_table_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row setter in the layout-state family. The helper stores one caller-supplied float into offset `0x23` of the selected `0x33`-byte row under preset table `[this+0x840]`. Current evidence only supports this structural preset-row float-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
 0x00545420,32,layout_state_store_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array setter adjacent to the preset-table strip. The helper stores two caller-supplied floats into indexed arrays `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]`. Current evidence only supports this structural paired-array store description.","objdump + local disassembly + layout-state correlation + paired-array correlation"
 0x00545440,48,layout_state_query_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array query sibling to `0x00545420`. The helper conditionally writes indexed floats from `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]` into up to two caller-supplied outparams. Current evidence only supports this structural paired-array query description.","objdump + local disassembly + layout-state correlation + paired-array correlation"
 0x00545470,48,layout_state_store_two_floats_into_preset_row_column_pair,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small indexed preset-row setter adjacent to `0x00545400`. The helper resolves one selected `0x33`-byte row under `[this+0x840]`, then stores two caller-supplied floats into the first and second column bands using the caller's subindex as a `4`-byte lane selector. Current evidence only supports this structural two-float row-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
 0x005454a0,32,layout_state_query_float_from_preset_row_column_band_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row query helper over the same table `[this+0x840]`. The helper resolves one selected `0x33`-byte row and returns the float stored in the first column band at the requested `4`-byte subindex. Current evidence only supports this structural preset-row float-query description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
 0x005457c0,224,layout_state_publish_property_0x8b_with_stack_descriptor_and_optional_capability_scaled_scalar,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stack-descriptor publisher in the layout-state family. The helper zeroes one local descriptor block, optionally seeds one capability-gated scaled scalar from `[this+0x25fb] * [this+0x24f4]` when both the caller flag and shell capability byte `[0x006d4024+0x11422e]` are live, pushes packed color `0xffafafaf` into property `0x8b` on the bound node `[this+0x25df]`, and then forwards the prepared stack descriptor through node slot `+0xa8`. Current grounded callers include nearby layout-state refresh owners `0x00524cd3`, `0x00524e28`, `0x0052a641`, `0x0052ac7a`, `0x0052ae3d`, `0x0052b42f`, `0x0052bbc1`, `0x0054d944`, and later support branches `0x00564c38`, so the safest current read is a property-`0x8b` stack-descriptor publish helper rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + stack-descriptor correlation"
 0x005458a0,48,layout_state_borrow_current_segment_record_window_handle_0x265b_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over current segment-record handle `[this+0x265b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2800`-byte window through handle vtable slot `+0x2c`, and returns the borrowed scratch pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
 0x005458d0,32,layout_state_release_current_segment_record_window_handle_0x265b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x005458a0`. The helper decrements global counter `0x00ccd824` and forwards current segment-record handle `[this+0x265b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
 0x005459f0,48,layout_state_release_segment_record_window_handle_0x2643_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the `0x2643` segment-record window readers. When gate byte `[this+0x254e]` is live, the helper clears that gate, decrements global counter `0x00ccd824`, and forwards handle `[this+0x2643]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
 0x00545a20,32,layout_state_release_handle_0x264f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny release-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
 0x00545a40,48,layout_state_borrow_handle_0x264f_window_0x7800_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x7800`-byte window through handle vtable slot `+0x2c`, writes the borrowed pointer to local scratch `[this+0x2657]`, and returns that pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
 0x00545a70,48,layout_state_borrow_handle_0x2653_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x2653]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
 0x00545aa0,32,layout_state_release_handle_0x2653_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545a70`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x2653]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
 0x00545ac0,48,layout_state_borrow_handle_0x264b_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
 0x00545af0,32,layout_state_release_handle_0x264b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545ac0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x264b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
 0x00545b90,32,layout_state_release_vertex24_window_handle_0x2647_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the vertex24 window readers over handle `[this+0x2647]`. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + vertex24 correlation"
 0x00545bb0,48,layout_state_borrow_handle_0x263f_window_0x2ee00_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x263f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2ee00`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
 0x00545be0,32,layout_state_release_handle_0x263f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545bb0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x263f]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
 0x00545ca0,176,layout_state_clear_first_optional_binding_publish_property_0x9e_and_commit_span_type1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small commit-side owner in the layout-state family. When gate byte `[this+0x254d]` is still clear and slot count `[this+0x258f]` is positive, the helper clears the first optional slot binding `[this+0x2593][0]` through node slot `+0xf4` when that binding is nonnull, then publishes property `0x9e = 1.0f` on the bound node `[this+0x25df]`, accumulates one derived span count into `[this+0x3711]`, and commits the caller-supplied range through node slot `+0x118` with primitive-type argument `1`. Current evidence only supports this structural clear-plus-commit description.","objdump + local disassembly + layout-state correlation + span-commit correlation"
 0x00545d50,16,layout_state_query_accumulated_span_counter_0x3711,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny accessor in the same layout-state family. The helper returns accumulated span counter `[this+0x3711]` unchanged. Current evidence only supports this structural counter-query description.","objdump + local disassembly + layout-state correlation + counter correlation"
 0x00545d60,80,layout_state_reset_counters_0x370d_0x3711_and_optionally_reseed_bound_node_mode2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Reset-side helper adjacent to the span-commit strip. The function zeroes local counters `[this+0x370d]` and `[this+0x3711]`, optionally dispatches the bound node `[this+0x25df]` through vtable slot `+0x90` with selector `2` and one `1.0f` scalar when the caller requests it, and then unconditionally forwards the node through slot `+0x88`. Current evidence only supports this structural reset-and-optional-reseed description.","objdump + local disassembly + layout-state correlation + counter correlation"
 0x00545db0,64,layout_state_finalize_bound_node_and_optionally_clear_zero_mode_through_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small finalize-side helper over the bound node `[this+0x25df]`. The helper first dispatches node slot `+0x8c`, then, when the caller's boolean is still zero, clears one four-zero argument lane through node slot `+0x3c`. Current evidence only supports this structural finalize-and-optional-clear description.","objdump + local disassembly + layout-state correlation + bound-node correlation"
 0x00545e00,48,layout_state_classify_bound_node_signature_0x88760868_0x88760869_or_other,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny classifier over the bound node `[this+0x25df]`. The helper queries node slot `+0x0c` and returns `1` for signature `0x88760868`, `2` for `0x88760869`, `0` for a null signature, and `3` for any other nonzero result. Current evidence only supports this structural node-signature classifier description.","objdump + local disassembly + layout-state correlation + node-signature correlation"
 0x00554830,142,attachment_object_init_named_asset,bootstrap,thiscall,inferred,ghidra-headless,3,Initializes one named attachment object from a caller-supplied asset string and placement parameters. The helper copies the asset name into the local object buffer at [this+0x10] stores attachment selectors at [this+0x130] and [this+0x138] optionally derives a cached scale pair at [this+0x120] and [this+0x124] and then finalizes object state through 0x005545d0.,ghidra + rizin + llvm-objdump
 0x00531640,129,shell_audio_service_query_selected_backend_index_by_name,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Queries the currently selected audio backend index from the shell audio service. When service mode dword `[this+0x04]` is `1` and the override gate at `0x00ccb9f4` is clear, the helper pulls the current backend-name stem through `0x569720` on service object `0x00ccb9fc`, iterates candidate names through `0x005314b0`, and returns the first matching backend index. Otherwise it falls back to `0`. Current grounded callers are the `Sound` page refresh and callback paths, which use it to mirror the live backend selector into control `0x7551`.","objdump + settings-window caller correlation + backend-name-match correlation"
 0x005316d0,47,shell_audio_service_query_backend_available_flag_by_index,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns one availability flag for the requested audio backend index. When service mode dword `[this+0x04]` is `1` and the override gate at `0x00ccb9f4` is clear, the helper resolves the backend-name pointer through `0x005314b0(index)` and forwards it into `0x569730` on service object `0x00ccb9fc`; otherwise it returns `0`. Current grounded callers are the `Sound` page refresh and callback paths, which use the returned flag to republish control `0x7550`.","objdump + settings-window caller correlation + backend-availability correlation"
 0x00531e10,48,shell_audio_service_apply_indexed_feedback_event_if_ready,shell,thiscall,inferred,objdump + caller correlation + local disassembly,4,"Small shell-audio-service sink beneath the indexed feedback-nudge helper `0x0045ea20`. The helper only dispatches when service mode dword `[this+0x04]` equals `1`, override gate `0x00ccb9f4` is clear, and the service-side readiness scalar at `[0x00ccb9f8+0x20]` passes the local positive check; on the ready path it tail-jumps into `0x0056ad20` with the caller's table-driven event pair and scalar, otherwise it returns `0`. Current grounded direct caller is `shell_emit_indexed_audio_feedback_nudge_if_live` `0x0045ea20`, which keeps this safely on the shell-audio feedback side rather than the broader backend-selection family.","objdump + caller correlation + local disassembly + readiness-gate correlation"
 0x0053ef60,4,graphics_backend_query_primary_status_dword_18,shell,thiscall,inferred,objdump + settings-window caller correlation,3,"Returns graphics-backend dword `[this+0x18]` unchanged. Current grounded callers are the `Graphics` page refresh and graphics-selector callback strip, which pair this value with `graphics_backend_query_both_status_slots_clear` `0x0053ef70` when deciding how controls `0x757c` and `0x759a` should be republished.","objdump + settings-window caller correlation"
 0x0053ef70,23,graphics_backend_query_both_status_slots_clear,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns `1` only when both graphics-backend dword `[this+0x18]` and dword `[this+0x14]` are zero; otherwise returns `0`. Current grounded callers are the `Graphics` page refresh and the graphics-selector callback strip, which use this test as the fallback branch when republishing controls `0x757c` and `0x759a`.","objdump + settings-window caller correlation + status-slot correlation"
 0x00540e30,283,surface_owner_base_init_and_register_on_global_list,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Base initializer for the `0xec`-byte RGBA surface-owner family. The helper copies one fixed owner label into `[this+0x13]`, seeds capability and mode bytes from the live shell presenter into `[this+0x96/+0x97]`, clears the cached byte-count and pointer bands `[this+0xc0..+0xe8]`, allocates two small companion helper objects through `0x0053b070 -> 0x00556d80`, clears the eight-entry row bands `[this+0x98..+0x9f]` and `[this+0xa0..+0xbc]`, resets selector dword `[this+0x07]`, and finally links the owner into the global intrusive list rooted at `0x00ccbb2c`, incrementing `0x00ccbb30`. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, so this is the safest current read for base-init plus global registration rather than a generic shell allocator.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation"
 0x00540fc0,304,surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Two-part maintenance owner in the same surface-owner family. Its first half clears cached byte totals `[this+0xcc/+0xd0]` and then walks the eight row slots `[this+0xa0..+0xbc]`, accumulating active row byte sizes `[row+0x04]` into total bytes when backing pointer `[row+0x22]` is live and into selected bytes when companion byte `[this+0x98 + slot]` is set and selector dword `[this+0x07]` matches the shell mode token `[0x006d4024+0x114222]`. Its second half walks the same slots again and frees row buffers `[row+0x2a/+0x26/+0x2e]`, clears `[row+0x22]`, and resets owner selector `[this+0x07]`. Current grounded callers are the surface constructor `0x00543980` and the cached-surface commit helper `0x005438d0`, so this is the safest current read for the cached-byte refresh plus full row-buffer release owner rather than a narrow query helper.","objdump + caller inspection + local disassembly + surface-family correlation + byte-total correlation + row-release correlation"
 0x00541160,88,surface_owner_query_dimension_cap_from_mode_and_quality_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small dimension-cap query in the same surface-owner family. When owner byte `[this+0x05]` is clear it returns the broad fallback cap `0x800`. Otherwise it derives a tighter power-of-two limit from the shell editor or capability gate `[0x006d4024+0x11422f]` and then clamps that base cap against quality-style selector dword `[this+0xd8]`, yielding at most `0x100`, `0x200`, or `0x400`. Current grounded caller is the type-`2` import branch at `0x00542e15`, so this is the safest current read for the shared surface-dimension cap helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + dimension-cap correlation"
 0x005411c0,79,surface_owner_probe_named_file_for_type2_header_signature,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small file-header probe adjacent to the same import seam. The helper opens one caller-supplied path with mode `0x8000`, reads the leading `0x12` bytes, closes the file, and returns `1` only when the checked header byte stays clear and the small type byte at local offset `+0x06` equals `2`; otherwise it returns `0`. Current grounded caller is the shell-side path at `0x005039fb`, so this is the safest current read for probing a named file for the type-`2` header signature rather than a generic file-exists test.","objdump + caller inspection + local disassembly + surface-family correlation + file-header correlation"
 0x00541210,709,surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Row-side repack owner beneath the same RGBA surface family. When shell capability byte `[0x006d4024+0x114255]` is live and editor-map gate `[0x006d4024+0x11422f]` is clear, the helper requires row backing buffer `[row+0x26]`, ensures one active output buffer at `[row+0x2a]`, seeds row state `[row+0x04/+0x10/+0x1c/+0x22]`, and then repacks the caller pixels into a 16-bit destination. The current split is structural but real: when owner byte `[this+0x96]` is nonzero it computes a palette-like packed color from accumulated channel maxima; otherwise it uses direct nibble-packed conversion from the source dwords. When owner byte `[this+0x97]` is clear it also frees the source backing pointer `[row+0x26]` on exit. Current grounded callers are `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish` `0x005438d0` and the broader row-type import body at `0x00541c30`, so this is the safest current read for the active 16-bit repack owner rather than a generic blit.","objdump + caller inspection + local disassembly + surface-family correlation + repack correlation + capability-gate correlation"
 0x00541970,292,surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Shared query-or-materialize helper in the same `0xec`-byte surface-owner family. For non-type-`2` rows it optionally returns width and height from `[row+0x08/+0x0c]`, then returns active RGBA backing pointer `[row+0x26]` when already live. If that RGBA buffer is still null, the helper allocates `width * height * 4` bytes, expands the current 16-bit source buffer `[row+0x2a]` into nibble-doubled RGBA dwords, stores the result into `[row+0x26]`, and returns that pointer. Current grounded callers include the cached world-presentation strip `0x005323f0/0x00532460`, the staged overlay publisher `0x00534af0`, the secondary-overlay loaders `0x00535430/0x00538060`, and the save/setup preview seam below `0x00542550`, so this is the safest current read for querying or materializing the RGBA backing buffer from the active 16-bit row rather than a generic width or height helper.","objdump + caller inspection + local disassembly + surface-family correlation + RGBA-materialization correlation"
 0x00541aa0,48,surface_owner_query_first_row_width_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny first-row width query in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns width dword `[row+0x08]`; otherwise it falls back to `1`. Current grounded callers include the world-presentation math strips at `0x0055238a/0x005523b6` and the later projection-side branch `0x0055f5d0`, so this is the safest current read for the first-row width-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + width-query correlation"
 0x00541ad0,48,surface_owner_query_first_row_height_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Height-side sibling to `surface_owner_query_first_row_width_or_one` in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns height dword `[row+0x0c]`; otherwise it falls back to `1`. Current grounded callers include the same world-presentation and projection-side strips at `0x0055250e/0x0055253a` and `0x0055f5ed`, so this is the safest current read for the first-row height-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + height-query correlation"
 0x00541bf0,32,surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small state-refresh helper in the same surface-owner family. The helper reads the live shell presenter through `0x0051f070`, copies presenter dword `[presenter+0x05]` into cached owner field `[this+0xd4]`, and returns bound handle `[this+0xc0]`. Current grounded caller is the layout-state binding strip at `0x00545566`, so this is the safest current read for refreshing cached shell scalar `0xd4` and returning handle `[+0xc0]` rather than a broader semantic owner.","objdump + caller inspection + local disassembly + surface-family correlation + cached-shell-scalar correlation"
 0x00541c10,32,surface_owner_release_selector_handle_0x07_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny selector-handle release helper in the same surface-owner family. When owner field `[this+0x07]` is nonzero, the helper re-enters `0x00541780` on that handle and then clears `[this+0x07]` back to zero. Current grounded callers include the broader release body `0x00542c90`, the local maintenance strip at `0x0053293c`, and the cache-refresh owner around `0x00543521/0x00543593`, so this is the safest current read for releasing selector handle `+0x07` rather than a generic destructor fragment.","objdump + caller inspection + local disassembly + surface-family correlation + selector-handle correlation"
 0x00541b10,132,surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Slot allocator in the `0xec`-byte RGBA surface-owner family. The helper scans the eight-entry row-pointer band `[this+0xa0 .. +0xbc]` for the first null slot, increments active-count byte `[this+0x04]`, marks companion byte `[this+0x98 + slot] = 1`, allocates one `0x32`-byte row, zeroes it, seeds row fields `[row+0x08]` and `[row+0x0c]` from the caller width and height, mirrors the third caller dword into `[row+0x14/+0x18]`, stores the row into `[this+0xa0 + slot*4]`, and returns the slot index or `-1` when no slot is free. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, which invokes it as `(..., width, height, 3)`, so this is the safest current read for allocating the first free surface-row slot rather than a generic small object allocator.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation"
 0x00541ba0,66,surface_owner_release_row_slot_0xa0_by_index,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Release-side companion to `0x00541b10` in the same surface-owner family. When the caller-supplied slot index is in range and row pointer `[this+0xa0 + slot*4]` is live, the helper decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current evidence grounds it as the indexed row-slot releaser beneath the same temporary-surface and cached-surface owner family.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation"
 0x00541c30,1024,surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`4` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the usual early fast path through `0x00541210`, the helper reads one tagged payload stream, validates the fixed tag sequence rooted at `0xbabe` and the following `0xbaba/0xbabb` alternatives, allocates temporary buffers for the recovered bands, and then reconstructs one RGBA destination buffer from those tagged payload pieces before storing it back into the active row. The current grounded split is structural but real: one branch routes the recovered tagged bands through `0x00553120`, another copies one direct recovered band, and the mismatch branch falls back to an all-`0xff` fill. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`4` family and then re-enters `0x00541210` to materialize the live 16-bit buffer. This is the safest current read for the tagged `0xbabe/0xbaba/0xbabb` payload importer rather than a generic stream helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-payload correlation"
 0x00542030,905,surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`3` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the same early repack fast path through `0x00541210`, the helper resolves one headered payload through the local stream service, validates recovered width and height against the live shell caps, rejects unsupported header combinations, allocates a full RGBA destination plus one temporary `0x40000` staging buffer, and then decodes the payload into RGBA rows. The current grounded split is structural but real: it accepts direct `0x20`-byte-per-pixel and `0x18`-byte-per-pixel source bands, can reseed an auxiliary table lookup through `0x0053b7c0`, and treats one large-value branch as a staged scanline reader rather than a raw memcpy. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`3` family and re-enters `0x00541210` with row flag byte `[row+0x20]` selected from the dimension threshold branch. This is the safest current read for the headered RGB or paletted payload importer rather than another generic buffer copy.","objdump + caller inspection + local disassembly + surface-family correlation + headered-payload correlation"
 0x005423d0,380,surface_row_materialize_dxt3_payload_into_active_16bit_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"DXT3 materializer beneath the same type-`2` row family. When the active output buffer `[row+0x2a]` is still null and compressed payload `[row+0x2e]` is live, the helper builds two temporary codec-side objects through `0x00570691`, forwards the row payload and format tag `0x33545844` (`DXT3`) into the adjacent decode path `0x0057025d`, runs the follow-on materialization step `0x005706f7`, and then allocates the live output buffer `[row+0x2a]`, copies the decoded bytes into it, seeds row state `[row+0x04/+0x10/+0x14/+0x1c/+0x22]`, and releases the temporary codec objects. Current grounded caller is the non-editor tail of `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, so this is the safest current read for materializing the compressed DXT3 row payload into the active output buffer rather than another generic codec wrapper.","objdump + caller inspection + local disassembly + surface-family correlation + DXT3-correlation + decode-materialization correlation"
 0x00542550,786,surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Capability-gated row postprocess owner in the same surface family. When shell capability byte `[0x006d4024+0x11422d]` is live and owner byte `[this+0x95]` has not already latched, the helper walks the active row slots, skips type-`2` rows and rows whose processed byte `[row+0x21]` is already set, forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970`, marks the row processed, seeds row state `[row+0x1c] = 0x3c`, discards the previous live 16-bit buffer `[row+0x2a]`, allocates a replacement destination, and then rebuilds `[row+0x22/+0x2a]` from a float-heavy neighbor-difference transform over the RGBA source. For rows whose pixel-size tag `[row+0x10]` equals `0x20`, it halves the stored byte count `[row+0x04]` after the rebuild. Current grounded caller is the world-presentation template seeder `0x005356e0`, which revisits the earlier overlay slot series and runs this helper after clearing byte `[slot+0x05]`, so this is the safest current read for the capability-gated postprocess over non-type-`2` rows rather than a generic buffer conversion.","objdump + caller inspection + local disassembly + surface-family correlation + processed-row correlation + neighbor-difference correlation"
 0x00542870,69,surface_owner_release_all_row_slots_0xa0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Compact full-slot release helper in the same surface-owner family. The function walks all eight row slots `[this+0xa0..+0xbc]`, and for each live slot decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current grounded caller is the broader release owner `surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots` `0x00542c90`, which uses this after unlinking the global owner entry, so this is the safest current read for releasing all row slots rather than a generic loop body.","objdump + caller inspection + local disassembly + surface-family correlation + full-slot-release correlation"
 0x005428c0,607,surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader file-write owner in the same import/export surface seam. The helper allocates one alpha-sized plane and one `3 * width * height` RGB plane from the active row dimensions, splits current backing pixels `[row+0x26]` into those temporary buffers, seeds a stack image/codec object, and then writes several tagged records into the already-open stream passed by the caller. The current grounded split is structural: when the caller requests the transformed path it forwards the temporary planes through `0x00553000` before writing the tagged records `0xbaba`, `0xbabb`, and `0xbabe`; otherwise it writes the raw split buffers and the same trailing tag family directly. It frees the temporary planes before returning. Current grounded caller is `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`, which opens the destination path in `a+b` mode and forwards the resulting stream here, so this is the safest current read for encoding the active surface row and writing tagged records to the open stream rather than a generic image copy helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-record correlation + open-stream correlation"
 0x00542b30,208,surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Direct file-write sibling to `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50` in the same preview-surface seam. The helper opens one caller-supplied path in `wb` mode, builds a compact `0x12`-byte header on the stack with row type `2`, the first-row width and height, fixed pixel-size byte `0x20`, and one optional flag bit `0x20` when the second caller argument is nonzero, then optionally forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970` and writes the first-row RGBA payload `[row+0x26]` plus the header to the open stream. Current grounded callers are the paired export-side branches at `0x00520cda`, `0x00520f61`, and `0x00534dd6`, each of which uses this as the direct-file alternative to `0x00542f50` before releasing the temporary surface owner through `0x00542c90 + 0x0053b080`, so this is the safest current read for writing the first row plus its `0x12`-byte header to a named file rather than a generic save helper.","objdump + caller inspection + local disassembly + surface-family correlation + direct-file-write correlation"
 0x00542c10,114,shell_release_active_global_layout_cache_entries,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Global cache-release sweep in the shell layout-state family. The helper walks the linked list rooted at `0x00ccbb2c`, and for every active entry `[entry+0x07]` releases optional handles `[entry+0xc0]` and `[entry+0xc8]` through vtable slot `+0x08`, refreshes controller-side cached field `[0x006d4024+0x1136ad]` through `0x0051f990`, clears sibling bookkeeping dwords `[entry+0xcc/+0xd0/+0xd4]`, decrements active-count global `0x00ccbb34`, and resets `[entry+0x07]` back to `0`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd80` and `0x0055e060`, so this is the safest current read for releasing the active global layout-cache entries rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + global-cache correlation"
 0x00542c90,177,surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Primary release body for the same global surface-owner family. The helper releases optional companion helpers `[this+0xdc]` and `[this+0xe4]` through `0x005571d0 + 0x0053b080`, clears sibling field `[this+0xe0]`, unlinks the owner from the intrusive global list rooted at `0x00ccbb2c`, conditionally refreshes the live shell presenter through `0x005271a0` when owner byte `[this+0x93]` is set, re-enters `0x00541780` to drop any active selector-side handle, re-enters `surface_owner_release_all_row_slots_0xa0` `0x00542870`, and finally clears `[this+0x07]` plus `[this+0xc0]`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation slot-release strips `0x00532760/0x00532b30/0x00534f80`, and the shell overlay release path `0x0047b320`, so this is the safest current read for releasing helper objects, unlinking the global surface-owner entry, and dropping the row slots rather than a generic destructor stub.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation + row-slot-release correlation"
 0x00542f50,95,surface_owner_open_named_resource_and_dispatch_row_type_import,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Named-resource import dispatcher in the same temporary-surface and cached-surface family used by the setup/save preview helpers. The function takes one caller path seed, opens or resolves the matching resource file through the neighboring file-open strip, forwards the result into `0x005428c0`, and then dispatches the imported row by embedded type dword `[row+0x18]`: current grounded branches are type `2 -> 0x00542d50`, type `3 -> 0x00542030`, and type `4 -> 0x00541c30`, with the fallback returning `2`. Current grounded caller is `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46` `0x00442740`, which uses the returned dword as payload field `[record+0x18]`, so this is the safest current read for the named-resource open-and-import dispatcher rather than a generic file helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation"
 0x00542fb0,64,surface_owner_dispatch_row_import_by_embedded_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small row-type selector beneath the same import seam. The helper reads embedded row type dword `[row+0x18]` and dispatches type `2` to `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, type `3` to `surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer` `0x00542030`, and type `4` to `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer` `0x00541c30`, returning `2` on the unsupported fallback path. Current grounded caller is the temporary-slot wrapper `0x00543000`, so this is the safest current read for the embedded row-type import selector rather than another file-open helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation"
 0x00543000,128,surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Temporary-slot import wrapper in the same surface-owner family. The helper clears selector field `[this+0x07]`, allocates one fresh slot through `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10`, dispatches the newly allocated row through `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0`, releases the slot again through `0x00541ba0` when the import result is `1` or `2`, and then refreshes cached byte totals and row state through `0x00540fc0` before returning the import status. Current grounded callers are the higher surface-owner service strip immediately above `0x00543080`, so this is the safest current read for allocating a temporary row slot, dispatching the type-specific import, and releasing it on failure rather than a broader constructor.","objdump + caller inspection + local disassembly + surface-family correlation + temp-slot-import correlation"
 0x005438d0,173,surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Commit-side publish helper in the same `0xec`-byte RGBA surface-owner family used by `0x00543980`. When the caller supplies a nonnull backing buffer, the helper replaces existing row buffer `[row+0x26]`, freeing the old buffer when it differs. It then resets state byte `[row+0x20]` to `0`, restores state dword `[row+0x1c] = 0x15`, mirrors active backing pointer into `[row+0x22]`, recomputes byte size `[row+0x04] = width * height * 4` from `[row+0x08/+0x0c]`, re-enters `0x00541210`, publishes through `0x005435d0`, and finally clears owner dwords `[this+0xcc/+0xd0]`. Current grounded callers are the surface constructor `0x00543980`, the cached world-presentation surface strip at `0x00532460/0x00534af0`, and the shell overlay raster wrappers `0x0047b3d0/0x0047b470`, so this is the safest current read for committing the active RGBA backing buffer and republishing the live surface row rather than a generic free helper.","objdump + caller inspection + local disassembly + surface-family correlation + republish correlation"
 0x00543980,131,surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Constructor or ensure helper for the `0xec`-byte RGBA surface-owner family. The function takes an optional caller pixel buffer, width, height, and one extra mode or flag argument. When the pixel buffer is null it allocates `width * height * 4` bytes itself, then re-enters `0x00540e30`, copies the fixed owner label at `0x005dd924` into `[this+0x13]`, and on first use seeds local bytes `[this+0x94] = 1` and `[this+0x96] = 0`, allocates one slot row through `0x00541b10(width, height, 3)`, and commits the active backing pixels through `0x005438d0`. It finishes by re-entering `0x00540fc0`, clears byte `[this+0x05]`, and returns `this`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation cached-surface owners `0x005323f0/0x00535100/0x00535430`, and the shell overlay ensure-surface owner `0x0047b470`, so this is the safest current read for initializing or ensuring one RGBA surface owner from caller pixels and dimensions rather than a world-only allocator.","objdump + caller inspection + local disassembly + surface-family correlation + first-use-slot-allocation correlation"
 0x005454c0,82,layout_state_snapshot_current_slot_triplet_table_into_history_list_0x259f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, copies the whole live slot table into that buffer, and then appends the copied buffer into the history-style list rooted at `[this+0x259f]` through `0x00556e10`. Current grounded callers are the tightly clustered probe-side branches `0x0055de10..0x0055df9f`, so this is the safest current read for snapshotting the current slot-triplet table into history list `[+0x259f]` rather than a generic allocator wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation + history-list correlation"
 0x00545520,179,layout_state_set_optional_item_binding_in_slot_table_0x2593,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared optional-binding setter over slot table `[this+0x2593]` in the broader layout-state presentation family. When the requested slot index is in range, the helper compares the incoming item pointer against the current slot binding. For nonnull items it first checks item dword `[item+0x07]` against the current shell-side mode token `[0x006d4024+0x114222]`; mismatches are normalized through `0x005435d0(item, [this+0x25df], 0)` before the final bind. Effective changes then publish node property slot `+0xf4` on `[this+0x25df]`, using the derived item-side dword returned from `0x00541bf0` for nonnull bindings or `0` for clears, incrementing local change counter `[this+0x370d]` and mirroring the final pointer back into `[this+0x2593 + slot*4]`. Current grounded callers include the nearby-presentation and layout-state refresh strips `0x005243eb`, `0x0052876a`, `0x00548a24`, and many sibling presentation owners, so this is the safest current read for the optional per-slot item-binding publisher rather than a generic list write.","objdump + caller inspection + local disassembly + layout-state correlation + slot-binding correlation"
 0x005455e0,224,layout_state_set_slot_triplet_lo,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the first three cached per-slot presentation scalars in the 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 1 through 3.,ghidra + rizin + llvm-objdump
 0x005456d0,240,layout_state_set_slot_triplet_hi,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the second three cached per-slot presentation scalars in the same 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 4 through 6.,ghidra + rizin + llvm-objdump
 0x005458f0,169,layout_state_read_segment_record_window,bootstrap,thiscall,inferred,ghidra-headless,4,Gates the 32-byte segment-record table at [this+0x2643]; queries record bounds then copies a start-to-end or wrapped window into scratch storage at [this+0x2657] through vtable slot +0x2c while toggling byte flag [this+0x254e]. The downstream shell path treats each 0x20-byte record as two vec3 blocks plus two trailing scalars.,ghidra + rizin
@ -1862,23 +2065,286 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00545b10,57,layout_state_read_vertex24_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 24-byte-indexed vertex block from the presentation table at [this+0x2647] through vtable slot +0x2c using index*24 addressing and returns the copied pointer through a stack outparam. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
 0x00545b50,59,layout_state_read_vertex24_window,bootstrap,thiscall,inferred,ghidra-headless,4,Copies a window between two 24-byte vertex indices from [this+0x2647] into scratch storage at [this+0x2657] through vtable slot +0x2c using index*24 addressing and a fixed 0x1800-byte transfer span. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
 0x00545c50,67,layout_state_commit_vertex24_span,bootstrap,thiscall,inferred,ghidra-headless,4,Converts a start and end vertex index range into a triplet count by dividing the delta by three accumulates that count at [this+0x3711] and notifies the bound presentation node at [this+0x25df] through vtable slot +0x118 with primitive-type argument 4.,ghidra + rizin
 0x00545e30,1657,layout_state_query_external_report_and_build_summary_text_0x43c,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader report-summary owner in the layout-state family beneath the release and capability-gated property strip. The helper first queries one external/provider object through `0x0058bc36`; when that lookup fails it formats localized id `0x73` directly into summary buffer `[this+0x43c]` and returns success. On the live path it fetches one capability-style report through vtable slot `+0x10`, clears summary buffer `[this+0x43c]`, and then appends a sequence of localized fragments `0x74..0x7d`, fixed format strings such as `%1(16-bit HW) ` and `%1(8-bit HW) `, and several numeric fields from the returned report before returning. Current grounded caller is the broader setup-side layout-state owner branch `0x0054a12b`, so this is the safest current read for querying the external report and building summary text buffer `0x43c` rather than a generic string formatter.","objdump + caller inspection + local disassembly + layout-state correlation + summary-buffer correlation + external-report correlation"
 0x005464d0,105,layout_state_run_four_pass_bound_node_reset_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small four-pass bound-node reset strip in the layout-state family. The helper re-enters node slot `+0x88`, then publishes fixed selector/value pairs through node slot `+0x90` and finally clears slot `+0x3c`, repeating that sequence four times against bound presentation node `[this+0x25df]`. Current grounded caller is the same broader owner strip that invokes `0x00545e30` and then selects shell mode `4` or `5`, so this is the safest current read for the repeated bound-node reset strip rather than a generic loop body.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
 0x00546540,19,layout_state_set_property_0x17_to_7,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny fixed property setter over the bound presentation node `[this+0x25df]`. The helper simply publishes value `7` into property `0x17`. Current grounded caller is `0x0052cb68`, so this is the safest current read for setting property `0x17` to `7` rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
 0x00546560,19,layout_state_set_property_0x17_to_4,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546540` in the same layout-state family. The helper simply publishes value `4` into property `0x17` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00546580,19,layout_state_clear_property_0xa8,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny property-clear helper over bound presentation node `[this+0x25df]`. The function publishes `0` into property `0xa8`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x005465a0,19,layout_state_set_property_0xa8_to_0x0f,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small fixed property setter beside `0x00546580` in the same layout-state family. The helper publishes value `0x0f` into property `0xa8` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00546a30,333,layout_state_rebuild_variant_asset_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Releases any loaded entries in the 64-slot presentation asset bank rooted at 0x31ab then rebuilds the paired-key metadata table at 0x266b tracking active entries count at [this+0x2667] and sibling or reuse links for later keyed lookups.,ghidra + rizin
 0x005467a0,50,layout_state_enable_presentation_gate,bootstrap,thiscall,inferred,ghidra-headless,4,Ensures the presentation node gate property 0x1c is enabled once for the layout state when the template flag at [[this+0x83c]+0x2e] permits it by setting [this+0x2549] and forwarding the toggle into the node at [this+0x25df].,ghidra + rizin
 0x005467e0,41,layout_state_disable_presentation_gate,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005467a0` in the same layout-state family. When local gate byte `[this+0x2549]` is live, the helper clears that byte and publishes `0` into property `0x1c` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + presentation-gate correlation"
 0x00546810,67,layout_state_raise_property_0x16_to_3_when_template_flag_0x1c_permits,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Template-gated property raiser in the layout-state family. When local mode byte `[this+0x254a]` is not already `2` and template byte `[[this+0x83c]+0x1c]` is nonzero, the helper publishes value `3` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 2`.","objdump + local disassembly + layout-state correlation + template-gate correlation + property-strip correlation"
 0x00546850,30,layout_state_set_property_0x16_to_2_and_store_mode1,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546810` in the same layout-state family. The helper publishes value `2` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 1`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x00546890,41,layout_state_clear_property_0x16_and_reset_mode_byte_0x254a,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x00546810/0x00546850` in the same layout-state family. When local mode byte `[this+0x254a]` is nonzero, the helper publishes value `1` into property `0x16` on bound node `[this+0x25df]` and resets `[this+0x254a]` back to `0`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
 0x005463e0,149,layout_state_release_midband_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Midband handle-release strip in the layout-state family. The helper walks a five-handle band rooted at `[this+0x260f]`, `[this+0x2617]`, `[this+0x261f]`, `[this+0x2627]`, and `[this+0x262f]`, releasing each live entry through vtable slot `+0x08`, clearing the corresponding field back to `0`, and emitting localized notice `0x9b` when the release reports success. Current grounded callers are the repeated layout-state owner branches `0x00549f1c..0x0054a1c2`, including the broader bound-presentation release body `0x0054a190`, so this is the safest current read for the midband bound-handle cleanup strip rather than a generic field reset.","objdump + caller inspection + local disassembly + layout-state correlation + handle-band correlation"
 0x005465c0,284,layout_state_release_variant_bank_and_late_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Late cleanup strip in the layout-state family beneath the broader bound-presentation release path. The helper first walks the 64-entry variant-bank table rooted at `[this+0x31ab]`, releasing every live entry through vtable slot `+0x08` with localized notice `0x9b` on successful release, then performs the same release-and-clear pattern on the later bound-handle band `[this+0x263f/+0x2643/+0x264f/+0x265b/+0x265f/+0x2663]`. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the variant bank and late bound handles rather than a generic array clear.","objdump + caller inspection + local disassembly + layout-state correlation + variant-bank correlation + handle-band correlation"
 0x00546d40,712,layout_state_publish_transform_descriptor_from_local_scalars_and_seeded_handle_0x36fd,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader descriptor-publish helper in the layout-state family. The helper builds one large stack descriptor from local scalar bands `[this+0x2517/+0x251b/+0x251f/+0x25f7/+0x25ff]`, scale factors `[this+0x24f0/+0x24f8]`, the seeded handle `[this+0x36fd]`, and a local side buffer at `[this+0x35af]`, then forwards that descriptor into the bound presentation node `[this+0x25df]`. Current grounded caller is the three-slot batch owner `0x0054ab20`, so this is the safest current read for publishing one transform-style descriptor from local scalars and seeded handle `0x36fd` rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + descriptor-publish correlation"
 0x005471f0,176,layout_state_bind_table_0x112_or_0x142_and_optionally_publish_property_0x154,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Generalized table-bind helper in the layout-state family beneath the local `0x2643/0x2647/0x264f` wrapper strip. When the caller-supplied table pointer differs from cached field `[this+0x2637]`, the helper binds that table onto the bound presentation node `[this+0x25df]`, choosing property `0x112` for `0x20`-byte records or property `0x142` for `0x18`-byte records through node slots `+0x130/+0x14c`, then caches the new table pointer. It also optionally forwards one caller dword through node slot `+0x154` and mirrors that value into `[this+0x263b]`. Current grounded callers are the small wrappers `0x0054bbd0` and `0x0054bbf0`, so this is the safest current read for the shared table-bind plus optional property-`0x154` publish helper rather than a single table-specific owner.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation + bound-node correlation"
 0x005472a0,20,layout_state_clear_property_0x1b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-clear helper over the bound presentation node `[this+0x25df]`. The function simply publishes `0` into property group `0x1b` through node slot `+0xc8`. Current grounded callers include layout-state owner branches `0x0052888d`, `0x0052b93b`, `0x0052bebc`, `0x0052caf4`, `0x00564d58`, and `0x0056507e`, so this is the safest current read for clearing property `0x1b` rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
 0x00547300,31,layout_state_publish_property_0x1b_from_template_flag_bit0,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small property publisher beside `0x005472a0` in the same layout-state family. The helper reads template byte bit `0` from `[[this+0x83c]+0x21]` and forwards that one-bit value into property group `0x1b` on the bound presentation node `[this+0x25df]` through node slot `+0xc8`. Current grounded callers include layout-state owners `0x00524c3c`, `0x0052889d`, `0x005289a0`, `0x0052ae55`, `0x0052b89c`, `0x0052cb4e`, and later shell-side presentation branches, so this is the safest current read for publishing property `0x1b` from the template bit rather than a generic flag copy.","objdump + caller inspection + local disassembly + layout-state correlation + template-flag correlation + property-strip correlation"
 0x00547320,96,layout_state_apply_capability_gated_property_0x0f_0x18_0x19_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated three-property strip in the layout-state family. When shell capability byte `[0x006d4024+0x114252]` is live, the helper publishes `1` into property `0x0f`, forwards the caller dword into property `0x18`, and then publishes fixed value `7` into property `0x19` on the bound node `[this+0x25df]`. Current grounded callers include layout-state owners `0x005243c1`, `0x00524cc9`, `0x0052873c`, `0x00529995`, `0x0052a1c9`, `0x0052a50c`, `0x0052ae5f`, `0x0052b8a6`, `0x0052c824`, and later shell-side branches, so this is the safest current read for the capability-gated `0x0f/0x18/0x19` property strip rather than an isolated scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation"
 0x00547380,64,layout_state_clear_capability_gated_property_0x0f_0x18_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small clear-side sibling to `0x00547320` in the same layout-state family. When capability byte `[0x006d4024+0x114252]` is live, the helper clears property `0x0f` and property `0x18` on the bound node `[this+0x25df]` by publishing zero into both groups. Current grounded callers include layout-state owner branches `0x00528895` and `0x0052b940`, so this is the safest current read for clearing the capability-gated `0x0f/0x18` strip rather than a generic branch reset.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation"
 0x00547610,48,layout_state_publish_bound_node_pair_0x2607_0x260b_once,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small one-shot publisher over the bound presentation node `[this+0x25df]` in the layout-state family. When local gate byte `[this+0x254c]` is still clear, the helper forwards dwords `[this+0x2607]` and `[this+0x260b]` into node vtable slot `+0x7c`, then marks the gate byte live. Current grounded callers are the setup-side owner `0x0052c032`, the small and broad release bodies `0x0055dd57/0x0055dd87/0x0055e07b`, and sibling rebuild paths such as `0x0052cc7d` and `0x0055e978`, so this is the safest current read for publishing the cached bound-node pair once rather than a generic setter.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
 0x00547640,7,layout_state_clear_bound_node_pair_0x2607_0x260b_publish_gate,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny gate-clear sibling to `0x00547610` in the same layout-state family. The helper only resets byte `[this+0x254c]` back to `0`, allowing the next `0x00547610` call to republish dwords `[this+0x2607/+0x260b]` into the bound node. Current grounded callers are nearby presentation owners such as `0x0052bc20` and `0x0052bdd3`, so this is the safest current read for clearing the one-shot publish gate rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + publish-gate correlation"
 0x00547650,578,layout_state_apply_capability_gated_presentation_property_strip_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated presentation property owner over the bound node `[this+0x25df]` in the layout-state family. When shell capability byte `[0x006d4024+0x11422d]` is live, the helper seeds one fixed property strip through repeated node slot `+0xfc` writes over property groups `0x0b`, `0x18`, `0x0d`, and `0x0e`, then binds auxiliary handles `[this+0x2623]` and `[this+0x2633]` through node slots `+0x130` and `+0x160`. When the first gate is clear but capability byte `[0x006d4024+0x114250]` is live, it instead builds one stack descriptor rooted at local handle `[this+0x36fd]`, publishes that block through node slot `+0x94` on property `0x11`, and then applies the reduced `0x0d/0x0e` property pair. Both branches finish by clearing the `0x0d/0x0e` property lane for selector `3`. Current grounded callers are the neighboring layout-state owner paths `0x0054abd1`, `0x0054b0e1`, and `0x0054b5de`, so this is the safest current read for the capability-gated presentation property strip and auxiliary-handle bind rather than a small scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + bound-node correlation"
 0x005478a0,680,layout_state_apply_trig_derived_presentation_property_strip_and_bind_aux_handles_0x261b_0x262b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Alternate property-strip sibling to `0x00547650` in the same layout-state family. After one external timing or state query, the helper applies the same initial `0x0b/0x18` property band on the bound node `[this+0x25df]`, then publishes trig-derived scalar pairs into property groups `0x07..0x0a` for selectors `2` and `3`, sets both `0x0d/0x0e` groups for selector `2`, clears those groups for selector `3`, and finally binds auxiliary handles `[this+0x261b]` and `[this+0x262b]` through node slots `+0x130` and `+0x160`. Current grounded callers are the batch owners `0x0054abca` and `0x0054b0da`, so this is the safest current read for the trig-derived alternate property strip rather than a generic sine-cosine helper.","objdump + caller inspection + local disassembly + layout-state correlation + trig-strip correlation + bound-node correlation"
 0x00547c30,224,layout_state_store_four_local_scalars_0x36df_0x36eb_and_publish_property_0x07_block,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared four-scalar publisher beneath the trig-derived layout-state strip. The helper stores four caller dwords into local scalar fields `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, validates them against the zero-threshold path, and then publishes either one identity-like `(0,0,1,1)` block or one block using the negated first pair plus the unmodified second pair into property group `0x07` on the bound presentation node `[this+0x25df]` through node slot `+0x13c` with notify flag `1`. Current grounded callers are the neighboring owner branches `0x0052c701` and `0x0052c77e`, so this is the safest current read for storing the local four-scalar band and publishing the derived property-`0x07` block rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + four-scalar correlation + property-strip correlation"
 0x00547d10,288,layout_state_apply_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Applies a four-float extent or quad block onto presentation property 0x18 for the bound node at [this+0x25df]. If all four inputs are nonpositive it clears the property through vtable slot +0xfc; otherwise it builds a 0x10-field stack block with the four caller values and a unit scalar then commits it through node slots +0xfc and +0x94.,ghidra + rizin + llvm-objdump
 0x00547f20,177,layout_state_apply_gamma_ramp_scalar,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a 256-entry three-channel gamma-ramp buffer from the caller scalar and uploads it through vtable slot +0x48 on the bound presentation node at [this+0x25df]. The helper clamps each 16-bit ramp entry stores the accepted scalar in the subordinate state block at [[this+0x83c]+0x2f] and respects shell capability guards under 0x006d4024 before touching the display device.,ghidra + rizin + llvm-objdump
 0x00548030,43,layout_state_publish_property_pair_0x13_0x14_as_1_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-pair setter in the layout-state family. The helper publishes value `1` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b8ae`, so this is the safest current read for the fixed `0x13/0x14 = 1/6` publish pair rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation"
 0x00548060,43,layout_state_publish_property_pair_0x13_0x14_as_5_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x00548030` in the same layout-state family. The helper publishes value `5` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b91c`, so this is the safest current read for the fixed `0x13/0x14 = 5/6` publish pair rather than a generic wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation"
 0x00548120,92,layout_state_reset_local_descriptor_identity_ensure_fallback_block_0x25e3_and_refresh_current_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small rect-strip owner in the layout-state family. The helper resets local descriptor `[this+0x34ef]` to identity through `0x00544360`, lazily allocates fallback block `[this+0x25e3]` and registers it on the bound node `[this+0x25df]` through slot `+0xa4`, then refreshes the sibling local descriptor `[this+0x352f]` from the current integer span pair `[this+0x25c7/+0x25cb]` by tail-calling `0x00544290`. Current grounded caller is `shell_commit_layout_updates` `0x00523d90`, so this is the safest current read for the identity-reset plus fallback-block ensure path rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation"
 0x00548180,350,layout_state_store_normalized_local_rect_0x2523_0x252f_publish_dynamic_or_fallback_block_and_refresh_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader rect update owner immediately above `0x00548120` in the same layout-state family. The helper lazily allocates fallback block `[this+0x25e3]`, stores four normalized local rect scalars into `[this+0x2523/+0x2527/+0x252b/+0x252f]` from the caller's integer rectangle corners and current span pair `[this+0x25c7/+0x25cb]`, publishes either that derived dynamic block through node slot `+0xa0` or the fallback block when the rectangle is too small, and then refreshes sibling descriptor `[this+0x352f]` by re-entering `0x00544290` with the resulting width and height deltas. Current grounded caller is the neighboring bridge `0x005482e0`, so this is the safest current read for storing the normalized local rect, publishing the dynamic-or-fallback block, and refreshing the current span rather than a generic rectangle math helper.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation + fallback-block correlation"
 0x005482e0,109,layout_state_apply_display_rect_or_delta_span_from_controller_normalized_scalars,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Bridge between the embedded view-controller scalar band and the layout-state rect-strip owners. The helper first materializes one active-display rectangle from controller scalar band `[controller+0x50..+0x5c]` through `embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c` `0x0052d4d0`; when that resolved rectangle is nondegenerate it forwards the four corners into `0x00548180`, and otherwise it computes simple width and height deltas and refreshes descriptor `[this+0x352f]` directly through `0x00544290`. Current grounded callers are shell presentation branches `0x0052c108` and `0x0052ccd8`, so this is the safest current read for applying a controller-derived display rect or fallback delta span into the layout-state family rather than a generic clamp helper.","objdump + caller inspection + local disassembly + layout-state correlation + controller-bridge correlation + rect-strip correlation"
 0x00548820,116,layout_state_seed_all_slot_triplets_to_1_2_1_pattern,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small slot-table seed helper in the broader layout-state presentation family. The function walks every live slot in `[this+0x2597]` and writes the same six-scalar pattern into both triplet halves of each `0x18`-byte slot record: `(1, 2, 1)` at `+0x00/+0x04/+0x08` and again at `+0x0c/+0x10/+0x14`. Current grounded caller is the capability-side `TextureForTests` probe strip at `0x0055dfaa`, so this is the safest current read for seeding all slot triplets to the fixed `1,2,1` pattern rather than a general reset helper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation"
 0x005488a0,157,layout_state_snapshot_current_slot_triplet_table_into_seeded_list_and_optionally_apply,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, pushes that copied table into the seeded-record list rooted at `[this+0x259b]` through `0x00557150`, and, when the caller requests it, immediately re-applies the copied low and high triplet halves to every live destination slot through `0x005455e0` and `0x005456d0` with notify flag `1`. Current grounded callers include several nearby-presentation builders `0x00524393`, `0x00524cca`, `0x005288ec`, `0x00528a20`, the broader probe path `0x00548a3b`, and later sibling presentation owners, so this is the safest current read for snapshotting the current slot-triplet table into the seeded list with an optional immediate re-apply rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + slot-triplet correlation"
 0x005489f0,237,layout_state_run_texture_for_tests_binding_probe,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Capability-style probe owner in the broader layout-state presentation family. The helper allocates one temporary payload from literal `TextureForTests` through `0x0053c1c0(0, 0, 0x7f)`, binds that payload across every live optional item slot through `0x00545520`, snapshots or reapplies the current slot-triplet state through `0x005488a0`, queries the bound presentation node at `[this+0x25df]` through vtable slot `+0x100`, re-applies the first seeded slot-triplet pair through `0x00548940(1)`, clears the live optional slot bindings back to null through `0x00545520`, releases the temporary payload through `0x0053c000`, and returns the resulting boolean-like probe outcome. Current grounded callers are the later capability-setting branch `0x0055dfc1/0x0055dfe0/0x0055e004/0x0055e047`, which mirror that result into shell capability bytes `[0x006d4024+0x114250/+0x114251]`, so this is the safest current read for the `TextureForTests` binding probe rather than a generic presentation refresh owner.","objdump + caller inspection + local disassembly + rdata string decode + layout-state correlation + capability-probe correlation"
 0x00548940,167,layout_state_apply_first_n_seeded_slot_triplet_pairs_from_list_0x259b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-triplet apply helper over the seeded record list rooted at `[this+0x259b]` in the broader layout-state presentation family. The function clamps the caller-requested record count against list count `[[this+0x259b]+0x0c]`, iterates that many seeded `0x18`-byte records through `0x00556e50`, and for each destination slot index writes the first and second triplet blocks into the cached slot table `[this+0x2597]` through `0x005455e0` and `0x005456d0` with notify flag `1`. After the pass it releases the temporary seeded-list cursor through `0x005a1145`. Current grounded callers include the nearby-presentation sweeps `0x00524521`, `0x00524e32`, `0x00529998`, the broader layout-state owner `0x00548a71`, and several sibling presentation rebuild paths, so this is the safest current read for applying the first N seeded slot-triplet pairs from list `[+0x259b]` rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation"
 0x00548c50,342,layout_state_release_history_seeded_lists_and_clear_optional_slot_bindings,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pre-release cleanup owner in the layout-state presentation family. When live slot count `[this+0x258f]` is positive, the helper drains and frees every record in the history list `[this+0x259f]` and the seeded-record list `[this+0x259b]`, releases the two list owners themselves, clears both fields back to `0`, and then walks the optional slot-binding table `[this+0x2593]` to publish null bindings through bound-node slot `+0xf4` before zeroing each slot entry. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the history and seeded lists plus clearing optional slot bindings rather than a narrow list helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + optional-binding correlation"
 0x00548da0,1328,layout_state_refresh_presentation_batches,bootstrap,thiscall,inferred,ghidra-headless,4,Walks the active presentation-batch list and refreshes the bound node state for each selected item. The routine applies batch extents through 0x00547d10 pushes style and gate properties including packed color property 0x3c updates per-slot triplets through 0x005455e0 and 0x005456d0 and emits segment-record or vertex24 spans from the current batch family before advancing to the next record.,ghidra + rizin + llvm-objdump
 0x005492d0,3747,layout_state_probe_d3d8_capabilities,bootstrap,thiscall,inferred,ghidra-headless,4,Creates a Direct3D8 probe object and walks adapter or device capability queries for the layout-state presentation path. The routine caches probed texture-memory style fields into shell globals under 0x006d4024 including the values later reported as Texture SRAM and Texture VRAM consults the shell memory-budget helpers 0x0051fa40 and 0x0051fa60 refreshes the gamma ramp through 0x00547f20 when needed and assigns a local renderer capability tier at [this+0x04].,ghidra + rizin + llvm-objdump + strings
 0x0054a0c0,176,layout_state_bind_external_source_rebuild_summary_reset_bound_node_and_select_mode_4_or_5,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader setup-side owner in the layout-state family above the newly grounded summary and reset strips. The helper binds one caller-supplied external source onto the bound presentation node `[this+0x25df]` through node slot `+0x12c`, falls back to the midband-handle cleanup strip `0x005463e0` when that bind reports failure, conditionally reapplies the cached gamma-ramp scalar from template field `[[this+0x83c]+0x2f]` through `0x00547f20`, seeds optional handle `[this+0x33ab]` through `0x00570fbd`, rebuilds summary buffer `[this+0x43c]` through `0x00545e30`, runs the repeated bound-node reset strip `0x005464d0`, clears local byte `[this+0x254d]`, and finally selects layout-state mode dword `[this+0x04]` as `4` or `5` from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`. Current grounded caller is the surrounding setup-side branch that prepares the subordinate layout state before later property application, so this is the safest current read for binding the external source, rebuilding the summary/reset strip, and selecting mode `4` or `5` rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation + summary-buffer correlation + resolution-tier correlation"
 0x0054a190,228,layout_state_release_bound_presentation_handles_and_clear_controller_slot_0x08,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broad bound-presentation release body in the layout-state family. The helper first re-enters `0x00548c50`, then releases optional handles `[this+0x33ab]`, `[this+0x25e3]`, `[this+0x25e7]`, `[this+0x25df]`, and `[this+0x25db]`, emitting shell notices through localized ids `0x9b` or `0x9c` when the bound-node release paths report success. It also re-enters the two adjacent cleanup helpers `0x005463e0` and `0x005465c0`, clears local presentation pointers `[this+0x2643/+0x25df/+0x25db]`, and finally clears shell controller dword `[0x006d4024+0x08]` back to `0`. Current grounded callers are the direct layout-state branches `0x0054bd64` and `0x0054be7f`, so this is the safest current read for releasing the bound presentation handles and controller slot rather than a generic object destructor.","objdump + caller inspection + local disassembly + layout-state correlation + presentation-release correlation"
 0x0054a280,626,layout_state_apply_presentation_properties,bootstrap,thiscall,inferred,ghidra-headless,4,Pushes visibility color and mode-dependent scalar properties from the layout state into the bound presentation node at [this+0x25df]; toggles gate property 0x1c writes packed color property 0x22 from bytes 0x2510..0x2512 updates mode properties 0x23 through 0x26 from template flags and caller-supplied scalars and caches the leading scalar at [this+0x25b3].,ghidra + rizin
 0x0054a500,1568,layout_state_refresh_variant_bank_batches_from_handle_0x2663_or_local_descriptor_set,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch owner in the layout-state family above the newly grounded `0x00547c30` strip. The helper requires active batch count `[this+0x2667]`, clears the local visited-byte strip `[this+0x254f..]`, pulses property groups `0x89` and `0x0e`, derives two normalized shell-scalars from the current shell presentation size through `0x0051f090 -> 0x00533970/0x00533980`, and then branches on midband handle `[this+0x260f]`. On the null-handle path it snapshots the current slot-triplet state through `0x005488a0`, seeds one fixed triplet pair, binds handle `[this+0x2663]` as one `0x18`-byte table on property `0x142`, reads that table through vtable slot `+0x2c`, rescales the resulting rows by local scalar band `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, and commits the resulting batch ranges through variant-bank entries `[this+0x31ab + batch*4]` into node slot `+0x11c`. On the live-handle path it instead binds current segment-record handle `[this+0x265b]`, publishes the local descriptor rooted at `[this+0x35af]`, pushes two fixed property blocks `5` and `6`, and then commits the same visited batch ranges. Current grounded caller is the neighboring owner branch `0x0052c73d`, so this is the safest current read for refreshing the variant-bank batches from handle `0x2663` or the local descriptor set rather than a generic layout rebuild body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + variant-bank correlation"
 0x0054ab20,1262,layout_state_refresh_presentation_batches_with_three_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch-refresh owner in the layout-state family with three optional slot-binding candidates. The helper clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` onto node property `0x112` when needed, chooses between the capability-gated property strips `0x00547650` and `0x005478a0`, applies one descriptor publish through `0x00546d40`, and then walks the active `0x2d`-stride batch records rooted at `[this+0x266f]`. During that walk it compares previous/current/next candidate values, updates optional slot bindings through `0x00545520` for slots `0`, `1`, and `2`, emits batch ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited batch bytes under `[this+0x254f]`, and follows the per-batch next-link selectors at `+0x267b/+0x2683/+0x2687`. Current grounded callers are the setup-side layout-state owner branches `0x0052c4d6`, `0x0052c50c`, and `0x0052c53d`, so this is the safest current read for the three-slot candidate batch-refresh owner rather than a generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation"
 0x0054b030,1159,layout_state_refresh_presentation_batches_with_two_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Two-slot sibling to `0x0054ab20` in the same layout-state batch family. The owner clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` when needed, chooses between `0x00547650` and `0x005478a0`, and then walks the same `0x2d`-stride batch records rooted at `[this+0x266f]`. Its candidate-comparison and rebinding phase only manages slots `0` and `1` through `0x00545520`, then commits the selected ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited bytes, and follows the same per-batch next-link selectors. Current grounded callers are the setup-side owner branches `0x0052c578`, `0x0052c5e5`, `0x0052c63c`, and `0x0052cb2f`, so this is the safest current read for the two-slot candidate batch-refresh owner rather than another generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation"
 0x0054b4e0,1465,layout_state_refresh_handle_0x265f_backed_batches_with_capability_variant_switch,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-switched batch-refresh owner in the same layout-state family. The helper clears the visited-byte strip `[this+0x254f..]`, ensures current segment-record handle `[this+0x265b]` is rebound, applies a capability-gated pre-strip over properties `0x0f`, `0x18`, and `0x1b`, calls `0x00547650`, and then branches on node slot `+0x128` plus capability byte `[0x006d4024+0x114250]` to choose one of two handle-backed descriptor publishes rooted at `[this+0x265f]`. After that it walks the same `0x2d`-stride batch records and commits them through variant-bank entry `[this+0x31ab + batch*4]`, but the candidate-rebinding phase is narrower and only refreshes slot `0` plus the optional slot-`1` clear path. Current grounded callers are the setup-side layout-state owner branches `0x0052c46c` and `0x0052c49a`, so this is the safest current read for the `0x265f`-backed capability-variant batch owner rather than a generic descriptor upload body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + capability-variant correlation"
 0x0054bab0,89,layout_state_bind_segment_record_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 32-byte segment-record table at [this+0x2643] onto the presentation node if it changed since the last bind. The helper drives node property 0x112 through vtable slots +0x130 and +0x14c with record size 0x20 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
 0x0054bb10,90,layout_state_bind_alternate_segment_record_table_0x263f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x0054bab0` in the same layout-state family. The helper binds alternate `0x20`-byte segment-record table `[this+0x263f]` onto property `0x112` of the bound presentation node `[this+0x25df]` when that table differs from cached field `[this+0x2637]`, then clears local dirty dword `[this+0x263b]`. Current grounded caller is the nearby owner branch `0x00528885`, so this is the safest current read for the alternate segment-record table bind rather than a broader batch owner.","objdump + caller inspection + local disassembly + layout-state correlation + segment-record correlation"
 0x0054bb70,90,layout_state_bind_vertex24_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 24-byte vertex24 table at [this+0x2647] onto the presentation node if it changed since the last bind. The helper drives node property 0x142 through vtable slots +0x130 and +0x14c with record size 0x18 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
 0x0054bbd0,22,layout_state_bind_vertex24_table_0x264f_and_publish_property_0x154_from_0x2653,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny wrapper into `0x005471f0` in the layout-state family. The helper binds the `0x18`-byte table `[this+0x264f]` onto the bound presentation node and forwards companion dword `[this+0x2653]` through property `0x154`. Current grounded callers are the neighboring owner branches `0x0052b8be` and `0x0052b94b`, so this is the safest current read for the `0x264f/0x2653` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation"
 0x0054bbf0,22,layout_state_bind_vertex24_table_0x2647_and_publish_property_0x154_from_0x264b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny sibling wrapper into `0x005471f0` in the same layout-state family. The helper binds the `0x18`-byte table `[this+0x2647]` onto the bound presentation node and forwards companion dword `[this+0x264b]` through property `0x154`. Current grounded callers are the nearby owner branches `0x0052ae2b` and `0x0054e30b`, so this is the safest current read for the `0x2647/0x264b` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation"
 0x0054bc10,592,shell_init_layout_state_defaults,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the large subordinate layout-state object allocated by 0x0055e2b0; seeds default float and flag fields points [this+0x83c] at a shell-bundle template block near 0x006d4024+0x11468a optionally copies a 0x72c-byte preset table and notifies the shell bundle service at [0x006d4024+0x28].,ghidra + rizin
 0x0054be60,52,layout_state_export_preset_table_0x840_to_global_defaults_and_refresh,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small export-and-refresh helper in the shell layout-state family. The function copies the full `0x72c`-byte preset table from `[this+0x840]` into global default cache `0x00ccbb68`, raises global dirty byte `0x00ccd820`, refreshes the surrounding layout-state side through `0x0054a190`, and clears shell controller pointer field `[0x006d4024+0x0c]` through `shell_controller_store_pointer_field_0x0c` `0x0051eff0(0)`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd9a` and `0x0055e29d`, so this is the safest current read for exporting preset table `0x840` into the global defaults and refreshing the shell-side cache rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + default-cache correlation"
 0x0054bea0,1399,layout_state_apply_interpolated_pose,bootstrap,thiscall,inferred,ghidra-headless,4,Applies an interpolated pose and palette sample on the subordinate layout-state object using the controller counters passed by callers; clamps the time window blends preset tables at offsets 0x840 through 0x86f updates color bytes at 0x2510 through 0x2512 invokes the bound presentation node at [this+0x25df] and finishes through 0x0054a280.,ghidra + rizin
 0x0055ddc0,664,shell_seed_layout_state_probe_snapshot_handles_by_resolution_tier,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Setup-side probe owner for the shell layout-state family. The helper first chooses a small resolution tier, `4` or `5`, from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`, then programs a sequence of fixed slot-triplet patterns into subordinate layout state `[this+0x2d]` through `0x005455e0/0x005456d0`, snapshotting each resulting slot table through `0x005454c0` and storing the returned handles into local probe fields `[this+0x35/+0x39/+0x3d/+0x41/+0x45/+0x49/+0x4d/+0x51/+0x55/+0x59]`. After that it seeds all live slots to the fixed `(1,2,1)` pattern through `0x00548820`, clears shell capability byte `[0x006d4024+0x114251]`, probes several of the stored snapshot handles through `layout_state_run_texture_for_tests_binding_probe` `0x005489f0`, mutates one fallback probe record at `[this+0x4d]` when the first pass fails, and finally mirrors the resulting booleans into shell capability bytes `[0x006d4024+0x114250/+0x114251]`. Current grounded caller is the layout-state constructor `shell_create_layout_state` `0x0055e2b0`, so this is the safest current read for seeding the layout-state probe snapshots by resolution tier rather than a generic table initializer.","objdump + caller inspection + local disassembly + layout-state correlation + capability-probe correlation + resolution-tier correlation"
 0x0055dd80,50,shell_release_layout_state_field_0x2d_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small layout-state teardown sibling over owner field `[this+0x2d]`. The helper first refreshes and drops the live layout-state side through `0x00547610` and `0x00542c10`, then, when `[this+0x2d]` is nonnull, releases that subordinate layout-state object through `0x0054be60` and `0x0053b080` before clearing the field back to null. Current grounded callers are the broader layout-state rebuild owner `0x00565110` and the local branch at `0x00520008`, so this is the safest current read for the direct layout-state field release helper rather than a generic object free.","objdump + caller inspection + local disassembly + layout-state correlation + teardown correlation"
 0x0055e060,587,shell_release_layout_state_owner_resources_and_subordinate_handles,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader release body in the same shell layout-state owner family. When activation dword `[this+0x01]` is live, the helper first shuts down subordinate payload `[this+0x5d]`, refreshes and drops layout-state side `[this+0x2d]` through `0x00547610` and `0x00542c10`, and then walks a long owned-handle strip rooted at `[this+0x65]`, `[this+0x79..+0x8d]`, `[this+0x95..+0xa5]`, `[this+0x364d]`, and `[this+0x3651..+0x3665]`, releasing each live entry through the corresponding local family helper plus `0x0053b080` or `0x0053c000`. The tail also clears several cached layout-owned pointers and finally releases the subordinate layout-state object at `[this+0x2d]` through `0x0054be60`. Current grounded caller is the shell-side owner branch at `0x0051ffee`, which frees `[owner+0x18]` through this helper when the higher-level teardown flag is set, so this is the safest current read for the full layout-state owner release body rather than a small field reset.","objdump + caller inspection + local disassembly + layout-state correlation + owner-release correlation"
 0x0054e3a0,528,shell_controller_window_message_dispatch,shell,stdcall,inferred,objdump,4,Primary window-message ingress for the active shell controller window. The dispatcher branches over low window lifecycle messages handles `WM_KEYDOWN` and `WM_KEYUP` by first updating the shell controller through 0x0051f0c0 or 0x0051f0d0 and then forwarding the transition into shell_input_apply_window_key_transition at 0x0054f290 on the shell input object rooted at 0x006d4018 routes `WM_COMMAND` through 0x0054eb10 routes mouse messages in the `0x0200..0x0208` family through 0x0054ee50 and falls back to `DefWindowProcA` for unhandled cases. This is the first grounded shell-side input ingest path rather than only a generic message drain.,objdump + import table + callsite inspection
 0x0054e5d0,88,shell_drain_pending_window_messages,shell,cdecl,inferred,objdump + analysis-context,4,Shared pending-message drain that loops on `PeekMessageA` with remove mode 1 and feeds each dequeued record through `TranslateMessage` and `DispatchMessageA` until the queue is empty. Shell modal waits layout rebuild paths mouse-cursor frame work and the keyboard-toggle helpers all reuse this routine so it sits below the real input handlers rather than serving as the input dispatcher itself.,objdump + analysis-context + import table
 0x0054e710,110,shell_input_state_init,shell,thiscall,inferred,objdump + analysis-context,3,Initializes the standalone shell input-state object later stored at 0x006d4018. It zeroes the 0xaa8-byte state block resets counters and flags under +0xa88 through +0xa9c caches host metrics through `GetSystemMetrics` and `GetDoubleClickTime` and clears the per-key state storage that later window-message handlers update.,objdump + analysis-context + import table
 0x0054e880,305,shell_input_service_pointer_proximity_event_record_and_queue_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one queued 12-dword shell-input event record from the ring rooted at `[this+0x128]` as a pointer-proximity or timeout update. The helper classifies input record types `6`, `8`, and `10` into one of three local slot bands under `[this+0x104]`, `[this+0x110]`, and `[this+0x11c]`, measures the absolute pointer delta against the controller-selected view size from `[0x006d4024+0x34 + selector*0x15]`, compares that against the shared radius threshold, and either snapshots the current pointer coordinates plus deadline tick into the chosen slot or clones the record into a follow-on event with rewritten type `0x1e`, `0x20`, or `0x22` before requeueing it through `0x0054e9c0`. Current grounded callers are the queue wrappers `0x0054e9c0`, `0x0054f5b0`, and `0x0054eb10`, so this is the safest current read for the pointer-proximity event service owner rather than another generic ring-buffer helper.","objdump + caller inspection + local disassembly + event-ring correlation + pointer-proximity correlation"
 0x0054e9c0,79,shell_input_enqueue_event_record_and_run_pointer_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small queue wrapper over the shell-input event ring at `[this+0x128]`. The helper appends one caller-supplied 12-dword record into the ring, rewrites ring index `[this+0xa88]` from `0x32` back to `0x31` when needed, increments that index, and immediately tails into `0x0054e880` on the same record. Current grounded callers are `shell_input_apply_window_key_transition` `0x0054f290`, `shell_input_enqueue_window_event_record_and_signal_dispatch` `0x0054f5b0`, and `shell_input_handle_window_command_and_toggle_messages` `0x0054eb10`.","objdump + caller inspection + local disassembly + event-ring correlation"
 0x0054ea20,229,shell_input_pop_next_event_record_with_type2_coalescing,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Dequeues the next 12-dword shell-input event record from the same ring at `[this+0x128]` into one caller output buffer. When more than one event is pending and nested dispatch latch `[this+0xa90]` is clear, the helper compacts the ring forward, decrements the event count, and performs one special coalescing pass for adjacent type-`2` records when no key-state byte at `[this+0x100]` is active. Current grounded caller is `shell_input_snapshot_dispatch_state` `0x0054f4d0`, which uses this helper to pull one filtered dispatch record at a time.","objdump + caller inspection + local disassembly + event-ring correlation + coalescing correlation"
 0x005708c0,11,refcounted_object_vtable_0x5deba0_query_current_matrix_pointer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny current-entry pointer helper for the `0x5deba0` object family. The function resolves and returns the current `0x40`-byte matrix entry at `[this+0x08 + [this+0x0c]*0x40]`.","objdump + local disassembly + object-family correlation + matrix-row correlation"
 0x005708ce,36,aligned_alloc_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small aligned-allocation helper reused by the `0x5deba0` object family. The function allocates `requested_size + 0x10` bytes through `0x0053b070`, rounds the returned pointer up to the next 16-byte boundary, stores the applied back-offset in byte `[aligned_ptr-1]`, and returns that aligned pointer. Current grounded caller is `0x0057091d`, which uses this helper for `0x40`-byte matrix-row blocks.","objdump + local disassembly + allocation correlation + alignment correlation"
 0x005708f2,22,aligned_free_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Free-side sibling to `0x005708ce`. When the incoming aligned pointer is nonnull, the helper reads the stored back-offset byte at `[ptr-1]`, reconstructs the original allocation base, and frees it through `0x0053b080`. Current grounded callers are destructor `0x00570908` and the `0x5deba0` growth path.","objdump + local disassembly + allocation correlation + alignment correlation"
 0x00570908,21,refcounted_object_vtable_0x5deba0_destruct_and_release_row_block,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small destructor-side helper for the `0x5deba0` object family. The function reinstalls vtable `0x005deba0`, releases optional row-block pointer `[this+0x08]` through `0x005708f2`, and returns. Current grounded caller is the release wrapper `0x005709da`, so this is the safest current read for destructing the object and dropping its row block rather than a broader owner teardown.","objdump + local disassembly + object-family correlation + row-block correlation"
 0x0057091d,108,refcounted_object_vtable_0x5deba0_reserve_0x40_byte_row_capacity,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Reserve owner for the same `0x5deba0` object family. The helper allocates one aligned row block sized as `requested_count << 6`, fills it from fixed `0x40`-byte template `0x0056cd2c`, stores the resulting pointer into `[this+0x08]`, stores requested row capacity into `[this+0x04]`, clears live row count `[this+0x0c]`, and then dispatches one object-specific follow-on through vtable slot `+0x14`. Current grounded caller is the create-and-reserve wrapper `0x00570fbd(0x10)`, so this is the safest current read for reserving `0x40`-byte row capacity rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + row-capacity correlation"
 0x0057098b,77,refcounted_object_vtable_0x5deba0_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the `0x5deba0` object family. The helper accepts exactly two interface ids: `IUnknown` `{00000000-0000-0000-C000-000000000046}` from `0x005eaaec` and one custom IID rooted at `0x005c8520`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
 0x005709da,26,refcounted_object_vtable_0x5deba0_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the `0x5deba0` object family. The helper re-enters destructor `0x00570908`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00570fa1`, which invokes this path when refcount `[this+0x10]` reaches zero.","objdump + local disassembly + object-family correlation + refcount correlation"
 0x005709f6,180,refcounted_object_vtable_0x5deba0_grow_row_capacity_and_append_duplicate_last_row,bootstrap,thiscall,inferred,objdump + local disassembly,2,"First growth owner above `0x0057091d` in the same `0x5deba0` object family. The helper increments live row count `[this+0x0c]`, doubles row capacity `[this+0x04]` and reallocates the `0x40`-byte row block when the new count would exceed capacity, then duplicates the previous `0x40`-byte row into the new last slot. This is the safest current read for growing row capacity and appending a duplicate of the last row rather than a generic vector push.","objdump + local disassembly + object-family correlation + row-capacity correlation + row-block correlation"
 0x00570aac,95,refcounted_object_vtable_0x5deba0_set_current_matrix_to_identity,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small current-entry seed helper for the `0x5deba0` object family. The function resolves the current `0x40`-byte entry at `[this+0x08 + [this+0x0c]*0x40]`, zeroes all sixteen float lanes, and then writes `1.0` into offsets `0x00`, `0x14`, `0x28`, and `0x3c`, producing an identity 4x4 matrix. This is the safest current read for seeding the current matrix to identity rather than a generic clear helper.","objdump + local disassembly + object-family correlation + matrix-row correlation"
 0x00570b0d,29,refcounted_object_vtable_0x5deba0_store_current_matrix_from_caller_block,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Direct current-entry store helper for the `0x5deba0` object family. The function copies one caller-supplied `0x40`-byte block into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for storing the current matrix from a caller block rather than a generic memcpy wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation"
 0x00570b2c,72,refcounted_object_vtable_0x5deba0_compose_current_matrix_with_caller_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Current-entry composition helper for the `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, current, caller)` and writes the resulting block back into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for composing the current matrix with one caller matrix on the right-hand side rather than a generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation"
 0x00570b76,72,refcounted_object_vtable_0x5deba0_compose_caller_matrix_with_current_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling composition helper to `0x00570b2c` in the same `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, caller, current)` and writes the result back into the current entry. This is the safest current read for composing the caller matrix with the current matrix on the right-hand side rather than another generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation"
 0x00570bc0,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056df7d` from the caller pointer plus one float scalar, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56df7d`-generated right-side composition path rather than a generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
 0x00570c2f,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570bc0` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte helper matrix through `0x0056df7d`, then composes it on the left through `0x0056d3cd(temp, helper, current)` and stores the result back into the current entry. This is the safest current read for the left-side `0x56df7d` composition path rather than another generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
 0x00570c9e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56e1a8`-generated right-side composition path rather than a generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
 0x00570d1a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570c9e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, composes it on the left through `0x0056d3cd(temp, helper, current)`, and stores the result back into the current entry. This is the safest current read for the left-side `0x56e1a8` composition path rather than another generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
 0x00570d96,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dc9a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dc9a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
 0x00570e12,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570d96` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dc9a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dc9a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
 0x00570e8e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dd2a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dd2a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
 0x00570f0a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570e8e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dd2a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dd2a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
 0x00570f86,27,refcounted_object_vtable_0x5deba0_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for one 0x14-byte refcounted object family. The helper installs vtable `0x005deba0`, clears dwords `[this+0x04/+0x08/+0x0c]`, and seeds refcount `[this+0x10] = 1`. Current grounded direct caller is the create-and-reserve wrapper `0x00570fbd`, so this is the safest current read for initializing the `0x5deba0` object family rather than a wider bootstrap owner.","objdump + local disassembly + object-family correlation"
 0x00570fa1,26,refcounted_object_vtable_0x5deba0_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the `0x5deba0` object family. The function decrements refcount `[this+0x10]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x005709da(1)` to destroy and free the object. This is the safest current read for the direct refcount decrement path rather than a generic counter helper.","objdump + local disassembly + object-family correlation + refcount correlation"
 0x00570fbd,86,create_refcounted_object_vtable_0x5deba0_and_reserve_block_0x10,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small create-and-reserve wrapper for the same `0x5deba0` object family. The helper validates the caller out-pointer, allocates one `0x14`-byte object through `0x0053b070`, initializes it through `0x00570f86`, asks the new object to reserve or materialize one `0x10`-byte block through `0x0057091d(0x10)`, releases the object through vtable slot `+0x08` on failure, and stores the live pointer through the caller outparam on success. Current grounded caller is the setup-side layout-state owner `0x0054a0c0`, which uses this helper to seed optional handle `[layout+0x33ab]`, so this is the safest current read for creating the refcounted `0x5deba0` object and reserving its first `0x10`-byte block rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + allocation correlation"
 0x0057ad20,58,refcounted_object_vtable_0x5def30_destruct_release_resource_fields_and_attached_object,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def30`. The helper reinstalls vtable `0x005def30`, conditionally tears down resource field `[this+0x48]` through `0x00580bb9/0x00580bdc`, frees optional heap block `[this+0x08]` through import thunk `0x005c8058`, and releases attached object `[this+0x4c]` through its vtable slot `+0x08`. This is the safest current read for destructing the `0x5def30` object family and releasing its owned fields rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + resource-field correlation"
 0x0057ad5a,11,refcounted_object_vtable_0x5def30_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for object family `0x005def30`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation"
 0x0057ad67,91,refcounted_object_vtable_0x5def30_bind_resource_field_attach_object_and_copy_15_dword_payload,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for object family `0x005def30`. When both caller inputs are nonnull, the helper initializes resource field `[this+0x48]` through `0x0058123c`, allocates payload block `[this+0x08]` through import thunk `0x005c8054`, stores attached object `[this+0x4c]` with an addref, and copies one `0x0f`-dword payload block into `[this+0x0c]`. Otherwise it returns `0x8876086c`. This is the safest current read for binding the resource field, attaching the sibling object, and copying the fixed payload block rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + payload-copy correlation"
 0x0057add4,21,refcounted_object_vtable_0x5def30_get_attached_object_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for object family `0x005def30`. The helper writes attached object `[this+0x4c]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + attached-object correlation"
 0x0057adfb,18,refcounted_object_vtable_0x5def30_copy_15_dword_payload_out,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small payload-copy helper for object family `0x005def30`. The function copies the fixed `0x0f`-dword payload block from `[this+0x0c]` into the caller destination and returns `0x8876086c` only when the destination pointer is null.","objdump + local disassembly + object-family correlation + payload-copy correlation"
 0x0057ae0f,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_5809c7,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x005809c7`.","objdump + local disassembly + object-family correlation + resource-field correlation"
 0x0057ae1e,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a54,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae0f` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580a54`.","objdump + local disassembly + object-family correlation + resource-field correlation"
 0x0057ae2d,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode0,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader pass-through owner for object family `0x005def30`. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `0` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation"
 0x0057ae53,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode1,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Mode-`1` sibling to `0x0057ae2d` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `1` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation"
 0x0057ae79,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a84,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x00580a84`.","objdump + local disassembly + object-family correlation + resource-field correlation"
 0x0057ae88,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580aff,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae79` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580aff`.","objdump + local disassembly + object-family correlation + resource-field correlation"
 0x0057ae97,66,refcounted_object_vtable_0x5def30_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x005def30`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8500`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
 0x0057aedb,22,refcounted_object_vtable_0x5def30_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for object family `0x005def30`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571016(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation"
 0x0057aef3,27,refcounted_object_vtable_0x5def30_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for object family `0x005def30`. The helper installs vtable `0x005def30`, seeds refcount `[this+0x04] = 1`, and clears optional fields `[this+0x08]`, `[this+0x48]`, and `[this+0x4c]`.","objdump + local disassembly + object-family correlation"
 0x0057af0e,64,refcounted_object_vtable_0x5def5c_destruct_release_optional_target_and_two_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def5c`. The helper reinstalls vtable `0x005def5c`, and when target field `[this+0x08]` is live it conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0` before releasing the target itself through slot `+0x08`. This is the safest current read for destructing the `0x5def5c` object family and releasing its optional target-side handles rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + target-handle correlation"
 0x0057af4e,11,refcounted_object_vtable_0x5def5c_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for sibling object family `0x005def5c`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation"
 0x0057af5b,115,refcounted_object_vtable_0x5def5c_attach_target_and_derive_cached_flag_pair,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for sibling object family `0x005def5c`. The helper stores one caller target object into `[this+0x08]` with addref, queries two target-side flag blocks through vtable slots `+0x1c` and `+0x24`, and derives cached booleans `[this+0x1c]` and `[this+0x18]` from the observed flag bits before returning success. When the incoming target pointer is null it returns `0x8876086c`. This is the safest current read for attaching the target and deriving the cached flag pair rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + target-flag correlation"
 0x0057afd0,36,refcounted_object_vtable_0x5def5c_get_target_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for sibling object family `0x5def5c`. The helper writes target field `[this+0x08]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + target-object correlation"
 0x0057aff6,40,refcounted_object_vtable_0x5def5c_release_handle_0x10_once,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small one-shot release helper for sibling object family `0x5def5c`. When live flag `[this+0x0c]` is nonzero, the function asks target `[this+0x08]` to release handle `[this+0x10]` through vtable slot `+0xd8`, then clears `[this+0x0c]` back to `0`; otherwise it returns `0x80004005`. This is the safest current read for releasing handle `0x10` once rather than a generic boolean guard.","objdump + local disassembly + object-family correlation + target-handle correlation"
 0x0057b021,61,refcounted_object_vtable_0x5def5c_clear_optional_handles_0x14_and_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small clear-side sibling to `0x0057aff6` in the `0x5def5c` family. When target field `[this+0x08]` is live, the helper conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0`, then clears both fields back to `0`.","objdump + local disassembly + object-family correlation + target-handle correlation"
 0x0057b060,3,refcounted_object_vtable_0x5def5c_return_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Literal zero-return stub in the `0x5def5c` helper strip.","objdump + local disassembly + object-family correlation"
 0x0057b065,66,refcounted_object_vtable_0x5def5c_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x5def5c`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c84f0`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
 0x0057b0a9,22,refcounted_object_vtable_0x5def5c_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for sibling object family `0x5def5c`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571032(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation"
 0x0057b0c1,1074,refcounted_object_vtable_0x5def5c_seed_target_handles_publish_property_strip_and_latch_ready,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader service owner for sibling object family `0x5def5c`. The helper rejects re-entry when ready latch `[this+0x0c]` is already set, then, when optional handle `[this+0x10]` is still null, queries the target at `[this+0x08]` through slots `+0xd0`, `+0x130`, `+0x94`, `+0xc8`, `+0xfc`, and `+0xd4` to seed the two handle lanes `[this+0x10/+0x14]`, publish one fixed property strip, and optionally build one target-derived matrix when cached flag `[this+0x1c]` is clear. The tail always replays target slot `+0xdc` for `[this+0x10]`, target slot `+0xd8` for `[this+0x14]`, conditionally emits one more target-derived matrix through slot `+0x94`, and finally marks ready latch `[this+0x0c] = 1`. This is the safest current read for seeding target handles, publishing the fixed property strip, and latching the object ready rather than a generic virtual wrapper.","objdump + local disassembly + object-family correlation + target-handle correlation + property-strip correlation"
 0x0057b4fd,213,target_object_build_local_transform_block_from_optional_anchor_pairs_angle_and_scale_and_dispatch_slot_0x18,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader target-side geometry owner immediately above the `0x5def5c` service strip. The helper conditionally lifts up to three optional caller anchor pairs into local vec2-plus-scalar records, derives one temporary transform block through `0x0056e1bf` from those optional anchors plus caller angle and scale inputs, and then forwards that finished block into the target object through vtable slot `+0x18` with the caller's dispatch pair. This is the safest current read for building one local transform block from optional anchor pairs, angle, and scale before dispatching slot `+0x18`, rather than a generic float wrapper.","objdump + local disassembly + target-object correlation + transform-block correlation"
 0x00580867,75,target_service_init_clear_entry_bands_and_aux_fields,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the target-service object family wrapped by `0x005def30`. The helper seeds refcount `[this] = 1`, clears the target, attached-object, embedded entry-band roots, ready byte, service handles, auxiliary handle roots, and list link at `[this+0xac]`, and leaves the object ready for the later constructor-side owner `0x00580be8`.","objdump + local disassembly + target-service-family correlation + constructor correlation"
 0x005808b2,249,target_service_destruct_release_handles_entry_bands_and_unlink_global_cache,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for the same target-service family. The helper releases the two target-bound service handles `[this+0x64/+0x68]` through target slot `+0xe0`, walks and releases the two embedded eight-entry bands rooted at `[this+0x10]` and `[this+0x30]`, drops attached object `[this+0x0c]` and target `[this+0x04]`, tears down the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, `[this+0x9c]`, and `[this+0xa8]` through the imported `0x005c8030/0x005c803c/0x005c8058` helpers, and finally unlinks the object from the global cache chain rooted at `0x00db89e4`. This is the safest current read for the full target-service destructor rather than a generic cleanup body.","objdump + local disassembly + target-service-family correlation + destructor correlation + global-cache correlation"
 0x005809ab,28,target_service_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the target-service family. The helper re-enters destructor `0x005808b2`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00580bdc`.","objdump + local disassembly + target-service-family correlation + refcount correlation"
 0x005809c7,141,target_service_seed_handles_0x64_0x68_and_latch_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Activation-side owner for the next target-service family beneath the `0x5def30` wrappers. When ready byte `[this+0x60]` is still clear, the helper ensures service handles `[this+0x64]` and `[this+0x68]` through target `[this+0x04]` vtable slots `+0xd0` and `+0xd4`, invokes attached object `[this+0x0c]` through slot `+0x10`, republishes those two handles back into the target through slots `+0xdc` and `+0xd8`, and finally marks `[this+0x60] = 1`. This is the safest current read for seeding the two service handles and latching the service live rather than a generic query helper.","objdump + local disassembly + target-service-family correlation + handle-seed correlation"
 0x00580a54,48,target_service_release_handle_0x64_and_clear_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005809c7` in the same target-service family. When ready byte `[this+0x60]` is nonzero, the helper asks target `[this+0x04]` to release handle `[this+0x64]` through vtable slot `+0xd8`, notifies attached object `[this+0x0c]` through slot `+0x1c`, and clears `[this+0x60]` back to `0`.","objdump + local disassembly + target-service-family correlation + handle-release correlation"
 0x00580a84,123,target_service_release_handles_and_reset_embedded_entry_bands,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Broader release owner for the same target-service family. The helper tears down target-side handle state through target `[this+0x04]`, attached object `[this+0x0c]`, and the optional handles rooted at `[this+0x64]` and `[this+0x68]`, then iterates the two embedded eight-entry bands under `[this+0x10]` and `[this+0x30]` to clear their per-entry pointers and counters. This is the safest current read for releasing the bound handles and resetting the embedded entry bands rather than a generic cleanup fragment.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation"
 0x00580aff,186,target_service_build_embedded_entry_bands_from_mode_variant_and_dispatch_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Setup-side owner immediately above the clear strip in the same target-service family. When entry root `[this+0x10]` is still null, the helper branches on local mode byte `[this+0x50]` to choose one of two fixed parameter triples, seeds control scalars `[this+0x54]`, `[this+0x58]`, and `[this+0x5c]` through `0x00570669` and `0x00570691`, iterates the embedded entry bands rooted at `[this+0x10]` and dispatches each live per-entry object through slot `+0x3c`. This is the safest current read for building the embedded entry bands from the mode variant and dispatching their setup slot rather than a generic initializer.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation"
 0x00580bb9,35,target_service_release_aux_handle_band_if_live,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small auxiliary release helper for the same target-service family. When optional band flag `[this+0x6c]` is live, the helper walks the pointer band rooted at `[this+0xa8]`, releases it through import thunk `0x005c803c`, and clears the associated slots back to `0`.","objdump + local disassembly + target-service-family correlation + auxiliary-handle correlation"
 0x00580bdc,12,target_service_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny refcount-drop helper for the same target-service family. The function decrements refcount `[this]` and when it reaches zero tail-calls release wrapper `0x005809ab(1)`.","objdump + local disassembly + target-service-family correlation + refcount correlation"
 0x00580be8,321,target_service_init_seed_mode_scalars_build_entry_bands_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Constructor-side owner for the target-service family wrapped by the `0x5def30` object. The helper stores caller target `[this+0x04]`, derives mode byte `[this+0x50]` from target-side flags, seeds the fixed scalar triple `[this+0x54] = 0x15`, `[this+0x58] = 0x40`, `[this+0x5c] = 0x10`, invokes embedded-band builder `0x00580aff`, initializes the later service roots under `[this+0x70..]`, and allocates or binds the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, and `[this+0x9c]`. This is the safest current read for initializing the target-service object, seeding its mode scalars, building the entry bands, and binding the auxiliary handles rather than a generic constructor fragment.","objdump + local disassembly + target-service-family correlation + constructor correlation"
 0x00580d29,1299,target_service_dispatch_payload_block_with_mode_variant_and_target_callbacks,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary target-service owner beneath the `0x0057ae2d/0x0057ae53` wrappers. The helper accepts the target-service object, the caller payload block, five caller arguments, and a fixed mode variant flag from the wrapper, then branches across local bounds, anchor, and callback conditions while using service handle `[this+0x6c]` plus external callbacks rooted at `0x005c81e4`, `0x005c8248`, and `0x005c824c`. Current static evidence is strong enough to ground this as the main payload-dispatch and layout-style service body for the target-service family, while the exact user-facing meaning of every branch remains open.","objdump + local disassembly + target-service-family correlation + payload-block correlation + callback correlation"
 0x0058123c,117,target_service_cache_or_create_for_target_and_return_via_outparam,bootstrap,cdecl,inferred,objdump + local disassembly,2,"Factory-side helper above the target-service family. The function walks the global cache chain rooted at `0x00db89e4` looking for an existing target-service object whose target field `[entry+0x04]` matches the caller target. On a hit it increments the service refcount and returns the cached object through the caller outparam. Otherwise it allocates one `0xb0`-byte object through `0x0053b070`, initializes it through `0x00580867`, runs constructor owner `0x00580be8`, and on failure releases it through `0x005809ab(1)`. This is the safest current read for the cache-or-create factory for the target-service family rather than a generic resource wrapper constructor.","objdump + local disassembly + target-service-family correlation + global-cache correlation + factory correlation"
 0x005812b1,16,dword_pointer_vector_reset_4dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one four-dword vector-style record. The function clears fields `[this+0x00]`, `[this+0x04]`, `[this+0x08]`, and `[this+0x0c]` back to zero.","objdump + local disassembly + container-helper correlation"
 0x005812c1,14,dword_pointer_vector_release_storage_if_nonnull,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small release helper for the same four-dword vector record. When storage pointer `[this+0x00]` is nonnull, the helper frees it through `0x0053b080`.","objdump + local disassembly + container-helper correlation"
 0x005812cf,110,dword_pointer_vector_push_value_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable dword-pointer vector append helper. The function checks count `[this+0x04]` against capacity `[this+0x08]`, grows the backing dword array at `[this+0x00]` by `0x10` entries through `0x0053b070` when full, preserves existing contents, writes the caller dword into the next slot, increments the count, and stores allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation"
 0x0058133d,52,dword_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same dword-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last dword through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation"
 0x00581371,8,dword_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same dword-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation"
 0x00581379,19,string_pointer_vector_reset_5dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one five-dword string-pointer vector record. The function clears storage pointer, count, capacity, status, and accumulated-byte counter fields `[this+0x00..+0x10]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
 0x0058138c,49,string_pointer_vector_release_storage_and_owned_strings,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release helper for the string-pointer vector record. When storage `[this+0x00]` is live, the helper walks all counted string pointers, frees each owned string through `0x0053b080`, then frees the pointer array itself through the same allocator shim.","objdump + local disassembly + container-helper correlation + string-vector correlation"
 0x005813bd,179,string_pointer_vector_push_copy_or_null_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable string-pointer vector append helper. The function grows the pointer array at `[this+0x00]` by `0x10` entries when count reaches capacity, then either stores a null pointer for a null caller string or allocates and copies a private NUL-terminated copy of the caller string, updates accumulated-byte counter `[this+0x10]`, stores the resulting pointer in the next slot, increments the count, and records allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
 0x00581470,52,string_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same string-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last string pointer through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
 0x005814a4,8,string_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same string-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation + string-vector correlation"
 0x005814ac,232,string_pointer_vector_build_newline_joined_text_object,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary owner above the string-pointer vector helper strip. When accumulated-byte count `[this+0x10]` is nonzero, the helper allocates one `0x10`-byte text object through `0x0053b070`, initializes it through `0x00581673`, asks that object to allocate a text buffer sized for total string bytes plus one newline per stored string plus the trailing NUL through vtable slot `+0x18`, and then copies each stored string from the vector into the owned buffer separated by literal `0x0a` bytes before returning the object through the caller outparam. This is the safest current read for building one newline-joined text object from the stored string vector rather than a generic vector wrapper.","objdump + local disassembly + string-vector correlation + text-object correlation"
 0x00581594,21,text_object_vtable_0x5e0bd8_destruct_release_owned_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the small text object family rooted at vtable `0x005e0bd8`. The helper reinstalls that vtable and frees owned text buffer `[this+0x0c]` through `0x0053b080` when it is live.","objdump + local disassembly + text-object correlation"
 0x005815a9,38,text_object_vtable_0x5e0bd8_allocate_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Allocation helper for the same text object family. The function stores the requested byte length in `[this+0x08]`, allocates that many bytes through `0x0053b070`, writes the result to `[this+0x0c]`, and returns either `0` or allocation failure `0x8007000e`.","objdump + local disassembly + text-object correlation"
 0x005815cf,11,text_object_vtable_0x5e0bd8_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for the same text object family. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + text-object correlation + refcount correlation"
 0x005815dc,30,text_object_vtable_0x5e0bd8_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the same text object family. The function decrements refcount `[this+0x04]`, and when it reaches zero tail-calls release wrapper `0x00581610(1)`.","objdump + local disassembly + text-object correlation + refcount correlation"
 0x005815fc,18,text_object_vtable_0x5e0bd8_get_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns owned text buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation"
 0x00581606,8,text_object_vtable_0x5e0bd8_get_buffer_length,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns stored buffer length `[this+0x08]`.","objdump + local disassembly + text-object correlation"
 0x00581610,26,text_object_vtable_0x5e0bd8_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the same text object family. The helper re-enters destructor `0x00581594`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + text-object correlation + refcount correlation"
 0x0058162c,71,text_object_vtable_0x5e0bd8_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the same text object family. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8510`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + text-object correlation + COM-correlation"
 0x00581673,24,text_object_vtable_0x5e0bd8_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the same text object family. The helper installs vtable `0x005e0bd8`, seeds refcount `[this+0x04] = 1`, and clears buffer-length `[this+0x08]` plus owned-buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation"
 0x00581690,64,math_apply_2d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small SSE helper over one caller output buffer, one XY input pair, and one basis or translation block. The function multiplies the input X and Y scalars by the first two 16-byte rows at `[basis+0x00]` and `[basis+0x10]`, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. This is the safest current read for the shared 2D-basis-plus-translation vec4 builder rather than a gameplay-specific transform.","objdump + local disassembly + SSE arithmetic inspection"
 0x005816d0,96,math_apply_2d_basis_rows_translation_and_project_xy_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective sibling to `0x00581690`. The helper builds the same intermediate 4-lane vector from the caller XY pair and basis or translation rows, then derives a reciprocal from lane 3 and uses it to scale the vector before storing only the low 64 bits through the caller output. Current evidence is strongest for a shared transform-plus-project helper that returns projected XY rather than a gameplay-specific projection owner.","objdump + local disassembly + SSE arithmetic inspection"
 0x00581730,57,math_apply_2d_basis_rows_to_vec2_without_translation,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small translation-free sibling to `0x00581690`. The helper multiplies the caller XY pair by the first two 16-byte basis rows at `[basis+0x00]` and `[basis+0x10]`, sums the lanes, and stores only the low 64 bits to the caller output. This is the safest current read for the shared 2D basis-to-vec2 helper rather than another owner-specific math body.","objdump + local disassembly + SSE arithmetic inspection"
 0x00581770,192,math_apply_3d_basis_rows_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 3D SSE transform helper over one caller output buffer, one XYZ input triple, and one basis block. The function multiplies the input X, Y, and Z scalars by the first three 16-byte rows at `[basis+0x00]`, `[basis+0x10]`, and `[basis+0x20]`, sums the lanes, and stores the resulting XYZ triple through the caller output. It uses a separate fast path when the basis pointer is 16-byte aligned, but both legs preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection"
 0x00581830,192,math_apply_3d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Translation-bearing sibling to `0x00581770`. The helper multiplies the caller XYZ triple by the first three 16-byte basis rows, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. As with the sibling, the body has aligned and unaligned load paths but the same observable transform semantics.","objdump + local disassembly + SSE arithmetic inspection"
 0x005818f0,256,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective 3D sibling to `0x00581830`. The helper builds the same 4-lane transformed vector from the caller XYZ triple and basis or translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the resulting XYZ triple through the caller output. Both the aligned and unaligned legs preserve the same transform-plus-project semantics.","objdump + local disassembly + SSE arithmetic inspection"
 0x005819f0,192,math_apply_4d_basis_rows_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 4D SSE transform helper over one caller output buffer, one XYZW input vector, and one 4x4 basis block. The function multiplies each input lane by the corresponding 16-byte row at `[basis+0x00]`, `[basis+0x10]`, `[basis+0x20]`, and `[basis+0x30]`, sums the lanes, and stores the full vec4 result through the caller output. The body preserves the same semantics across aligned and unaligned basis-pointer paths.","objdump + local disassembly + SSE arithmetic inspection"
 0x00581ab0,336,math_apply_4d_basis_rows_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch sibling to `0x005819f0`. The helper takes one 4x4 source row block, applies the same 4-row basis block to each of its four input vec4 rows, and writes the four transformed vec4 rows to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`. This is the safest current read for the shared four-row 4D basis application helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
 0x00581c00,208,math_normalize_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small vec3 normalization helper. The function computes squared length from the caller XYZ triple, compares it against a tiny epsilon table under `0x00dbc000`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result. This is the safest current read for the shared normalize-or-zero vec3 helper rather than a gameplay-specific metric.","objdump + local disassembly + SSE arithmetic inspection"
 0x00581cd0,216,math_normalize_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00581c00`. The helper computes squared length from the caller XYZW tuple, compares it against a nearby epsilon table under `0x00dbc00c`, returns a zero vec4 when the length is too small, and otherwise applies the same Newton-refined reciprocal-square-root scale before writing the normalized XYZW result. This is the safest current read for the shared normalize-or-zero vec4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
 0x00581db0,1008,math_invert_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Primary 4x4 matrix inversion helper. The function derives the cofactor bands for the caller source matrix, accumulates the determinant, optionally stores that determinant through the caller outparam, returns failure when the determinant is zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the inverse to the caller output. This is the safest current read for the shared invert-4x4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
 0x00582070,352,math_apply_4d_basis_rows_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output sibling to `0x00581ab0`. The helper applies one 4-row basis block to each row of a caller 4x4 source block, then repacks the four transformed vec4 rows into a transposed or column-packed output layout before storing them to the caller destination. This is the safest current read for the shared four-row 4D basis application helper with packed transposed output.","objdump + local disassembly + SSE arithmetic inspection"
 0x005821d0,164,math_compute_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4D vector helper over three caller vec4 inputs. The function computes the alternating-sign generalized cross-product style combination of those three vectors and writes the resulting vec4 through the caller output. The final sign flip through mask `0x00627ce0` is part of the same determinant-style construction, so this is the safest current read for the shared 4D cross-product helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection"
 0x00582280,160,math_normalize_vec4_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked vec4 normalization helper. The function computes squared length from the caller XYZW tuple, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon zeroing guard used by `0x00581cd0`.","objdump + local disassembly + SSE arithmetic inspection"
 0x00582320,176,math_sample_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Cubic-basis interpolation helper over one scalar parameter and four caller vec3 control points. The function builds four basis weights from the scalar through the constant tables at `0x00627d10..0x00627d40`, multiplies each control point by its corresponding weight, and writes the blended vec3 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
 0x005823e0,136,math_sample_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
 0x00582470,165,math_sample_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
 0x00582520,181,math_sample_alternate_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Alternate-basis vec3 interpolation sibling. The helper again derives four weights from the caller scalar parameter, but uses the alternate constant tables at `0x00627d50..0x00627d80` before applying those weights to four caller vec3 control points and writing the blended vec3 result. This is the safest current read for the alternate cubic-basis vec3 sampler rather than a subsystem-specific curve owner.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
 0x005825e0,153,math_sample_alternate_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
 0x00582680,133,math_sample_alternate_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
 0x00582710,89,math_blend_vec3_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Two-scalar affine blend helper over three caller vec3 points. The function computes `p0 + s*(p1-p0) + t*(p2-p0)` from the caller origin point, two target points, and scalar weights `s` and `t`, then writes the blended vec3 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
 0x00582770,70,math_blend_vec4_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 points and two scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
 0x005827c0,79,math_blend_vec2_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 points and two scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
 0x00582820,188,math_intersect_plane_vec4_with_vec3_segment,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Geometric intersection helper over one plane vec4 and two caller vec3 endpoints. The function evaluates the plane against both endpoints, derives the affine parameter along the segment between them, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the shared plane-versus-segment intersection helper rather than a subsystem-specific query.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation"
 0x005828e0,203,math_measure_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4x4 determinant helper. The function forms the required cofactor combinations from the caller matrix rows, contracts them against the first row, and returns the resulting determinant scalar through the x87 return path. Current evidence is strongest for a shared determinant helper paired with the nearby inversion body `0x00581db0`.","objdump + local disassembly + SSE arithmetic inspection + matrix-correlation"
 0x005829b0,226,math_build_plane_vec4_from_three_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-point plane builder over caller vec3 inputs. The function forms two edge vectors from the three points, computes their cross product, normalizes that resulting normal, stores the plane normal through output `[+0x00..+0x08]`, and writes the signed plane constant `-dot(normal, p0)` to `[out+0x0c]`. This is the safest current read for the shared plane-from-three-points helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation"
 0x00582aa0,392,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Shared plane-driven 4x4 matrix builder over one caller plane vec4 and one second vec4 input. The function normalizes the plane against the XYZ-length of its first three lanes, computes one diagonal dot term against the second vec4, combines that term with per-plane outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as a projective plane-and-vec4 matrix helper, but not yet tight enough to overname it as one specific API variant.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation + projective-matrix correlation"
 0x00582c30,209,math_build_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion-to-matrix helper. The function normalizes the caller quaternion-like vec4, applies the standard doubled-product combinations through the constant tables at `0x00627e10..0x00627e80`, and writes a 4x4 rotation matrix to the caller output. This is the safest current read for the shared quaternion-to-4x4 rotation-matrix builder rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
 0x00582d10,130,math_multiply_quaternions,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion product helper over two caller vec4 inputs. The function applies the expected sign-mask and shuffle pattern for Hamilton-product-style quaternion composition and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
 0x00582da0,128,math_normalize_quaternion_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked quaternion normalization helper. The function computes the caller quaternion length, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon guard used by the nearby zero-safe normalizers.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
 0x00582e40,109,math_invert_quaternion_by_conjugate_over_squared_length,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion inverse helper over one caller vec4. The function flips the sign of the spatial XYZ lanes, preserves the scalar W lane, divides that conjugate by the squared quaternion length, and writes the resulting vec4 through the caller output. This is the safest current read for the shared quaternion-inverse helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
 0x00582eb0,274,math_build_quaternion_from_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Rotation-matrix-to-quaternion helper over one caller 3x3 row block. The function checks the matrix trace, takes the usual positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected off-diagonal differences and sums before writing the resulting vec4 to the caller output. This is the safest current read for the shared 3x3-rotation-matrix-to-quaternion builder.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation"
 0x00582fd0,191,math_build_quaternion_from_three_euler_angles_via_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-angle quaternion builder over caller scalar inputs. The function packs the three caller angles with one zero lane, scales them by `0.5`, routes that half-angle tuple through packed trig helper `0x0058aa70`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. The current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation + packed-trig correlation"
 0x005830a0,176,math_apply_packed_3x3_basis_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 3D basis helper over one caller vec3 input and one compact 3x3 basis block. The function multiplies the input X, Y, and Z scalars by three packed matrix rows and stores the resulting XYZ triple through the caller output, with aligned and unaligned load paths that preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
 0x00583160,175,math_apply_packed_3x3_basis_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row translation-bearing sibling to `0x005830a0`. The helper multiplies one caller vec3 input by three packed basis rows, adds one packed translation row, and stores the resulting full vec4 through the caller output. Both aligned and unaligned load paths preserve the same transform semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
 0x00583220,243,math_apply_packed_3x3_basis_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective packed-row sibling to `0x00583160`. The helper builds the same transformed 4-lane vector from one caller vec3 input plus packed basis and translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the projected XYZ triple through the caller output. The aligned and unaligned legs preserve the same transform-plus-project behavior.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + projection correlation"
 0x00583320,184,math_apply_packed_4x4_basis_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4D basis helper over one caller vec4 input and one packed 4x4 row block. The function multiplies each input lane by its corresponding packed row, sums the four products, and stores the resulting vec4 through the caller output, again preserving the same behavior across aligned and unaligned load paths.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
 0x005833e0,324,math_apply_packed_4x4_basis_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch packed-row sibling to `0x00583320`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
 0x00583530,196,math_normalize_packed_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec3 normalization sibling to `0x00581c00`. The helper computes squared length from the caller XYZ triple, compares it against the nearby epsilon table under `0x00dbc180`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation"
 0x00583600,216,math_normalize_packed_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec4 normalization sibling to `0x00581cd0`. The helper computes squared length from the caller XYZW tuple, compares it against the nearby epsilon table under `0x00dbc18c`, returns a zero vec4 when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZW result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation"
 0x005836e0,695,math_invert_packed_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4x4 inversion sibling to `0x00581db0`. The helper expands the packed 4x4 source rows, derives the required cofactor bands and determinant scalar, optionally stores that determinant through the caller outparam, returns failure when the determinant collapses to zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the packed inverse to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-inversion correlation"
 0x005839a0,342,math_apply_packed_4x4_basis_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output batch sibling to `0x005833e0`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block, then repacks the transformed lanes into a transposed or column-packed output layout before storing the four result rows.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + transposed-output correlation"
 0x00583b00,164,math_compute_packed_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product style combination through shuffle, multiply, and subtract bands, applies the final sign-mask adjustment under `0x00627ee0`, and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + 4d-cross-product correlation"
 0x00583cc0,201,math_measure_packed_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row determinant sibling to `0x005828e0`. The helper expands the packed 4x4 row block, forms the same cofactor combinations as the wider determinant strip, contracts them against the first packed row, and returns the resulting determinant scalar through the x87 return path.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-determinant correlation"
 0x00583bb0,121,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_a,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Single-angle packed 4x4 rotation-matrix helper above interleaved trig worker `0x0058ac60`. The function broadcasts one caller angle, derives one interleaved sine/cosine tuple through `0x0058ac60`, combines that tuple with fixed identity-row constants, and writes one packed 4x4 axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation"
 0x00583c30,128,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_b,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Sibling single-angle packed 4x4 rotation-matrix helper above `0x0058ac60`. Like `0x00583bb0`, it broadcasts one caller angle, derives one interleaved sine/cosine tuple through the shared trig worker, combines that tuple with fixed identity-row constants in a different lane arrangement, and writes one second packed 4x4 axial rotation-matrix variant to the caller output. The safest current read is a second fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation"
 0x00583d90,226,math_build_plane_vec4_from_three_packed_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row three-point plane builder sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross product, normalizes that resulting normal, stores the plane normal through the caller output, and writes the signed plane constant to `[out+0x0c]`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation"
 0x00583e80,392,math_build_packed_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes, computes one diagonal dot term against the second vec4 input, combines that term with per-plane outer-product bands, and writes the resulting packed 4x4 matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation + projective-matrix correlation"
 0x00584010,209,math_build_packed_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row quaternion-to-matrix sibling to `0x00582c30`. The helper normalizes the caller quaternion-like vec4, applies the same doubled-product combinations through the packed constant tables at `0x00627f70..0x00627fe0`, and writes a packed 4x4 rotation matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation"
 0x005840f0,274,math_build_quaternion_from_packed_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Packed-row rotation-matrix-to-quaternion sibling to `0x00582eb0`. The helper checks the packed 3x3 trace, takes the positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected packed off-diagonal differences and sums before writing the resulting vec4 to the caller output.","objdump + local disassembly + x87 arithmetic inspection + packed-matrix correlation + quaternion correlation"
 0x00584210,191,math_build_quaternion_from_three_euler_angles_via_packed_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582fd0`. The helper packs three caller angles with one zero lane, scales them by `0.5`, routes that tuple through packed trig helper `0x0058ad50`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation + packed-trig correlation"
 0x005842e0,151,math_multiply_quaternions_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582d10`. The helper loads two caller quaternion-like vec4 inputs, applies the same sign-mask and pairwise multiply-add or subtract pattern used by the SSE quaternion-product strip, and writes the resulting vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation"
 0x00584379,90,math_normalize_vec4_or_zero_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 normalize-or-zero helper. The function computes squared length from the caller vec4, compares it against the nearby epsilon constant at `0x005df610`, and when the length is large enough scales the full vec4 by one reciprocal-square-root refinement before writing it to the caller output; smaller inputs collapse to zero through the same mask path.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation"
 0x005843d6,179,math_normalize_vec3_with_optional_length_outparam_and_default_axis_fallback_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization helper with two optional outparams. The function computes the squared XYZ length from the caller source block, optionally writes the normalized vec3 through one caller outparam, optionally writes a derived scalar magnitude through another, and when the input collapses below the epsilon threshold falls back to a fixed default-axis vector plus zero magnitude. This is the safest current read for the shared vec3 normalize-with-length helper without overclaiming the exact downstream semantic of the scalar outparam.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation"
 0x00584489,1073,math_build_quaternion_from_3x3_rotation_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582eb0`. The helper inspects the same 3x3 rotation-matrix trace and dominant diagonal cases, chooses one of the expected reconstruction branches, and writes the resulting quaternion vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix-correlation"
 0x005848ba,195,math_build_quaternion_from_three_euler_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582fd0`. The helper halves the three caller Euler angles, routes those half angles through scalar trig worker `0x0058b660`, and combines the resulting sine and cosine values into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + trig correlation"
 0x0058497f,106,math_build_quaternion_from_axis_vec3_and_angle_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle-to-quaternion helper. The function first normalizes one caller axis vec3 through `0x005896d2`, halves the caller angle, routes that half-angle through trig worker `0x0058b660`, scales the normalized axis by the sine-like lane, and writes the resulting quaternion vec4 with the cosine-like scalar lane in `W`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation"
 0x005849eb,309,math_interpolate_quaternion_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion slerp helper over two caller quaternion-like vec4 inputs and one scalar interpolation factor. The function measures the 4D dot product, takes the expected small-angle fast path, otherwise derives one angular term through `0x0058af80` and two sine-weight terms through `0x0058b780`, then writes the weighted combination through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + slerp correlation"
 0x00584b22,139,math_blend_three_quaternion_controls_by_two_parameter_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Two-parameter nested quaternion-slerp helper. The function first forms `u+v`, performs two intermediate slerps from one shared control quaternion to two neighboring controls through `0x005849eb`, derives relative blend weight `v/(u+v)`, and then slerps between those intermediates into the caller output. The safest current read is a barycentric or triangular nested-slerp helper rather than a tighter named spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation"
 0x00584baf,144,math_blend_three_quaternion_controls_by_quadratic_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Quadratic nested quaternion-slerp helper. The function first builds two intermediate slerps at the same parameter `t` through `0x005849eb`, derives the classic quadratic blend scalar `2*t*(1-t)`, and then slerps between those intermediates into the caller output. This is the safest current read for a three-control quaternion curve helper without overclaiming the exact higher-level spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation"
 0x00584c41,98,math_invert_quaternion_by_conjugate_over_squared_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582e40`. The helper conjugates the caller quaternion by negating `XYZ` while preserving `W`, divides that conjugate by the squared quaternion length, and writes the resulting inverse quaternion through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation"
 0x00584ca5,165,math_build_axis_angle_vec4_from_quaternion_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-axis-angle extractor. The function reads the scalar `W` lane, derives one angular term through `0x0058b080` and `0x0058b780`, conditionally rescales the `XYZ` lanes by the reciprocal sine factor when that angle is not degenerate, and writes the resulting axis-angle-style vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation"
 0x00584d4c,163,math_build_quaternion_from_scaled_axis_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scaled-axis-to-quaternion helper. The function measures the length of the caller vec3, routes that magnitude through trig worker `0x0058b660`, conditionally rescales the `XYZ` lanes by the reciprocal magnitude, and writes a quaternion-style vec4 whose `XYZ` lanes hold the scaled axis contribution and whose `W` lane receives the cosine-like scalar result. This is the safest current read for a shared scaled-axis-to-quaternion helper without overclaiming the exact upstream representation.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation"
 0x00584df1,396,math_build_two_inner_quaternion_spline_controls_from_four_keys_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow quaternion spline-control builder over four caller key quaternions. The helper first aligns neighboring keys onto the same hemisphere by comparing sum-vs-difference norms, then around each interior key converts the two neighboring relative quaternions through the already-grounded inverse, axis-angle, and scaled-axis helpers, averages those tangent-like terms, exponentiates back into a quaternion, and multiplies by the interior key to write two inner control quaternions through the caller output buffer. The safest current read is a four-key inner-control builder for quaternion spline interpolation rather than a tighter spline-family label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + spline-control correlation"
 0x0058584a,559,math_multiply_4x4_matrices_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller matrix from the split qword row layout used by the neighboring constructors into temporary contiguous rows on the stack, then multiplies a second caller 4x4 matrix by those repacked rows and writes the product through the caller output buffer. The safest current read is a non-alias-staging sibling of the later packed 4x4 multiply family rather than a subsystem-specific API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation"
 0x00585a7c,207,math_compute_determinant_of_upper_3x3_basis_from_split_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scalar determinant helper over one split-layout 4x4 matrix. The function forms the expected 3x3 cofactor bands from the upper basis rows, completes the final cofactor expansion against the remaining basis row, accumulates the result to one scalar lane, and returns that determinant through `st0`. The safest current read is a determinant-of-basis helper rather than a tighter affine-class predicate.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + determinant correlation"
 0x00585b4b,80,math_build_4x4_translation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow row-major translation-matrix constructor. The helper seeds the three identity rows from `0x005df668` and `0x005df660`, writes the three caller translation scalars into the trailing homogeneous row, and returns the finished 4x4 matrix through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
 0x00585b9b,235,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes through `0x0058a988`, computes one diagonal dot term against the second vec4 input, combines that dot term with the expected negated outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as the MMX plane-driven projective matrix helper without overclaiming one specific API variant.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + geometry correlation + projective-matrix correlation"
 0x00585c86,220,math_build_4x4_reflection_matrix_from_plane_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane-reflection matrix helper. The function normalizes the caller plane vec4 through `0x0058a988`, forms the expected `1 - 2*n*n^T` diagonal terms plus the paired `-2*n_i*n_j` off-diagonal bands, and writes the resulting homogeneous 4x4 reflection-style matrix to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + plane-reflection correlation"
 0x00585d62,97,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through scalar trig worker `0x0058b660`, seeds the fixed identity rows from constants `0x005df668` and `0x005df660`, and writes one axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
 0x00585dc5,94,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. Like `0x00585d62`, it routes one caller angle through `0x0058b660`, combines the resulting sine or cosine lanes with the same identity-row constants in a different layout, and writes one second axial rotation-matrix variant to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
 0x00585e23,87,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_c,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Third MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through `0x0058b660`, seeds the remaining fixed identity rows, and writes one third axial rotation-matrix variant to the caller output. The safest current read is a third fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
 0x00585e7c,67,math_build_4x4_scale_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow diagonal scale-matrix constructor. The helper writes the three caller scalar scale lanes onto the homogeneous 4x4 diagonal, clears the off-diagonal lanes, and seeds the trailing homogeneous `1.0f` row or column from `0x005df660`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + scale correlation"
 0x00585ec3,110,math_transpose_or_repack_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Small MMX or 3DNow 4x4 matrix repack helper. It reads the caller matrix in one split qword layout, unpacks the low and high dword pairs across the four rows, and writes the reordered 4x4 matrix to the caller output. The safest current read is a transpose or row-column repack helper rather than a higher-level owner.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + repack correlation"
 0x00585f32,57,math_build_identity_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"MMX or 3DNow identity-matrix constructor. The helper seeds the diagonal with `1.0f` from `0x005df590`, clears the off-diagonal lanes, and writes the resulting homogeneous 4x4 identity matrix to the caller output.","objdump + local disassembly + matrix correlation + identity correlation"
 0x00585f6b,199,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. The function doubles the caller quaternion lanes, forms the expected pairwise product bands, combines them with the fixed `1 - 2*...` diagonal terms from `0x005df5a0`, and writes one 4x4 rotation-matrix layout to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation"
 0x0058603d,181,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. It uses the same doubled-lane and pairwise-product construction as `0x00585f6b`, but writes the resulting rotation terms in a second lane layout to the caller output. The safest current read is a second quaternion-to-matrix variant rather than a tighter row- or column-major claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation"
 0x005860f2,1655,math_build_4x4_transform_from_optional_translation_base_rotation_pivoted_post_rotation_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional base rotation quaternion, one optional base translation vec3, one optional pivot vec3, one optional post-rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when no base translation is present, otherwise seeds a pure translation matrix or translation-plus-base-rotation matrix, then optionally applies a second quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the post-rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a shared affine-transform builder rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation"
 0x0058728a,421,math_build_4x4_rotation_matrix_from_three_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection,2,"MMX or 3DNow three-angle 4x4 rotation-matrix builder. The helper halves the three caller angle scalars through the `0.5f` pair at `0x005df630`, routes those half-angles through trig worker `0x0058b660`, combines the resulting sine or cosine lanes through the same doubled-product and `1 - 2*...` bands used by the nearby quaternion-to-matrix helpers, and writes one 4x4 rotation-matrix layout to the caller output. The safest current read is a three-angle rotation constructor via half-angle trig rather than a tighter Euler-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection + trig correlation + quaternion-formula correlation + matrix correlation"
 0x0058742f,308,math_build_4x4_transform_from_uniform_scale_optional_pivoted_rotation_quaternion_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one uniform scalar scale, one optional pivot vec3, one optional rotation quaternion, and one optional trailing translation delta vec3. The helper first seeds a diagonal scale matrix from the caller scalar plus the fixed homogeneous `1.0f` lane at `0x005df580`, then optionally applies one quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection + matrix correlation + scale correlation + quaternion correlation + pivot-rotation correlation"
 0x00587963,281,math_build_4x4_rotation_matrix_from_axis_vec3_and_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle 4x4 rotation-matrix helper. The function first normalizes one caller axis vec3 through `0x005896d2`, routes the caller angle through trig worker `0x0058b660`, forms the expected Rodrigues-style `axis*axis*(1-c)`, `axis*s`, and diagonal `c + axis*axis*(1-c)` bands, and writes the resulting 4x4 rotation matrix through the caller output buffer.","objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection + axis-angle correlation + trig correlation + matrix correlation"
 0x00587a7c,4436,math_build_4x4_transform_from_optional_translation_two_optional_pivoted_rotation_quaternions_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional first pivot vec3, one optional first rotation quaternion, one optional base translation vec3, one optional second pivot vec3, one optional second rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when the base translation is absent, otherwise seeds a pure translation matrix or translation-plus-first-rotation matrix, optionally applies that first rotation about the first caller pivot, then optionally applies a second quaternion rotation about the second caller pivot, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a broader shared affine-transform builder with up to two pivoted quaternion stages rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation"
 0x00588eb2,1013,math_multiply_4x4_matrices_with_alias_safe_rhs_staging_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller source matrix into a temporary contiguous row layout, multiplies those four rows by the second caller 4x4 matrix, and writes the product through the caller output buffer. When the destination aliases the right-hand input matrix it stages the product in temporary storage and copies it back afterward, so the safest current read is an alias-safe packed 4x4 multiply helper rather than a narrower subsystem API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation + alias-staging correlation"
 0x00588bd0,738,math_invert_4x4_matrix_variant_b_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Alternate MMX or 3DNow 4x4 matrix inverse helper. Like `0x005892aa`, the function expands the caller matrix into cofactor-like bands, optionally writes one determinant scalar through a caller out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the reciprocal-determinant-scaled inverse matrix through the caller output buffer. The safest current read is a second inverse helper variant rather than a tighter matrix-class claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation"
 0x005892aa,820,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix inverse helper. The function expands the caller matrix into the expected cofactor bands, accumulates the determinant into one optional caller scalar out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the adjugate scaled by the reciprocal determinant through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation"
 0x005895de,28,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow_wrapper,support,cdecl,inferred,objdump + local disassembly,2,"Tiny FEMMS wrapper around `0x005892aa`. It forwards the three caller parameters unchanged to the broader MMX 4x4 inverse helper and then returns the caller output pointer.","objdump + local disassembly + wrapper correlation"
 0x005895fa,112,math_apply_3d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581830`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
 0x0058966b,103,math_apply_3d_basis_rows_to_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581770`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller basis block, sums the three product bands, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
 0x005896d2,95,math_normalize_vec3_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization sibling to `0x00581c00`. The function computes squared length from the caller XYZ triple, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vector when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XYZ result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
 0x00589731,113,math_blend_vec3_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec3 control points and two caller scalar weights, then writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
 0x005897a2,213,math_sample_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582320`. The helper derives four cubic-basis weights from the caller scalar parameter through the same local constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
 0x00589876,234,math_sample_alternate_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582520`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
 0x00589960,140,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005818f0`. The helper builds the same translated four-lane transform result from one caller XYZ triple and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation"
 0x005899eb,456,math_apply_4d_basis_rows_to_four_vec4_rows_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581ab0`. The helper applies one caller 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed vec4 rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
 0x00589bb2,5,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow_thunk,support,cdecl,inferred,objdump + local disassembly,2,"Jump thunk into `0x00589960`, the MMX or 3DNow projective vec3 transform helper.","objdump + local disassembly + wrapper correlation"
 0x00589bb7,392,math_apply_vec3_through_optional_4x4_chain_and_optional_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Broader MMX or 3DNow projective transform owner over one caller vec3, up to three optional 4x4 matrix inputs, and one optional integer viewport-style range block. The helper selects identity, one matrix, or the ordered composition of two or three matrices through `0x005899eb`, applies the resulting chain through `0x00589960`, and when the optional range block is present remaps the projected normalized result into that caller integer range before returning.","objdump + local disassembly + matrix correlation + projective correlation + viewport-range correlation"
 0x00589d3f,518,math_apply_vec3_through_optional_inverse_4x4_chain_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Inverse-side sibling to `0x00589bb7`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, inverts the chosen chain through `0x005892aa`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the inverse chain through `0x00589960`. The safest current read is an MMX unproject or inverse-projective helper without overclaiming one subsystem-specific API.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
 0x00589f67,303,math_apply_vec3_through_optional_inverse_4x4_chain_variant_b_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Adjacent inverse-side sibling to `0x00589d3f`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, routes the chosen chain through inverse helper variant `0x00588bd0`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the resulting inverse chain through `0x00589960`. The safest current read is a second MMX unproject or inverse-projective helper variant rather than a tighter API claim.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
 0x0058a0b8,79,math_apply_2d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581690`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
 0x0058a10d,55,math_apply_2d_basis_rows_to_vec2_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581730`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller basis block, sums the two product bands, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
 0x0058a146,100,math_apply_2d_basis_rows_translation_and_project_vec2_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005816d0`. The helper builds the same translated four-lane transform result from one caller XY pair and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation"
 0x0058a1aa,153,math_sample_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005823e0`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
 0x0058a242,71,math_blend_vec2_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005827c0`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 control points and two caller scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
 0x0058a28b,65,math_normalize_vec2_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 normalization sibling to `0x00582320`'s lower-dimensional normalize helpers. The function computes squared length from the caller XY pair, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vec2 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XY result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
 0x0058a2ce,172,math_sample_alternate_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582680`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
 0x0058a379,130,math_apply_4d_basis_rows_to_vec4_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow duplicate-layout sibling to `0x0058a9ec`. The helper broadcasts the caller XYZW lanes, multiplies those broadcasts by the four rows of one caller 4x4 basis block, sums the four product bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
 0x0058a3fb,95,math_normalize_vec4_or_zero_below_epsilon_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow four-lane normalization sibling to `0x00584379`. The function computes squared length across all four caller lanes, compares that magnitude against the nearby epsilon constant at `0x005df610`, returns a zero vec4 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized vec4 result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
 0x0058a45a,306,math_compute_4d_cross_product_from_three_vec4_inputs_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product-style combination through paired multiply-subtract bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + 4d-cross-product correlation + caller correlation"
 0x0058a58c,113,math_blend_vec4_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to the earlier affine blend strip. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 control points and two caller scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
 0x0058a5fd,200,math_sample_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x00582470`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
 0x0058a6c5,223,math_sample_alternate_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x005825e0`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
 0x0058a7a3,65,math_build_plane_vec4_from_normal_vec3_and_point_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane builder over one caller normal vec3 and one point on that plane. The helper copies the incoming normal into the output `XYZ` lanes, computes the signed plane constant as the negated dot product of that normal with the caller point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation"
 0x0058a7e6,229,math_build_plane_vec4_from_three_vec3_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross-product-style normal, normalizes that resulting plane normal, derives the signed plane constant from one source point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation"
 0x0058a8ca,190,math_intersect_origin_plane_normal_vec3_with_vec3_segment_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow geometric intersection helper over one plane-normal vec3 and two caller segment endpoints. The function derives the numerator and denominator for the plane-through-origin affine parameter, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the MMX origin-plane-versus-segment sibling rather than a subsystem-specific query.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + segment-intersection correlation"
 0x0058a988,98,math_normalize_vec4_by_xyz_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow normalization helper over one caller vec4-like input. The function measures length from the first three lanes only, compares that squared XYZ length against the nearby epsilon constant at `0x005df610`, and when large enough scales the full four-lane payload by one reciprocal-square-root refinement before writing it through the caller output; smaller inputs collapse to zero through the same mask path. Current grounded callers are the broader matrix builders `0x00585b9b` and `0x00585c86`, so this is the safest current read for the shared normalize-by-XYZ-length helper rather than a full XYZW normalizer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
 0x0058a9ec,124,math_apply_4d_basis_rows_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005819f0`. The helper broadcasts each input XYZW lane, multiplies those broadcasts by the corresponding four rows of one caller 4x4 basis block, sums the four product bands, and stores the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
 0x0058ac60,229,math_compute_interleaved_packed_sine_cosine_lanes_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles. The function performs sign extraction, range reduction, quadrant selection, and polynomial evaluation through the constant tables at `0x00628320..0x006283f0`, then returns one interleaved sine/cosine-style lane tuple in `xmm0`. Current grounded callers are the single-angle packed axial rotation-matrix builders `0x00583bb0` and `0x00583c30`, so the safest current read is an interleaved packed sine/cosine helper rather than a generic scalar polynomial.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
 0x0058ad50,329,math_compute_packed_sine_and_cosine_vectors_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles and two caller output buffers. The function performs sign extraction, range reduction, quadrant selection, and dual polynomial evaluation through the constant tables at `0x00628400..0x00628520`, then writes one packed pair of sine/cosine result vectors through the two caller outputs. Current grounded caller is `0x00584210`, the packed Euler-angle-to-quaternion helper, so the safest current read is a packed sin/cos vector generator rather than a subsystem-specific math body.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
 0x0058af80,244,math_compute_scalar_atan2_style_angle_from_y_and_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar angle helper over two caller float lanes. The function compares magnitudes, forms one min-over-max style ratio, evaluates a polynomial over that ratio, and then restores quadrant and sign through the constant strip at `0x006285d8..0x00628638`. Current grounded caller is quaternion slerp helper `0x005849eb`, so the safest current read is a scalar `atan2`-style angle worker rather than a narrower subsystem label.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
 0x0058b080,247,math_compute_scalar_arccos_style_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The function clamps or folds the incoming magnitude against the nearby constant strip at `0x006285d8..0x00628638`, evaluates a reciprocal-square-root-assisted polynomial, and restores the correct signed or reflected branch before returning one angle-like scalar in `mm0`. Current grounded caller is quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar arccos-style angle worker rather than a tighter half-angle claim.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
 0x0058b180,226,math_compute_scalar_arccos_style_angle_variant_b_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Adjacent MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The body shares the same reciprocal-square-root-assisted polynomial strip as `0x0058b080`, but finishes through a different reflected or complemented angle reconstruction path before returning one scalar in `mm0`. The safest current read is a second arccos-style angle variant rather than a tighter named inverse-trig identity.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
 0x0058b280,233,math_compute_scalar_natural_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar logarithm helper over one caller float lane. The function decomposes the input into exponent and mantissa bands, evaluates a polynomial over the reduced mantissa through the constant strip at `0x00628648..0x0062866c`, folds back the exponent contribution, and returns one natural-log-style scalar in `mm0`. The nearby wrapper `0x0058b380` scales this result by `0.434294...`, which is the strongest current evidence for the natural-log interpretation.","objdump + local disassembly + polynomial-approximation inspection + logarithm correlation"
 0x0058b380,17,math_compute_scalar_base10_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny wrapper over `0x0058b280`. The helper calls the natural-log worker and then scales the result by the float constant at `0x0062868c`, `0.434294...`, before returning; the safest current read is a shared base-10 logarithm helper.","objdump + local disassembly + constant inspection + logarithm correlation"
 0x0058b3a0,224,math_compute_scalar_exponential_e_to_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Shared MMX or 3DNow scalar exponential helper over one caller float lane. The function range-reduces the input through the nearby `log2(e)` and split-`ln(2)` constants at `0x0062863c..0x0062864c`, evaluates the reduced polynomial strip, reconstructs the exponent field by shifting the derived integer part into float-exponent position, and returns one `e^x`-style scalar in `mm0` with the expected overflow and underflow clamps. The safest current read is a scalar natural-exponential worker rather than a subsystem-specific transform helper.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + exponential correlation"
 0x0058b480,24,math_compute_scalar_square_root_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Tiny MMX or 3DNow square-root helper over one caller scalar lane. The body seeds one reciprocal-square-root estimate through `pfrsqrt`, refines it with `pfrsqit1` and `pfrcpit2`, multiplies that reciprocal-square-root by the original input, and returns the resulting square-root-style scalar in `mm0`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + square-root correlation"
 0x0058b4a0,8,math_clear_scalar_float_sign_bit_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar absolute-value helper. The function clears the sign bit of the caller float lane with the mask at `0x00628578` and returns the resulting non-negative scalar in `mm0`.","objdump + local disassembly + constant inspection + absolute-value correlation"
 0x0058b4c0,50,math_round_scalar_upward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a positive fractional remainder is still present, and adds one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `ceil`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation"
 0x0058b500,37,math_round_scalar_downward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a negative fractional remainder is still present, and subtracts one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `floor`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation"
 0x0058b540,64,math_split_scalar_float_into_normalized_mantissa_and_exponent_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar decomposition helper over one caller float lane. The function masks off sign and exponent bits, rebuilds a normalized mantissa lane with fixed exponent bits through the constants at `0x00628540..0x00628588`, derives the unbiased exponent as an integer-float lane, and returns the pair packed in `mm0`. The safest current read is a `frexp`-style mantissa or exponent splitter rather than a tighter ABI claim.","objdump + local disassembly + constant inspection + exponent-mantissa correlation"
 0x0058b580,94,math_scale_scalar_float_by_integral_power_of_two_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar scaling helper over one caller float lane and one caller integer-like exponent lane. The function extracts the current exponent field, adds the requested exponent delta, reconstructs the float when the result stays in range, and otherwise returns the expected underflow or signed-overflow infinities through the mask strip at `0x00628568..0x00628580`. The safest current read is an `ldexp`-style scalar multiply-by-`2^n` helper.","objdump + local disassembly + constant inspection + exponent-mantissa correlation + scaling correlation"
 0x0058b5de,18,math_split_scalar_float_into_fractional_and_integral_float_lanes_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar split helper over one caller float lane. The body truncates the input to integer with `pf2id` or `pi2fd`, subtracts that integral part from the original value, and returns the fractional and integral float lanes packed together in `mm0`. The safest current read is a compact `modf`-style split helper rather than a dedicated subsystem formatter.","objdump + local disassembly + split correlation"
 0x0058b600,72,math_compute_scalar_fmod_style_remainder_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + arithmetic inspection,2,"Shared MMX or 3DNow scalar remainder helper over one caller dividend lane and one caller divisor lane. When the divisor is non-zero it multiplies the dividend by the reciprocal divisor, truncates that quotient toward zero, keeps only the fractional remainder, rescales by the divisor, and returns the resulting same-sign remainder in `mm0`; a zero divisor falls back to the constant at `0x00628578`. The safest current read is an `fmod`-style remainder helper rather than a tighter IEEE remainder claim.","objdump + local disassembly + arithmetic inspection + remainder correlation"
 0x0058b660,280,math_compute_scalar_cosine_and_sine_pair_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The function performs sign extraction, range reduction, quadrant handling, and polynomial evaluation through the constant strip at `0x00628558..0x00628694`, then returns one packed cosine/sine-style lane pair in `mm0`. Current grounded callers are the MMX Euler-angle, axis-angle, scaled-axis, and single-angle rotation-matrix helpers, so the safest current read is a scalar cos/sin pair worker rather than a subsystem-specific helper.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
 0x0058b780,280,math_compute_scalar_sine_lane_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The body matches `0x0058b660` through the same range-reduction and polynomial path, but duplicates the sine-like result lane before returning. Current grounded callers are quaternion slerp helper `0x005849eb` and quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar sine worker with duplicated output lane.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
 0x0058b9e0,408,math_compute_scalar_power_x_to_y_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Broader MMX or 3DNow scalar power helper over one caller base lane and one caller exponent lane. The function preserves the sign of negative bases only when the exponent truncates to an integer with odd parity, derives the logarithm-like core from the absolute base through the same exponent or mantissa constants used by the adjacent scalar log worker, multiplies that core by the exponent, and then rebuilds the final result through the same exponential-style polynomial and exponent-field reconstruction family used by `0x0058b3a0`. The safest current read is a shared `pow(x, y)`-style helper rather than a narrower transform-specific claim.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + power correlation"
 0x00571016,26,refcounted_object_vtable_0x5def30_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for object family `0x005def30`. The helper re-enters destructor `0x0057ad20`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x0057aedb`.","objdump + local disassembly + object-family correlation + refcount correlation"
 0x00571032,26,refcounted_object_vtable_0x5def5c_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for sibling object family `0x005def5c`. The helper re-enters destructor `0x0057af0e`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + object-family correlation + refcount correlation"
 0x0054eb10,376,shell_input_handle_window_command_and_toggle_messages,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one shell window-command or toggle-style input message into the shell-input ring. The helper tracks the last packed command or coordinate tuple under `[this+0xa94/+0xa98/+0xa9c]`, iterates eight local branch families, toggles selected state bits in `[this+0xa8c]`, synthesizes 12-dword records with types such as `1`, `2`, `5`, `6`, `7`, `8`, `9`, `10`, and `11`, and enqueues those records through `0x0054e880`. Current grounded caller is the `WM_COMMAND` branch in `shell_controller_window_message_dispatch` `0x0054e3a0`, so this is the safest current read for the shell-input command or toggle message owner rather than a generic control callback.","objdump + caller inspection + local disassembly + event-ring correlation + command-message correlation"
 0x0054ee50,544,shell_input_handle_window_mouse_message_and_enqueue_events,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Primary shell mouse-message handler for the `0x0200..0x0208` window-message family. The helper first deduplicates repeated `WM_MOUSEMOVE` coordinates against globals `0x0062545c/0x00625460`, then routes the live message through the shared shell-input command or toggle worker `0x0054eb10` and the surrounding pointer-state branches. Current evidence grounds this as the mouse-message ingress owner beneath `shell_controller_window_message_dispatch` `0x0054e3a0`, with local state updates flowing into the event-ring helpers `0x0054e880`, `0x0054e9c0`, and `0x0054ea20`.","objdump + caller inspection + local disassembly + mouse-message correlation + event-ring correlation"
 0x0054f290,480,shell_input_apply_window_key_transition,shell,thiscall,inferred,objdump + analysis-context,4,Normalizes one `WM_KEYDOWN` or `WM_KEYUP` transition for the shell input object at 0x006d4018. The helper samples `GetKeyboardState` optionally derives an ASCII byte through `ToAscii` updates the 256-byte per-key table starting at [this+0x100] and maps selected keyboard scan codes into packed modifier flags at [this+0xa8c]: 0x1d sets or clears bit 0x4 Control 0x2a sets or clears bit 0x2 Left Shift 0x36 sets or clears bit 0x1 Right Shift and 0x38 sets or clears bit 0x20 Alt. It then forwards the synthesized event record through 0x0054e9c0 for later shell consumers. The shell controller window dispatcher at 0x0054e3a0 is the grounded caller.,objdump + analysis-context + import table + callsite inspection
--- a/docs/atlas/company-and-ledger.md
+++ b/docs/atlas/company-and-ledger.md
@ -2,7 +2,7 @@
 Primary atlas sources:
- [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md)
+- [event-editors-companydetail-and-loadscreen.md](/home/jan/projects/rrt/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md)
 This view isolates the company-side shell panes, linked-transit company maintenance, city-connection
 news, and annual finance-policy thresholds.
--- a/docs/atlas/editor-and-site-service.md
+++ b/docs/atlas/editor-and-site-service.md
@ -2,8 +2,8 @@
 Primary atlas sources:
- [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md)
+- [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md)
- [input-save-load-and-simulation.md#station-detail-overlay](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md#station-detail-overlay)
+- [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md)
 This view isolates the map-editor page families, candidate and site-service runtime chain, and the
 station-detail or station-list read-side consumers.
--- a/docs/atlas/route-entry-and-trackers.md
+++ b/docs/atlas/route-entry-and-trackers.md
@ -2,7 +2,7 @@
 Primary atlas sources:
- [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md)
+- [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md)
 This note isolates the lower route-entry, linked-site, route-link, and auxiliary tracker families
 that are easy to lose inside the broader runtime section.
--- a/docs/atlas/runtime-and-world-tools.md
+++ b/docs/atlas/runtime-and-world-tools.md
@ -2,7 +2,7 @@
 Primary atlas sources:
- [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md)
+- [runtime-roots-camera-and-support-families.md](/home/jan/projects/rrt/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md)
 This view keeps together the runtime-side shell input path, world-view tool surfaces, world bring-up
 pipeline, and the large shell-window families that hang off the recurring frame owner.
--- a/docs/control-loop-atlas.md
+++ b/docs/control-loop-atlas.md
@ -54,6 +54,13 @@ Detailed section:
 Detailed section:
 [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md)
 Subsections:
 - [runtime-roots-camera-and-support-families.md](/home/jan/projects/rrt/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md)
 - [post-load-generation-paintterrain-and-save-load-restore.md](/home/jan/projects/rrt/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md)
 - [event-editors-companydetail-and-loadscreen.md](/home/jan/projects/rrt/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md)
 - [editor-breadth.md](/home/jan/projects/rrt/docs/control-loop-atlas/editor-breadth.md)
 - [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md)
 ## Next Mapping Passes
 Detailed section:
--- a/docs/control-loop-atlas/README.md
+++ b/docs/control-loop-atlas/README.md
@ -15,4 +15,12 @@ section files when adding or reviewing grounded narrative content.
 - [map-and-scenario-content-load.md](/home/jan/projects/rrt/docs/control-loop-atlas/map-and-scenario-content-load.md)
 - [multiplayer-session-and-transport-flow.md](/home/jan/projects/rrt/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md)
 - [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md)
 Input/Save/Load subsections:
 - [runtime-roots-camera-and-support-families.md](/home/jan/projects/rrt/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md)
 - [post-load-generation-paintterrain-and-save-load-restore.md](/home/jan/projects/rrt/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md)
 - [event-editors-companydetail-and-loadscreen.md](/home/jan/projects/rrt/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md)
 - [editor-breadth.md](/home/jan/projects/rrt/docs/control-loop-atlas/editor-breadth.md)
 - [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md)
 - [next-mapping-passes.md](/home/jan/projects/rrt/docs/control-loop-atlas/next-mapping-passes.md)
--- a/docs/control-loop-atlas/editor-breadth.md
+++ b/docs/control-loop-atlas/editor-breadth.md
@ -0,0 +1,912 @@
 # Input, Save/Load, and Simulation: Editor Breadth
 ### Editor Breadth
 The broader map-editor page owner is now bounded through
  `map_editor_panel_select_active_section` `0x004ce070` and
  `map_editor_panel_dispatch_active_section_message` `0x004cf700`, which switch among the grounded
  setup pages, `Cities/Regions`, `Territories`, the `Players` and `Player Pool` setup slices, the
  now-grounded `Building Density` page, the locomotives-available and industry-availability pages,
  the economic and special-condition pages, the `Port/Warehouse Cargos` page, and the later report
  pages. The mid-editor ownership is materially clearer now too: the chairman-slot editor is the
  `Players` page, the available-chairman editor is the `Player Pool` page, and the former unnamed
  dual tri-state page now lines up with localized page text `997` `Building Density` plus help text
  `1017` and the direct field captions `1642` `Starting Building Density Level:` and `1644`
  `Building Density Growth:`. Both controls are now bounded as stored ordinal bytes `0/1/2` rather
  than loose labels: the first three-choice control is the map-wide starting-density selector, with
  its default middle state `1` matching the documented `100%` baseline from `1643`; the second is
  the paired overall growth selector whose effects later appear in the city-growth side of the
  simulation. `map_editor_city_region_panel_construct` and
  `map_editor_city_region_panel_handle_message` own the city-or-region editing lane with rename and
  copy-industry-data flows. That copy side is tighter now too: the handler first enters
  `0x00420e00`, which rebuilds the selected region's profile collection `[region+0x37f]`, clones
  the source region's live label-weight entries when a source region is present, and otherwise
  reseeds a fixed default weight set through repeated `0x004206b0` calls. The no-source companion
  `0x00420ed0` now makes that split explicit: it rebuilds the same subcollection and then picks one
  of two fixed default label-weight sets based on region class dword `[region+0x23e]`, using one
  all-`0.2f` family for nonzero-class regions and one class-`0` family that starts with `0.3f`
  before continuing with repeated `0.2f` entries. The lower mutator
  `0x004206b0` then linearly scans the selected region subcollection by profile label, creates a
  new profile only when the copied weight is positive, removes an existing profile when the copied
  weight is non-positive, updates `[entry+0x1e]` otherwise, and refreshes the region's derived
  availability-summary bytes `[region+0x2f6/+0x2fa/+0x2fe]` through `0x00420410`; `map_editor_territory_panel_construct` and
  the adjacent no-source companion `0x00420ed0` is tighter too: it rebuilds the same collection
  root `[region+0x37f]` but then seeds one of two fixed default profile-label sets directly through
  repeated `0x004206b0` calls, splitting by region class dword `[region+0x23e]`. Nonzero-class
  regions take one all-`0.2f` default set, while class-0 regions take a different set that starts
  with one `0.3f` weight before continuing with repeated `0.2f` entries. That makes `0x420ed0`
  the true class-split default-profile companion to the source-cloning helper at `0x420e00`,
  rather than just more of the same editor copy path. Two neighboring collection queries are tight
  enough now too. `0x00421d20` counts how many live regions have at least one profile row in
  `[region+0x37f]` whose label matches the candidate-name string for one caller-supplied candidate
  id; `0x00421e30` resolves the Nth such matching region. Both helpers reuse the same
  `0x0041fac0` ordinal label-and-weight copy helper we just grounded, only increment once per
  region, and skip nonzero-class regions whose companion count `[region+0x242]` is nonpositive.
  Those two queries are what the editor summary side at `0x004cdd56/0x004cdeab` uses before it
  formats per-region lists for one selected industry or profile name. The adjacent world-facing
  query strip is bounded too: `0x00422010` scans the live region collection for class-0 regions
  whose normalized coordinates fall inside one caller-supplied float rectangle, keeps the nearest
  region id `[region+0x23a]` by squared XY distance through `0x0051db80`, and returns `0` when no
  qualifying region is found; `0x004220b0` is the small wrapper above it that returns the matched
  region name `[region+0x356]` or the fallback localized scratch string at `0x0062ba90`.
  `map_editor_territory_panel_construct` and
  `map_editor_territory_panel_handle_message` own the territory rename and border-remap lane;
  `map_editor_locomotive_availability_panel_construct` plus
  `map_editor_locomotive_availability_panel_handle_message` now bound the locomotive policy page
  over `0x006ada84`; `map_editor_industry_availability_panel_construct` plus
  `map_editor_industry_availability_panel_handle_message` do the same for the industry candidate
  pool at `0x0062b268`; and `map_editor_port_warehouse_cargo_panel_construct` plus
  `map_editor_port_warehouse_cargo_panel_handle_message` now ground the recipe-book page that edits
  port or warehouse cargo policies through twelve per-book state blocks at
  `[0x006cec78+0x0fe7+index*0x4e1]`. Each book now has a shared maximum annual production float at
  `book+0x3ed` and five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`; each
  line is bounded as a mode dword, annual amount, a supplied-cargo token at `+0x08`, and a
  demanded-cargo token at `+0x1c`. The constructor and handler now make those fields materially
  tighter too: the row pair shown in `Supply Only` and `Production Demand->Supply` is the `+0x08`
  supplied-cargo selector, the row pair shown in `Demand Only` and `Production Demand->Supply` is
  the `+0x1c` demanded-cargo selector, and the single amount field at `+0x04` is labeled `Annual
  Demand:` only in mode `1` but `Annual Supply:` in modes `2/3`. The stronger new runtime-side
  result is now a full chain rather than only the importer:
  `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` first imports those same five
  lines into one repeated array of identical `0xbc`-byte runtime descriptors with no row-index
  special casing, and the candidate-side rebuild pass at
  `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` then
  projects those descriptors into the live structure collection at `0x0062ba8c` before
  `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` rebuilds the
  per-cargo runtime summary tables. The current local file-side result is now tighter too: the
  grounded recipe-book root at `0x0fe7` is preserved byte-for-byte across the checked map/save
  scenario pairs, so the loader can safely treat the twelve `0x4e1`-byte books as preserved
  scenario payload rather than a drifting save-only band. A conservative summary probe now only
  reports per-book head signatures, raw cap dwords at `+0x3ed`, and five raw line summaries rooted
  at `+0x3f1` so the file-side structure stays aligned with this grounded ownership. The
  player-facing line modes remain `Disabled`, `Demand Only`, `Supply Only`, and
  `Production Demand->Supply`, and the fourth mode is tighter now too: current wording around
  `1674`, `1675`, and `504` plus the downstream scaling path says it is the
  production-line mode governed by the shared annual production cap, where the entered annual amount
  stays on the supply side while the demanded side becomes the normalized input branch. The
  candidate-side accumulator pass reinforces that split by applying the shared production cap only
  to the supply-half runtime branch and bypassing that scaling on the normalized demand half. The
  lower gameplay side is tighter now too: `structure_candidate_query_cargo_runtime_summary_channels`
  `0x00412650` is the first grounded consumer beneath that rebuild chain, because it lazily rebuilds
  four per-cargo summary banks and returns one direct-supply channel, one cap-normalized supply
  channel, one demand or input channel, and one scaled production-output subrow channel for a
  requested cargo id. The internal indexing is tighter now too: the direct-supply lane indexes from
  `[desc+0x1c]`, the demand or input lane uses that same resolved cargo id in the no-subrow branch,
  and the scaled production-output lane indexes each subordinate row directly from
  `[desc+0x44+row*0x1c]`, with no post-resolution failure guard between the importer writes and the
  summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if
  the imported low-16 marker rows fail the exact matcher at `0x0041e9f0`, the resulting `0` ids
  will still hit the first summary-bank bucket inside `0x00412650`, but the semantic meaning of
  cargo id `0` itself remains ungrounded. The sibling helper
  `structure_candidate_supports_or_references_cargo_id`
  `0x004129d0` then uses those same banks plus the cached cargo-membership arrays to answer whether
  a live candidate materially references a cargo at all. One compare step tighter, the raw line
  lanes now split cleanly by scenario family while still preserving map->save identity inside each
  checked pair. `Alternate USA.gmp` and `Autosave.gms` match at the raw line-content level: books
  `0..4` keep mixed line areas, their `line02` slots carry the recurring nonzero mode words
  `0x00110000`, `0x000b0000`, `0x000b0000`, `0x00130000`, and `0x00180000`, and the same `line02`
  slots also carry one recurring supplied token `0x000040a0`; the neighboring `line00/line01`
  slots carry the same recurring demanded token lanes such as `0x00010000`, `0x72470000`,
  `0x6f430000`, `0x694c0000`, and `0x694d0000`. `Southern Pacific.gmp` and `p.gms` also match at
  the raw line-content level, but the same rooted line slots stay zero in the checked pair.
  `Spanish Mainline.gmp` and `g.gms` again match at the raw line-content level yet carry a distinct
  nonzero pattern: books `0..4` keep mixed line areas, line-level supplied tokens include
  `0x00170000`, `0x00150000`, `0x00004040`, and `0x00004000`, demanded tokens include
  `0x00010000`, `0x68430000`, and `0x6c410000`, and the later `line02` mode words stabilize at
  `0x00070000` then `0x00010000`. So the loader can now safely treat these raw line lanes as
  preserved scenario payload with family-specific signatures, even though the exact cargo-id and
  mode-enum semantics still need separate grounding. One inference is tighter now too: when those
  demanded-token words are zero in the low 16 bits and printable in the high 16 bits, the byte
  order reads as short two-letter stems such as `Gr`, `Co`, `Li`, `Mi`, `Ch`, and `Al`, which fit
  the current scenario cargo-name families `Grain`, `Corn`, `Livestock`, `Milk`, `Cheese`, and
  `Alcohol` from `RT3.lng`; the runtime probe now exposes those only as probable ASCII stems, not
  as fully grounded cargo-id decodes. The supplied-token side is now bounded as a separate layout
  family rather than forced into that same stem model: the `Alternate USA` family uses one stable
  low-16 marker `0x000040a0` only in `book00..04.line02`, the `Southern Pacific` family leaves the
  supplied lanes zero in the checked pair, and the `Spanish Mainline` family splits between two
  high-16 numeric tokens `0x00170000` and `0x00150000` in `book00/01.line01` plus the later low-16
  markers `0x00004040`, `0x00004000`, and `0x00004040` in `book02..04.line02`. The probe now
  exposes those conservatively as token-layout classes `high16-ascii-stem`, `high16-numeric`, and
  `low16-marker`, without claiming that the non-stem numeric or marker families are decoded yet.
  One more structural layer is stable enough to name conservatively: the checked nonzero recipe
  rows repeatedly fall into four line-signature classes. `Alternate USA` books `0..4` all expose
  one `demand-numeric-entry` at `line00` (`0x00010000`), one `demand-stem-entry` at `line01`
  (`Gr/Co/Li/Mi` stems), and one `supply-marker-entry` at `line02` (nonzero mode plus
  `0x000040a0`). `Spanish Mainline` books `2..4` expose that same three-line pattern with
  `Ch/Al` stems and the `0x00004040/0x00004000` marker family, while books `0/1` only expose the
  earlier `supply-numeric-entry` form at `line01`. So the loader can now distinguish recurring row
  roles such as demand-stem versus supply-marker without pretending the marker payloads themselves
  are decoded. The importer-side branch map is tighter now too because local `objdump` over
  `0x00435630` shows that only nonzero mode dwords materialize into `0xbc` runtime descriptors:
  mode `0` lines are skipped entirely, mode `1` enters the demand-only branch, mode `3` enters the
  dual demand-plus-supply branch, and every other nonzero mode falls into the supply-side branch.
  In the checked corpus that means the recurring `demand-numeric-entry` and `demand-stem-entry`
  rows in `Alternate USA` and `Spanish Mainline` are preserved scenario-side line records but do
  not become live runtime descriptors, while the later `supply-marker-entry` rows are the ones that
  actually reach the runtime import path. The runtime probe now exposes that directly as
  `imports_to_runtime_descriptor` plus one conservative `runtime_import_branch_kind`.
  The raw token windows beneath those branch labels are tighter now too. The checked mode-zero
  demand rows preserve string-bearing windows at `line+0x1c`, and the current probe shows those
  conservatively as prefixed ASCII previews such as `..Grain`, `..Corn`, `..Livestock`, and
  `..Milk`; local `objdump` over `0x0041e9f0` then shows the importer feeding the corresponding
  token buffer into an exact cargo-name matcher built over the live cargo collection at
  `0x0062ba8c`. By contrast, the imported `supply-marker-entry` rows feed nonprintable windows such
  as `.@...` from `line+0x08` through that same matcher, and the resolver path currently shows no
  special-case decoding for those marker forms. So the strongest static read is now: the stem-like
  demand rows preserve cargo-name text but are skipped because their mode is zero, while the
  nonzero imported marker rows are the live descriptor inputs yet likely fail exact cargo-name
  resolution unless another upstream transform exists.
  The wrapper layer above that query no longer looks like a hiding place for special treatment
  either. Local `objdump` now shows `0x00412960` simply summing the two supply-side floats returned
  by `0x00412650`, while `0x004129a0` returns the single scaled production-output lane directly;
  neither wrapper checks for cargo id `0` after the query returns. The broader world-side
  accumulator at `0x0041e7be` is tighter in the same way: it calls `0x00412650`, requires all four
  returned channels to be positive before continuing, and only then scales those four channel
  values by one linked-instance count from `0x00413940` into caller-owned accumulators. So the
  current strongest read remains structural rather than semantic: unresolved marker rows can still
  propagate through the first bank bucket, but the first place that meaning matters is a normal
  positivity-gated cargo-channel consumer, not a dedicated null-cargo branch.
  The caller side is narrower than before too. The steady-state site bitset owner
  `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` starts its inner cargo
  loop at id `1` and only walks upward through the current live cargo count, so it never
  intentionally queries cargo id `0`. The broader placed-structure sweep around `0x00452e60`
  tightens the same boundary from above: when the requested cargo id is nonzero it resolves the
  backing candidate and enters `structure_candidate_supports_or_references_cargo_id`, but when the
  requested id is exactly `0` it skips that cargo-reference helper entirely and falls through to a
  different linked-site or station-or-transit gate. Current local `objdump` now shows that bypass
  first requiring one subtype latch through the placed-structure vtable `+0x70`, then resolving the
  linked site id at `[site+0x2a8]` through the placed-structure collection `0x006cec20`, and then
  forwarding that linked peer into the narrower predicate at `0x0047fd50`. That narrower helper is
  tighter than before too: it resolves the linked peer's backing candidate through the peer site id
  at `[peer+0x04]`, reads candidate class byte `[candidate+0x8c]`, and returns true only for the
  first three class values `0/1/2` while rejecting `3/4` and anything above `4`. So current local
  callers treat cargo id `0` as a nonstandard request bound to one linked-site reachability or
  classification side path, not one ordinary cargo lane they routinely probe.
  The vtable-`+0x70` latch itself is bounded a bit better now too. It still lacks a direct field
  decode, but every local callsite we checked around `0x0040d230`, `0x0040dba0`, `0x0040dbf0`, and
  `0x0040f670` uses that slot only as the precondition for touching `[site+0x2a8]` and the
  neighboring linked-site helpers `0x0047dda0`, `0x0047fd50`, and `0x004138b0`. That makes the
  safest current read a linked-site-bearing or linked-site-capable latch, strongly aligned with the
  subtype-`1` construction lane that is the only grounded writer of `[site+0x2a8]`, rather than a
  broad cargo or route-style predicate.
  The neighboring maintenance pair tightens that linked-site read further. Local `objdump` now
  shows `0x0040dba0` and `0x0040dbf0` as complementary tiny helpers that each require the same
  vtable-`+0x70` latch, resolve optional linked peer id `[site+0x2a8]` through `0x006cec20`,
  forward that linked peer (or null) into `0x0047dda0`, and then mirror opposite values into local
  byte `[site+0x42]` (`0` for `0x0040dba0`, `1` for `0x0040dbf0`). The route-entry side beneath
  them is tighter too: `0x0047dda0` reads route-entry anchor id `[peer+0x08]`, resolves that anchor
  through `0x006cfca8`, and only dispatches one of two route-entry vtable calls when
  `0x0048a090(1)` reports that all three anchor-slot dwords `[entry+0x206]`, `[entry+0x20a]`, and
  `[entry+0x20e]` are still `-1`. So the strongest current read is no longer just "linked-site
  capable" in the abstract: this latch consistently fronts the local linked-peer class gate
  `0x0047fd50`, the paired `[site+0x42]` route-entry state toggles, and the later linked-peer
  collection sweep `0x004138b0`, which keeps the `cargo id 0` bypass path firmly on the
  linked-site route-anchor or classification side rather than on an ordinary cargo lane.
  One smaller ownership boundary is tighter too: byte `[site+0x42]` is not private scratch owned
  only by that pair. Local `objdump` shows tiny direct setters at `0x0040cbc0` and `0x0040cbd0`
  plus a raw getter at `0x0040cbf0`, so the `0x0040dba0/0x0040dbf0` pair is writing one shared
  placed-structure state byte rather than inventing a route-entry-only scratch lane. One caution
  is tighter now too: there are later mode-gated reads at other addresses that also touch a
  `+0x42` byte on their own object layouts, but current local evidence does not yet prove those are
  the same placed-structure owner family, so the safest current note keeps only the immediate
  `0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0` cluster grounded together.
  The vtable side sharpens that split too. A local `.rdata` scan shows `0x0040dba0` and
  `0x0040dbf0` each appearing exactly once, together with `0x0040cbf0`, in one method table rooted
  at `0x005c8c50`; the constructor chain is tighter now too, because `0x0040c950` installs that
  same table as one concrete placed-structure specialization above the common base table
  `0x005cb4c0`, while `0x0040c970` tears the same specialization back down to the base before the
  temporary object is freed. By contrast the raw set or get trio
  `0x0040cbc0/0x0040cbd0/0x0040cbf0` also appears in several sibling tables such as `0x005c9750`
  and `0x005dd1f0`. So the strongest current structural read is that byte `[site+0x42]` belongs
  to one broader placed-structure virtual interface, while the linked-peer route-entry toggles are
  one specialization-specific override pair inside that family rather than generic setters used by
  every sibling.
  One negative boundary is tighter now too: the
  raw token words in this recipe block do not look like the already grounded shell-side
  `AnyCargo/AnyFreight/AnyExpress` selector-table ids from `0x00621e04/0x00621e10`, so the current
  best read is that these on-disk line tokens are not just copied UI selector ordinals or the same
  small express-side id family in another wrapper. One broader collection pass also now ties
  the editor rule side back into runtime filtering:
  `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0` rebuilds
  per-candidate flag `[candidate+0x56]` across the live structure collection, and current grounded
  callers show it rerunning directly off the runtime cargo-economy latch at `[0x006cec74+0x25f]`,
  which aligns this lane with the editor's `Disable Cargo Economy` special condition rather than
  leaving it as a purely editor-owned recipe page. The first common live gate beneath that filter is
  now bounded too: `structure_candidate_is_enabled_for_current_year` `0x0041e220` is the shared
  year-and-filter check used by the collection refresh and later candidate-selection branches, while
  `structure_candidate_rebuild_local_service_metrics` `0x0041e2b0` is a setup-side local service
  scorer that already consumes the same enabled candidate records through world-grid sampling. One
  steady-state world-side consumer is now grounded as well:
  `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` walks linked placed
  structures, filters live category-`2` candidates through
  `structure_candidate_is_enabled_for_current_year`, and compacts the direct and scaled supply-side
  channels from `0x00412960` and `0x004129a0` into per-cargo bitsets on the placed-structure record.
  The next site-side owner layer is tighter now too:
  `placed_structure_refresh_linked_candidate_flag4` `0x0042c8f0` refreshes the sibling state bit at
  `[site+0x0e6]`, `placed_structure_refresh_candidate_service_state` `0x0042cdf0` ties that flag
  refresh to the cargo-service bitset rebuild,
  `placed_structure_rebuild_candidate_local_service_tables` `0x0042ce00` then performs the heavier
  per-site candidate score rebuild over the aligned float and word tables at `[site+0x107]`,
  `[site+0x02]`, and `[site+0x6c]`, and `placed_structure_refresh_local_service_score_bundle`
  `0x0042d580` is now the local wrapper that chains that rebuild into the neighboring post-passes
  before the world-grid owner continues. Those post-passes are tighter too:
  `placed_structure_apply_route_linked_service_caps` `0x0042cc50` is the first route-backed cap pass
  over the rebuilt local tables,
  `placed_structure_redistribute_local_service_pressure_from_neighbors` `0x0042c1b0` is the
  neighboring-site redistribution pass, and `placed_structure_clamp_candidate_service_age_table`
  `0x0042cb30` is the final recent-service clamp over the primary per-candidate word table. Above
  that refresh lane, `placed_structure_query_candidate_local_service_metrics` `0x0047e240` is the
  first higher-level query, `placed_structure_count_candidates_with_local_service_metrics`
  `0x0047e330` counts how many candidates currently produce that query,
  `placed_structure_get_nth_candidate_id_with_local_service_metrics` `0x0047e620` is the ordinal
  selector over that same visible candidate family,
  `placed_structure_query_cached_express_service_class_score` `0x0047e390` caches one parallel class
  score for the express family now strongly aligned with `Passengers`, `Mail`, and `Troops`,
  `placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site`
  `0x0047eb90` rebuilds one peer-site comparison cache over the same local-service inputs, and
  `placed_structure_select_best_candidate_id_by_local_service_score` `0x0047f910` is the best-hit
  selector above the direct and directional local-service query pair. Those site-side scores now
  have grounded shell read-side consumers too:
  `shell_station_detail_format_freight_and_express_summary` `0x00506be0` formats the visible
  `Freight: %1` and `Express: %1` lines in `StationDetail.win`, and the same station-detail family
  now has a deeper candidate-service lane:
  `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` stores the active
  `(station id, candidate id)` pair for the world-side preview scan and now grounds the whole
  world-side arming strip through
  `world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active`
  `0x00452f60`,
  `world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero` `0x00452d80`,
  `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active`
  `0x00452db0`, and
  `world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid` `0x00452ca0`,
  `shell_station_detail_clear_active_candidate_service_preview` `0x00504a90` tears that pair back
  down, `shell_station_detail_update_candidate_service_entry` `0x00504ba0` is the shell-side entry
  updater above that preview pair, `shell_station_detail_format_candidate_local_service_summary`
  `0x00504bea` uses `placed_structure_query_candidate_local_service_metrics` together with localized
  ids `681`, `682`, and `2813` to build the visible candidate service text,
  `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150` now grounds the paired `To`
  and `From` hauled-traffic strip widgets, `shell_station_detail_present_to_from_haul_stats_popup`
  `0x00504770` owns their click-through annual and lifetime `hauled TO/FROM this station` popup,
  `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470` owns the five-row
  nearby-structure jump lane, and `shell_station_detail_refresh_candidate_service_rows` `0x00505760`
  is now the larger row-list owner that enumerates active candidate-service entries and wires
  `shell_station_detail_update_candidate_service_entry` into the per-row click path. The broader
  owner above those lanes is tighter now too: `shell_station_detail_window_refresh_controls`
  `0x00506610` is the real `StationDetail.win` refresh pass, validating the current station from the
  detail manager, publishing the upper summary lane, splitting the `0xb3b7/0xb3b8` action strip by
  scenario latch `[0x006cec74+0x1db]`, routing that scenario branch through
  `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590`, routing
  class `3/4` sites into the alternate branch
  `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and otherwise rebuilding the nearby-structure lane, the paired `To/From` widgets,
  and the candidate-service rows together. The broader message side is bounded now too:
  `shell_station_detail_window_handle_message` `0x00505e50` owns the wide `StationDetail.win`
  switch over message ids `0`, `0xca`, `0xcb`, and `0x3ea`, routes candidate-service rows
  `0xb4dc..0xb5a3` into preview arm or clear or a Ctrl-modified `Overview.win` handoff, routes
  nearby-structure rows `0xb40a..0xb413` into the detail transition and optional world-centering
  path, refreshes control `0xb3f8` on the `0x3ea` branch, and dispatches the lower
  `0xb3b5..0xb3bf` action band through the selected-station ownership and class-gated helper strip.
  The compact siblings under that pass are tighter now too:
  `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` is the dirty
  clear owner over the dynamic row bands and the paired haul widgets, `shell_station_detail_has_valid_selected_station`
  `0x00504370` is the bare selected-station validity probe, `shell_station_detail_selected_station_belongs_to_selected_company`
  `0x00504390` is the selected-company ownership gate, and
  `shell_station_detail_present_selected_station_not_controlled_notice` `0x005043f0` is the
  localized not-controlled popup beneath the same action family,
  `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` is the
  scenario-latched station-to-station triplet popup that formats three per-destination scalar lanes
  with `%5.2f` or `N/C`, and
  `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0` is the alternate
  class-`3/4` branch that rebuilds the `Trains Serviced` / `Trains Maintained` matrix before
  reusing the shared haul-popup callback wiring,
  `shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`
  refreshes the lower class-gated action strip rather than the older guessed `0xb3f8` lane. The
  adjacent lifecycle and navigation side is tighter now too:
  `shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton` `0x00505bf0`
  is the real `StationDetail.win` destructor, and
  `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class`
  `0x00505cb0` plus wrappers `0x00505e30` and `0x00505e40` now bound the next-or-previous station
  stepping path that keeps the selection inside the same owner and station-site class family before
  optionally recentering the world view. The broader shell command layer above that station-detail
  branch is tighter now too:
  `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00` and
  `shell_command_step_active_window_subject_backward_or_publish_contextual_notice` `0x00440f20`
  are the paired next-or-previous shell commands that first prefer `StationDetail.win`, then the
  live building-detail family, then `CompanyDetail.win`, and finally the sibling singleton at
  `0x006d3b20` before falling back to the localized notice pairs `0x017a/0x017b` and
  `0x017c/0x017d`. The adjacent direct subject-openers are tighter now too:
  `shell_open_or_focus_train_detail_for_current_or_first_owned_train` `0x00441040` reuses current
  detail subject `[detail+0x78]` or falls back to the first owned train for the selected chairman
  company before re-entering `shell_detail_panel_transition_manager` with mode `2`, while
  `shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station` `0x004410d0`
  reuses `[detail+0x80]` or falls back to the first owned linked station before the same transition
  manager is re-entered with mode `5`. Two later registered command siblings are now bounded only
  structurally but still usefully: `0x00441160` requires active scenario plus live world root
  `0x0062c120` and dispatches either
  `world_enable_preview_mode_0x15_latch_and_enter_if_idle` `0x00453370` or
  `world_disable_preview_mode_0x15_latch_and_clear_if_active` `0x00453780` by the query at
  `world_query_preview_mode_0x15_latch_active` `0x00450150`,
  while `0x004411a0` requires active scenario plus live route-store root `0x006cfca8` and
  dispatches either `0x00491880` or `0x004932a0` by the boolean result of `0x004934a0(0)`.
  The next registered shell-command strip is bounded the same way now:
  `shell_command_toggle_shared_world_preview_global_0x62be84` `0x00441240` flips the shared
  preview-oriented global `0x0062be84`,
  `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`
  and `...variant_1...` `0x004412a0` both route through
  `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`,
  which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across
  detail controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards
  the selected variant into
  `world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty` `0x0043a0a0`, and
  `shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds` `0x004412e0`
  re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` and then rewrites the
  paired shell-state dwords at `[0x006cec74+0x1df/+0x1e3]` through `0x00482850`. Those three
  commands are still structurally named rather than semantically named, but the current static owner
  boundaries are now explicit. The same command band is tighter at both edges too: `0x004411e0`
  simply flips presenter dword `[0x006d4024+0x114276]` when the main shell presenter is live, and
  `0x00441200` is the adjacent active-scenario gate that injects shell message `0xcb` for control
  `0x9858` through
  `shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars` `0x00538e00`. The later edge
  of the same shell strip is bounded too:
  `0x00441ac0` and `0x00441af0` are the two small active-scenario plus shell-idle wrappers over
  `shell_map_file_entry_coordinator` `0x00445ac0`, forwarding flag triplets `(0,0,0)` and
  `(0,1,0)` respectively, while `0x00441b20` is the neighboring live-world clamp that ensures
  `[world+0x168d]` never falls below `[world+0x1689]`. The next broader neighbor is now grounded
  too: `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` is the
  real editor-map-mode toggle owner above `0x00482e50`. It branches on current shell mode
  `[0x006cec74+0x68]`, uses one-shot latches `0x0062be88` and `0x0062be8c` to gate localized
  warnings `0x017e` and `0x0b24`, and on the non-editor side can instead raise warning `0x0b6e`
  when `0x004349a0` reports more than one active profile. After those gates it forwards target mode
  `([shell+0x68] == 0)` into
  `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`.
  The adjacent startup-year strip is grounded now too:
  `shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar` `0x00441cb0`
  and `shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar`
  `0x00441d20` are the paired registered commands beneath localized ids `0x0db5/0x0db6`. Both
  require active scenario state plus the same single-profile gate from `0x004349a0`, clear shell
  dwords `[0x006cec74+0x233]` and `[+0x124]`, then adjust startup scalar `[0x006cec78+0xbfa]` by
  `+0.5` or `-0.5` before re-entering
  `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute
  counter `[0x006cec78+0x15]` and refreshing the live world view through `0x00439a80`. The exact
  player-facing command labels are still open, but the static owner boundary is now clear: these
  are not generic shell scalars, they are the paired half-step selected-year presentation commands.
  The adjacent progress-status side is tighter now too:
  `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90` is the shared save or load
  progress payload builder, and
  `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` is the
  throttled callback installed at `0x00442960` through global `0x00d93988`. That callback advances
  the progress latches `0x0062bec8/0x0062becc/0x0062c118`, rebuilds the percent payload through
  `0x00441d90`, republishes it through `0x00538c70`, and services the shell frame through
  `0x00482160`. The surrounding `0x00445de0` callers keep that pair on the save or load progress
  side of the shell strip rather than as another input-command family. The adjacent companion-image
  file seam is bounded now too:
  `shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags`
  `0x00441f70` and
  `shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path`
  `0x004420f0` are the paired `_A.tga` / `_A.jpg` import and export helpers around the same
  tagged selector strip at `0x00441ec0`. Both derive an extensionless stem through
  `support_copy_string_stem_before_first_dot` `0x0051dde0`, choose the `_A.tga` versus `_A.jpg`
  suffix by selector byte `[record+0x09]`, and then shuttle the file bytes through the shared
  staging descriptor rooted at `0x0062bed4/0x0062bed8`. That keeps the family grounded on the same
  fallback descriptor later reused by
  `world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback` `0x00535430`,
  instead of leaving it as an isolated save-side file copier. The neighboring exporter
  `shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100`
  `0x00442ba0` is bounded now too: it copies the live setup payload from `[this+0x66be]`,
  patches world dimensions and three shell bytes into offsets `+0x01..+0x0b`, and then
  normalizes the embedded `0x100 x 0x100` pixel block at `+0x03c2` through `0x0047a120`
  before the save-side callers forward that same record into `0x00441ec0` or the tagged
  slot-table serializer at `0x00446312`. The broader sibling
  `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46`
  `0x00442740` is bounded now too: it copies the embedded preview pixels at `[record+0x03c2]`
  into a temporary `0x40000`-byte RGBA buffer, constructs one temporary `0xec`-byte surface-like
  owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, forwards the caller path
  plus fixed selector `0x46` into `0x00542f50`, stores the returned dword into payload field
  `[record+0x18]`, and then releases the temporary owner again through `0x00542c90` and
  `0x0053b080`. That keeps the short save-side branch at `0x00445925` grounded as a one-shot
  preview-surface query helper rather than leaving another anonymous image-copy leaf between the
  tagged export path and the progress notice strip. The broader sibling
  `shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback`
  `0x004427c0` is now bounded as the temporary-path owner above that same tag strip: it derives
  `%1.tmp` from the source path, installs progress callback `0x00441e20` in `0x00d93988`,
  rewrites the middle payload band rooted at `+0x03ce` through `0x00553000`, writes the result
  back out through `0x005a276f`, updates payload dword `[record+0x18]`, and only then re-enters
  `0x00441ec0`.
  The sibling `shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags`
  `0x00442900` is bounded now too: it takes the live payload record in `EAX`, reads the full
  companion file named by the caller path, installs the same progress callback, rewrites the
  middle payload through `0x00553000` using stored offsets `[record+0x18/+0x1c]`, and then writes
  the output back in four spans: the leading `0x03ce` bytes, the transformed middle payload, the
  untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. It then stores the
  caller path back into `[record+0x18]` and re-enters `0x00441ec0`. That closes the offset-driven
  save-side sibling reached from `0x004459dd` after `0x00441f70`, so the companion-payload strip
  is no longer split between one named temp-path owner and one anonymous offset-band rewrite body.
  The underlying temporary-surface seam beneath those save-side helpers is bounded now too.
  `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10`
  scans the eight-entry row band `[this+0xa0..+0xbc]`, allocates one `0x32`-byte row, seeds width,
  height, and type, and returns the chosen slot index; `0x00541ba0` is the indexed release-side
  companion. `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50` is the
  named-resource dispatcher used by `0x00442740`: it opens the caller-seeded resource path,
  forwards the result into `0x005428c0`, and then dispatches by imported row type
  `[row+0x18] = 2/3/4`. `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish`
  `0x005438d0` is the commit-side publish helper over the active RGBA backing buffer
  `[row+0x26]`, while `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode`
  `0x00543980` is the constructor or ensure owner that allocates one first-use slot through
  `0x00541b10(..., width, height, 3)` and then commits the caller pixels through `0x005438d0`.
  That keeps the save-side preview seam tied back to the same reusable surface-owner family already
  visible in the world-presentation and shell-overlay branches, instead of leaving the temporary
  preview query path grounded only at the leaf helper level.
  The lower surface-owner base is bounded now too. `surface_owner_base_init_and_register_on_global_list`
  `0x00540e30` seeds the fixed owner label, capability bytes, helper-object pair, row-slot bands,
  and global intrusive registration under `0x00ccbb2c`; `surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers`
  `0x00540fc0` is the shared maintenance owner that recomputes cached byte totals `[this+0xcc/+0xd0]`
  across the eight row slots and also owns the full row-buffer release pass; and
  `surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate` `0x00541210`
  is the row-side repack body that converts the active backing pixels into the live 16-bit buffer
  `[row+0x2a]`, either through a palette-like accumulated-channel path or a direct nibble-packed
  conversion path depending on owner byte `[this+0x96]`. That closes the reusable surface family
  one layer deeper instead of stopping at the first slot allocator and commit helpers.
  The two remaining compact helpers in that same seam are bounded now too.
  `surface_owner_query_dimension_cap_from_mode_and_quality_band` `0x00541160` derives the active
  power-of-two size cap `0x100/0x200/0x400/0x800` from owner byte `[this+0x05]`, shell gate
  `[0x006d4024+0x11422f]`, and selector dword `[this+0xd8]`, while
  `surface_owner_probe_named_file_for_type2_header_signature` `0x005411c0` is the adjacent file
  probe that opens one named path, reads `0x12` header bytes, and accepts only the local type-`2`
  signature. The broader survivor above them is bounded now too:
  `surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream` `0x005428c0`
  allocates temporary alpha and RGB planes from the active row, splits the current backing pixels,
  seeds the local codec object, and then writes the tagged record family `0xbaba/0xbabb/0xbabe`
  into the already-open stream, either directly or through the transformed payload path via
  `0x00553000`. That closes the immediate import-export seam under `0x00542f50`; the next open
  work in this branch is no longer a still-missing leaf, but the broader type-specific row owners.
  Those are bounded now too. `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer`
  `0x00541c30` is the type-`4` importer that validates the `0xbabe` lead tag plus the later
  `0xbaba/0xbabb` branches, reconstructs one RGBA row from the tagged payload bands, and then
  re-enters `0x00541210`. `surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer`
  `0x00542030` is the type-`3` importer that validates the recovered width, height, and pixel-size
  header, allocates a full RGBA destination plus temporary staging, and decodes the supported
  `0x18`/`0x20` source families into RGBA rows. `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer`
  `0x00542d50` is the type-`2` importer: it validates `DDS `, enforces the dimension cap from
  `0x00541160`, copies the block-compressed payload from offset `0x80`, stores format tag
  `DXT3`, and optionally materializes the live companion buffer through `0x005423d0`.
  That closes the current type-dispatch branch under `0x00542f50` without leaving its three row
  owners as anonymous stream bodies.
  The direct export-side sibling is bounded now too.
  `surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file` `0x00542b30`
  is the paired file-write alternative to `0x00542f50`: it opens one caller path in `wb` mode,
  builds the compact `0x12`-byte header with row type `2`, first-row width and height, fixed
  pixel-size byte `0x20`, and one optional `0x20` flag bit from the second caller argument, then
  optionally forces RGBA materialization through `0x00541970` and writes the first-row RGBA payload
  `[row+0x26]` plus that header to the open stream. The paired callers at `0x00520cda`,
  `0x00520f61`, and `0x00534dd6` all use it as the direct-file branch immediately before the same
  temporary-surface release through `0x00542c90 + 0x0053b080`, so the current export/import seam is
  no longer split between one named importer and one anonymous file-write sibling.
  The small dispatch sub-strip under that importer is bounded now too.
  `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0` is the direct selector over
  embedded row type `[row+0x18]`, routing type `2/3/4` to `0x00542d50/0x00542030/0x00541c30`.
  The wrapper immediately above it,
  `surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure` `0x00543000`,
  clears selector field `[this+0x07]`, allocates one fresh row slot through `0x00541b10`,
  re-enters `0x00542fb0`, drops the slot again through `0x00541ba0` on the `1/2` failure paths,
  and then refreshes cached byte totals through `0x00540fc0`. That closes the type-dispatch seam
  between the file-open owner and the per-row import bodies instead of leaving one more anonymous
  slot wrapper in the middle.
  The lower lifecycle in that same surface-owner family is tighter now too.
  `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970` is the
  shared query-or-materialize helper for non-type-`2` rows: it optionally returns width and height,
  returns `[row+0x26]` when RGBA backing pixels already exist, and otherwise expands the live
  16-bit source buffer `[row+0x2a]` into nibble-doubled RGBA dwords before storing the new backing
  pointer back into `[row+0x26]`. The broader sibling
  `surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers` `0x00542550`
  is the next owner above that helper: when shell capability byte `[0x006d4024+0x11422d]` is live
  and local latch `[this+0x95]` is still clear, it revisits the active row slots, skips type-`2`
  and already-processed rows, forces RGBA materialization through `0x00541970`, marks row byte
  `[row+0x21]`, seeds row state `[row+0x1c] = 0x3c`, discards the previous 16-bit output buffer,
  and rebuilds `[row+0x22/+0x2a]` from a float-heavy neighbor-difference transform over the RGBA
  source, halving `[row+0x04]` on the `0x20`-pixel-size branch. The release-side owner is bounded
  now too: `surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots` `0x00542c90`
  releases optional helper roots `[this+0xdc/+0xe4]`, unlinks the owner from the global intrusive
  list rooted at `0x00ccbb2c`, conditionally refreshes the live shell presenter when `[this+0x93]`
  is set, and then drops both the selector-side handle and all row slots through
  `0x00541780` and `surface_owner_release_all_row_slots_0xa0` `0x00542870`. That closes the
  reusable surface-owner seam one level deeper instead of stopping at construction, import, and
  commit helpers.
  The remaining tiny surface-owner leaves in that strip are bounded now too.
  `surface_owner_query_first_row_width_or_one` `0x00541aa0` and
  `surface_owner_query_first_row_height_or_one` `0x00541ad0` are the fallback-safe first-row
  geometry getters used by later projection and world-presentation math paths, while
  `surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0` `0x00541bf0`
  simply refreshes cached scalar `[this+0xd4]` from the live shell presenter and returns
  `[this+0xc0]`. The last tiny release helper `surface_owner_release_selector_handle_0x07_if_present`
  `0x00541c10` does exactly what the current name says: when `[this+0x07]` is live it re-enters
  `0x00541780` and clears that handle back to zero.
  The later owner `shell_apply_scenario_name_specific_post_load_world_and_object_fixups`
  `0x00442c30` is bounded now too: `world_entry_transition_and_runtime_bringup` re-enters it at
  `0x00444b50` with the loaded scenario title, and it dispatches on many fixed `.rdata` names
  including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`,
  `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`,
  `Central Pacific`, and `Orient Express`, with several branches further gated by setup payload
  byte `[this+0x66de]`. The matched branches then perform targeted live-world edits rather than a
  generic title-side publish: they patch object-state dwords and bytes inside collections rooted at
  `0x0062be18`, `0x0062bae0`, and `0x006ada80`, adjust selected float and scalar fields, copy
  paired ten-dword record blocks when specific name/class pairs match, flip secondary-raster bits
  through table `0x005ee508..0x005ee5cc`, retune a later collection at `0x0062b268`, and inject
  scenario-specific text lines into the shell-owned band `[this+0x4f30]` through repeated
  `0x0051e5d0`. That finally makes the broad post-load scenario-fixup seam explicit instead of
  leaving it as an unbounded string-switch body beneath world entry.
  One neighboring status helper is bounded now too:
  `shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks` `0x00442660` is the
  shared byte-delta and elapsed-time notice builder used by both the bundle-service strip and the
  save-side progress loop. It measures the current byte counter through `0x00530b70`, formats the
  rounded kilobyte delta and elapsed ticks through `%5d` and `% 4d`, packages them through
  `0x005193f0 -> 0x00518de0 -> 0x0051d680`, and then updates the running previous-counter latch
  `0x0062c11c`.
  That setter writes `[shell+0x68]`, then either rebuilds the editor-side shell surface through
  `0x004d4500` or refreshes the detail-panel and world side through `0x004d44a0`, `0x004dfda0`,
  and `0x0044fb70`, before both branches pulse graphics side effects through `0x00484d70(0x0d, 1)`.
  The adjacent display-settings strip is bounded now too:
  `shell_command_cycle_display_resolution_forward` `0x00483680` is the registered `+1` command
  wrapper into `shell_cycle_display_resolution_and_publish_status` `0x00483780`, while
  `0x00483990` and `0x004839a0` are the plain `+1` and `-1` wrappers into that same shared owner.
  The owner requires the live shell presenter `0x006d4024`, walks the supported resolution tables
  at `0x00620e64/0x00620e7c`, applies the chosen size through `0x005206b0`, publishes the updated
  size string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, and then refreshes dependent
  presentation state through `0x004625b0`, `0x00484910(1)`, and `0x004821d0`. After that point the
  embedded world-view controller strip is tighter now too.
  `world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet`
  `0x00439820` samples a five-point local clearance ring around the current eye X/Z pair through
  `0x00534490`, keeps the highest sample, expands it through `0x0052d0c0` plus fixed margins, and
  republishes the eye triplet through `0x0052d1e0` when the current eye height needs to be lifted.
  The embedded controller base beneath that path is now first-class instead of only being referenced
  indirectly: `0x0052d140` stores the four blend scalars at `[+0x50..+0x5c]`, `0x0052d180` stores
  the focus triplet and raises dirty byte `[+0x64]` when it changes, `0x0052d1e0` stores the eye
  triplet and refreshes sampled vertical delta `[+0x66]`, `0x0052d230` extracts focus-to-eye
  distance plus heading/pitch-like angles, `0x0052d2b0` serializes the focus, eye, and orientation
  lanes into one camera-view snapshot record, `0x0052d400` is the inverse helper that rebuilds the
  focus triplet from eye, heading, pitch, and distance, `0x0052d450` rebuilds the eye triplet from
  focus, heading, pitch, and distance, `0x0052d640` clamps distance against sampled eye height,
  `0x0052d750` is the stream-load companion that rehydrates one stored camera-view snapshot back
  into the controller base, and `0x0052d570/0x0052d5a0/0x0052d6f0/0x0052d860` are the
  base-reset, default-seed, seed, and reset-plus-seed constructor owners. One level higher,
  the compact accessor and dirty-latch strip is bounded now too: `0x0052cd20/0x0052cd60` export the
  current eye triplet as packed or split outparams, `0x0052cd40/0x0052cd80` do the same for the
  focus triplet, `0x0052cda0/0x0052cdc0` are the matching load-store helpers for auxiliary triplet
  `[+0x2c..+0x34]`, `0x0052cde0/0x0052ce20` snapshot the current focus, heading, and distance bands
  into the two cached companion strips when their paired dirty latches are cleared, and
  `0x0052ce70` refreshes shell presenter scalar `[+0x6a]` while consuming the primary dirty latch
  back to zero; the next compact query strip is bounded now too: `0x0052cea0` exports heading and
  pitch lanes `[+0x10/+0x14]`, `0x0052cec0` samples owner height at current eye X/Z,
  `0x0052cf00` broadens that into a clamped XY-extent peak-height query, `0x0052d0c0` is the
  current-eye wrapper into that peak-height query, and `0x0052d0f0` is the normalized scalar-band
  containment predicate over `[+0x50..+0x5c]`. One level higher,
  `world_view_refresh_dependent_projection_visibility_and_presentation_scalars` `0x0043bde0`
  now bounds the larger refresh pass that derives visibility and presentation-side scalars from the
  current focus and eye triplets before later motion and input branches resume. The load-side owner
  one layer above that strip is bounded now too:
  `world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars` `0x0043ac30`
  releases any pending helper handle, clears presenter ownership, resets the local controller strip,
  rehydrates one stored camera-view snapshot through `0x0052d750`, conditionally loads one
  extra-row band into `[this+0x10e]`, reseeds the four controller blend scalars through
  `0x0052d140(0, 0, 1.0, 0.7)`, and then normalizes heading before control returns to the broader
  world-view owner family. The adjacent low-side layout-state strip is bounded now too:
  `0x00544290/0x00544360` publish or reset the local descriptor blocks rooted at
  `[layout+0x352f]` and `[layout+0x34ef]`; the next setter strip `0x00544cb0..0x005450a0`
  publishes or clears bound-node property pairs `0x0d/0x0e`, packed property `0x3c`, grouped
  property `0x0b`, the broader capability and mode-gated slot strips
  `0x1d/0x13/0x14/0x12` and `0x15/0x1a/0x11/0x10`, plus the cached-byte-backed property `0x89`;
  and `0x005450c0/0x005450e0/0x00545130` export the cached local block `[layout+0x24f0]` and the
  negated local scalar triplet `[layout+0x2517/+0x251b/+0x251f]`, with the middle lane clamped up
  to `0.5f`. One level lower, `0x00545180` builds the generated default preset table rooted at
  `[layout+0x840]` as `0x90` fixed `0x33`-byte rows from an angular sweep, while
  `0x00545400/0x00545470/0x005454a0` are the adjacent indexed row setters and query helpers over
  that same table and `0x00545420/0x00545440` are the paired scalar-array siblings for
  `[layout+0x25f7/+0x25ff]`; the next local strip `0x005457c0/0x005458a0/0x005458d0` publishes
  one property-`0x8b` stack descriptor on the bound node and borrows or releases the current
  segment-record window handle `[layout+0x265b]` with global counter `0x00ccd824`; the immediate
  sibling wrappers `0x005459f0/0x00545a20/0x00545a40/0x00545a70/0x00545aa0/0x00545ac0/0x00545af0/0x00545b90/0x00545bb0/0x00545be0`
  repeat the same borrow-release pattern for the adjacent table handles `[layout+0x2643/+0x2647/+0x264b/+0x264f/+0x2653/+0x263f]`.
  The last clean local leaves after that are `0x00545ca0/0x00545d50/0x00545d60/0x00545db0/0x00545e00`,
  which cover the first-slot clear plus type-`1` span commit, the accumulated span counter query,
  the counter reset and optional bound-node reseed, the bound-node finalize-and-optional-clear
  helper, and the small bound-node signature classifier. One level up, the next owner body is
  bounded now too: `0x00545e30` queries one external/provider report and builds summary text in
  buffer `[layout+0x43c]`, falling back to localized id `0x73` when the provider lookup fails and
  otherwise appending the localized fragment strip `0x74..0x7d` plus the fixed format family
  `%1(16-bit HW) ` / `%1(8-bit HW) ` / `%1(8-bit) ` / `%1(16-bit) ` from the returned report. The
  adjacent reset-and-property strip is also tighter now: `0x005464d0` runs one repeated four-pass
  bound-node reset sequence, `0x00546540/0x00546560` force property `0x17` to `7` or `4`,
  `0x00546580/0x005465a0` clear or raise property `0xa8`, `0x005467a0/0x005467e0` are the paired
  one-bit gate writes for property `0x1c`, and `0x00546810/0x00546850/0x00546890` are the
  template-gated and clear-side mode writes for property `0x16` via local mode byte
  `[layout+0x254a]`. One level higher again, `0x0054a0c0` is now bounded as the broader setup-side
  owner above that strip: it binds one external source onto the bound presentation node, falls
  back to the midband release helper when that bind fails, conditionally reapplies the cached
  gamma-ramp scalar from `[[layout+0x83c]+0x2f]`, seeds optional handle `[layout+0x33ab]` through
  the small `0x00570fbd -> 0x00570f86` refcounted `0x14`-byte object helper pair, which now opens
  into a tighter row-container family: `0x0057091d` reserves one `0x40`-byte row block from the
  fixed template `0x0056cd2c`, with `0x005708ce/0x005708f2` as the aligned block alloc/free
  helpers, `0x00570908/0x005709da` as the destructor and release-side wrappers,
  `0x00570fa1` as the direct refcount-drop path, `0x0057098b` answering only `IUnknown` plus one
  custom IID, and `0x005709f6` as the first grow-and-duplicate-last-row owner. The next
  current-entry strip is also bounded now:
  `0x00570aac` seeds the current `0x40`-byte entry to an identity 4x4 matrix, `0x00570b0d`
  stores one caller matrix directly into that current slot, and `0x00570b2c/0x00570b76` are the
  two immediate left/right composition siblings over the same current matrix through
  `0x0056d3cd`. One level wider, the same family now has three helper-generated matrix-pair
  variants too: `0x00570bc0/0x00570c2f` build a temporary matrix through `0x0056df7d`,
  `0x00570c9e/0x00570d1a` do the same through `0x0056e1a8`, and `0x00570d96/0x00570e12` plus
  `0x00570e8e/0x00570f0a` do the same through `0x0056dc9a` and `0x0056dd2a`, with each pair
  preserving the same right- and left-side current-matrix composition split. The adjacent helper
  region is now bounded as one sibling COM-style object pair too: `0x0057aef3/0x0057aedb/0x00571016`
  are the init, refcount-drop, and release-side wrappers for vtable `0x005def30`, with
  `0x0057ad5a` as the direct addref helper,
  `0x0057ad20` as its destructor and `0x0057ae97` as its `IUnknown` plus custom-IID query gate,
  `0x0057ad67` as its resource-field bind plus attached-object and payload-copy owner,
  `0x0057add4/0x0057adfb` as the attached-object getter and fixed payload copy-out helpers, and
  `0x0057ae0f/0x0057ae1e/0x0057ae2d/0x0057ae53/0x0057ae79/0x0057ae88` as the direct pass-through
  wrappers over resource field `[+0x48]` and payload block `[+0x08]`,
  while `0x0057af0e/0x00571032` are the destructor and release-side wrapper for sibling vtable
  `0x005def5c`, with `0x0057af4e` as the matching addref helper, `0x0057af5b` as the target-attach
  plus cached-flag derivation owner, `0x0057afd0` as the target getter, and `0x0057aff6` as the
  one-shot target-handle release helper, `0x0057b021` as the paired two-handle clear path,
  `0x0057b065` as the matching `IUnknown` plus custom-IID query gate, `0x0057b0a9` as the
  refcount-drop helper, `0x0057b0c1` as the first broader target-handle and property-strip
  seeding owner, and `0x0057b4fd` as the next target-side transform-block builder over optional
  anchor pairs plus caller angle and scale. The resource-field branch under `0x0057ae0f..0x0057ae88`
  is now tighter too: `0x00580867` is the small constructor-style init for the `0xb0`-byte
  target-service object, clearing the embedded entry-band roots, ready byte, auxiliary handle
  fields, and cache link; `0x005808b2` is the matching full destructor, releasing the two
  target-bound service handles, both embedded eight-entry bands, attached object, target, the
  auxiliary handle family rooted at `[+0x6c/+0x98/+0x9c/+0xa8]`, and then unlinking the object
  from the global cache chain rooted at `0x00db89e4`; `0x005809ab` is the release-side wrapper for
  that destructor; `0x005809c7` seeds service handles `[+0x64]` and `[+0x68]`, invokes attached
  object `[+0x0c]` through slot `+0x10`, republishes those two handles through target slots `+0xdc`
  and `+0xd8`, and latches ready byte `[+0x60]`; `0x00580a54` is the paired clear-side sibling
  that releases handle `[+0x64]` through target slot `+0xd8`, notifies the attached object through
  slot `+0x1c`, and clears `[+0x60]`; `0x00580a84` is the broader release body over those target
  handles plus the two embedded eight-entry bands rooted at `[+0x10]` and `[+0x30]`;
  `0x00580aff` is the setup-side entry-band owner that chooses one of two fixed parameter triples
  from local mode byte `[+0x50]`, seeds scalars `[+0x54/+0x58/+0x5c]` through `0x00570669` and
  `0x00570691`, and dispatches live per-entry objects through slot `+0x3c`; `0x00580bb9` is the
  small auxiliary-handle release helper over the pointer band rooted at `[+0xa8]`; `0x00580bdc`
  is the direct refcount-drop path; `0x00580be8` is the constructor-side owner that stores target
  `[+0x04]`, derives mode byte `[+0x50]`, seeds the fixed scalar triple `[+0x54] = 0x15`,
  `[+0x58] = 0x40`, `[+0x5c] = 0x10`, builds the entry bands, and binds the auxiliary handle
  family rooted at `[+0x6c]`, `[+0x98]`, and `[+0x9c]`; and `0x00580d29` is the primary
  payload-dispatch and layout-style service owner below the `0x0057ae2d/0x0057ae53` wrappers,
  taking the target-service object, caller payload block, five caller arguments, and fixed
  mode-variant flag while using service handle `[+0x6c]` plus external callbacks
  `0x005c81e4/0x005c8248/0x005c824c`,
  and `0x0058123c` is the cache-or-create factory above that strip, walking the same global cache
  root `0x00db89e4` for a matching target, otherwise allocating one `0xb0`-byte object, running
  `0x00580867`, and finishing construction through `0x00580be8`. Immediately below that service
  factory the local container strip is now bounded too: `0x005812b1/0x005812c1/0x005812cf/
  0x0058133d/0x00581371` form the reset, release, push, pop, and status helpers for one growable
  dword-pointer vector, while `0x00581379/0x0058138c/0x005813bd/0x00581470/0x005814a4` do the same
  for the sibling growable string-pointer vector with accumulated byte count at `[+0x10]`, and
  `0x005814ac` is the first owner above that string-vector family, building one newline-joined
  text object from the stored strings. The adjacent object strip is now bounded too:
  `0x00581673/0x005815cf/0x005815dc/0x00581610` are the init, addref, refcount-drop, and release
  wrappers for vtable `0x005e0bd8`, `0x00581594` is the destructor, `0x005815a9` allocates the
  owned text buffer, `0x005815fc/0x00581606` are the direct getters for that buffer and its stored
  length, and `0x0058162c` is the matching `IUnknown` plus custom-IID query gate. The adjacent
  SIMD math strip is now bounded too: `0x00581690` applies the first two basis rows plus
  translation row `[+0x30]` to one XY pair and stores the full vec4 result, `0x005816d0` is the
  projective sibling that scales by a reciprocal derived from lane 3 and returns projected XY, and
  `0x00581730` is the translation-free low-64-bit sibling over just the first two basis rows,
  while `0x00581770/0x00581830/0x005818f0` are the corresponding 3D XYZ helpers for basis-only,
  basis-plus-translation, and projected basis-plus-translation output, `0x005819f0` is the direct
  4D vec4-by-4x4 basis application helper, `0x00581ab0` is the four-row batch sibling over a full
  4x4 source block, and `0x00581c00/0x00581cd0` are the shared normalize-or-zero helpers for vec3
  and vec4 input. One level wider, `0x00581db0` is now bounded as the shared 4x4 inversion helper
  with optional determinant outparam, `0x00582070` is the packed-output batch sibling to the
  earlier four-row 4D basis application helper, `0x005821d0` is a standalone 4D cross-product-like
  helper over three vec4 inputs, `0x00582280` is the unchecked vec4 normalization sibling, and
  `0x00582320/0x005823e0/0x00582470/0x00582520` are the first cubic-basis interpolation helpers
  in the same math strip for vec3, vec2, vec4, and the first alternate-basis vec3 case.
  The same family now extends cleanly through `0x005825e0` and `0x00582680` as the alternate-basis
  vec4 and vec2 siblings, then into `0x00582710/0x00582770/0x005827c0` as the two-scalar affine
  blend helpers computing `p0 + s*(p1-p0) + t*(p2-p0)` for vec3, vec4, and vec2 inputs.
  The next geometry leaves are bounded too: `0x00582820` is the plane-versus-segment intersection
  helper over one plane vec4 and two vec3 endpoints, `0x005828e0` is the standalone 4x4
  determinant helper beside the nearby inversion body, and `0x005829b0` builds one plane vec4
  from three vec3 points by cross product, normalization, and signed-distance writeout. The next
  quaternion strip is now bounded too: `0x00582c30` builds one 4x4 rotation matrix from a
  quaternion-like vec4, `0x00582d10` is the quaternion product helper, and `0x00582da0` is the
  unchecked quaternion-normalization sibling. The adjacent plane-and-quaternion leaves are tighter
  now too: `0x00582aa0` is the shared plane-driven projective 4x4 matrix builder over one plane
  vec4 and one second vec4 input, `0x00582e40` is the quaternion inverse helper that conjugates
  the spatial XYZ lanes and divides by squared length, `0x00582eb0` rebuilds one quaternion from a
  caller 3x3 rotation-matrix block, and `0x00582fd0` builds one quaternion from three caller Euler
  angles by halving them, routing the packed tuple through trig helper `0x0058aa70`, and then
  combining the resulting sine and cosine lanes. The next packed-row sibling strip is now bounded
  too: `0x005830a0` applies one compact 3x3 basis block to one vec3 input, `0x00583160` is the
  translation-bearing vec4 sibling, `0x00583220` is the packed projective vec3 sibling that scales
  by a reciprocal derived from lane 3, `0x00583320` is the packed 4x4 vec4 application helper,
  `0x005833e0` is its four-row batch sibling over a full caller 4x4 source block,
  `0x00583530/0x00583600` are the packed vec3 and vec4 normalize-or-zero siblings of
  `0x00581c00/0x00581cd0`, `0x005836e0` is the packed 4x4 inversion sibling with optional
  determinant outparam, `0x005839a0` is the packed-output batch sibling of `0x005833e0`, and
  `0x00583b00` is the packed-row sibling of the earlier 4D cross-product helper. The same packed
  analogue strip now extends further: `0x00583cc0` is the packed 4x4 determinant sibling,
  `0x00583d90` is the packed three-point plane builder, `0x00583e80` is the packed plane-driven
  projective 4x4 matrix builder, `0x00584010` is the packed quaternion-to-matrix sibling,
  `0x005840f0` rebuilds one quaternion from a packed 3x3 rotation-matrix block, and
  `0x00584210` is the packed Euler-angle-to-quaternion sibling using packed trig helper
  `0x0058ad50`. The lower trig seam is bounded now too: `0x00583bb0` and `0x00583c30` are the two
  single-angle packed axial rotation-matrix variants above the same trig layer, `0x0058ac60` is
  the interleaved packed sine/cosine helper they share, and `0x0058ad50` is the wider packed
  sin/cos vector generator used by the packed Euler-angle-to-quaternion helper. The MMX or 3DNow
  analogue seam is bounded now too: `0x005842e0` is the quaternion-product sibling,
  `0x00584379/0x005843d6` are the vec4 and vec3 normalize-or-zero siblings,
  `0x00584489` rebuilds one quaternion from a 3x3 rotation-matrix block,
  `0x005848ba` is the MMX or 3DNow Euler-angle-to-quaternion sibling using scalar trig helper
  `0x0058b660`, `0x0058497f` is the explicit axis-angle-to-quaternion sibling,
  `0x005849eb` is the core quaternion slerp helper, `0x00584b22` and `0x00584baf` are the next
  two nested-slerp multi-control helpers, `0x00584c41` is the quaternion inverse sibling,
  `0x00584ca5` extracts an axis-angle-style vec4 from one quaternion, and `0x00584d4c` is the
  scaled-axis-to-quaternion sibling. The next broader MMX owner is bounded now too: `0x00584df1`
  takes four caller key quaternions, aligns neighboring keys onto a common hemisphere, converts the
  two relative deltas around each interior key through the already-grounded inverse and
  axis-angle-style helpers, averages those tangent-like terms, exponentiates back into quaternions,
  and multiplies by the interior keys to write two inner spline-control quaternions. The immediate
  plane-and-matrix seam after that is tighter now too: `0x00585b4b` is the row-major MMX
  translation-matrix constructor, `0x00585b9b` is the MMX sibling to the shared plane-driven
  projective 4x4 matrix builder, `0x00585c86` is the paired plane-reflection matrix helper, and
  `0x0058a988` is the shared normalize-by-XYZ-length helper beneath those plane-driven bodies, while
  `0x0058a8ca` is the MMX origin-plane-versus-segment intersection sibling and `0x0058a9ec` is the
  MMX 4D vec4-by-4x4 basis application sibling. The immediate matrix seam after that is bounded
  too: `0x00585d62/0x00585dc5/0x00585e23` are the three single-angle MMX axial 4x4 rotation-matrix
  variants, `0x00585e7c` is the MMX diagonal scale-matrix constructor rather than a translation
  helper, `0x00585ec3` is the small 4x4 transpose or repack helper, `0x00585f32` is the MMX
  identity-matrix constructor, and `0x00585f6b/0x0058603d` are the two MMX quaternion-to-4x4
  rotation-matrix variants. The adjacent broader matrix owner beneath that constructor strip is
  bounded too: `0x0058584a` is the non-alias-staging MMX 4x4 multiply sibling that repacks one
  split-qword matrix to temporary contiguous rows before multiplying it through the second caller
  matrix, `0x00585a7c` is the scalar determinant helper for the upper 3x3 basis of the same
  split-layout 4x4 matrix family, `0x005860f2` is the broader affine-transform owner that builds
  one matrix from optional base translation, base rotation, pivoted post-rotation, and trailing
  translation-delta inputs, `0x0058728a` is the adjacent three-angle rotation-matrix builder that
  uses half-angle trig rather than the single-angle strip, `0x0058742f` is the uniform-scale
  sibling that adds one optional pivoted quaternion rotation and one trailing translation delta,
  `0x00587963` is the axis-angle rotation-matrix sibling over a normalized axis vec3 plus one
  caller angle, and `0x00587a7c` is the broader shared transform owner that supports one base
  translation, up to two optional pivoted quaternion rotations, and one trailing translation delta.
  One lower MMX sibling strip is bounded now too: `0x005895fa` is the
  3D basis-plus-translation-to-vec4 sibling of `0x00581830`, `0x0058966b` is the basis-only vec3
  sibling of `0x00581770`, `0x005896d2` is the vec3 normalize-or-zero sibling of `0x00581c00`, and
  `0x00589731` is the two-scalar affine vec3 blend sibling of `0x00582710`. The next MMX
  interpolation strip is bounded too: `0x005897a2` is the cubic-basis vec3 sibling of
  `0x00582320`, `0x00589876` is the alternate-basis vec3 sibling of `0x00582520`, `0x00589960` is
  the projective 3D basis-plus-translation sibling of `0x005818f0`, `0x005899eb` is the four-row
  4D basis application sibling of `0x00581ab0`, and `0x0058a1aa` is the cubic-basis vec2 sibling
  of `0x005823e0`. The remaining low-dimensional MMX strip is bounded now too: `0x0058a0b8` is the
  2D basis-plus-translation-to-vec4 sibling of `0x00581690`, `0x0058a10d` is the basis-only vec2
  sibling of `0x00581730`, `0x0058a146` is the projective 2D sibling of `0x005816d0`,
  `0x0058a242` is the affine vec2 blend sibling of `0x005827c0`, `0x0058a28b` is the vec2
  normalize-or-zero sibling, `0x0058a2ce` is the alternate-basis vec2 sibling of `0x00582680`,
  `0x0058a379` is the duplicate-layout 4D vec4-by-4x4 basis application sibling, `0x0058a3fb` is
  the four-lane normalize-or-zero sibling, `0x0058a45a` is the MMX 4D cross-product sibling of
  `0x005821d0`, `0x0058a58c` is the affine vec4 blend sibling, `0x0058a5fd` and `0x0058a6c5` are
  the cubic and alternate-basis vec4 siblings of `0x00582470` and `0x005825e0`, `0x0058a7a3`
  builds one plane vec4 from a normal vec3 plus point, and `0x0058a7e6` is the three-point plane
  builder sibling of `0x005829b0`. The broader MMX matrix seam just above those leaves is bounded
  now too: `0x00588eb2` is the alias-safe packed 4x4 multiply owner over two caller matrices,
  `0x00588bd0` and `0x005892aa` are the two broader MMX 4x4 inverse helpers with optional
  determinant output, `0x005895de` is the thin FEMMS wrapper over `0x005892aa`, `0x00589bb2` is
  the tiny thunk into the projective vec3 apply helper `0x00589960`,
  `0x00589bb7` selects identity or the ordered composition of up to three optional 4x4 inputs
  through `0x005899eb`, applies the resulting chain through `0x00589960`, and optionally remaps
  the normalized result into one caller integer viewport-style range block, `0x00589d3f` is the
  inverse-side sibling that composes the same optional chain, inverts it through `0x005892aa`,
  optionally maps one caller integer viewport-style coordinate triple back into normalized
  projective space, and then applies the inverse chain through `0x00589960`, and `0x00589f67` is
  the adjacent inverse-projective sibling that uses alternate inverse helper `0x00588bd0` before
  the same viewport-normalize and projective-apply tail. The scalar trig roots beneath the
  quaternion side are bounded now too: `0x0058af80` is the shared scalar `atan2`-style angle
  worker, `0x0058b080` is the shared scalar arccos-style angle worker, `0x0058b180` is the
  adjacent alternate arccos-style branch, `0x0058b280` and `0x0058b380` are the scalar natural-log
  and base-10-log helpers, `0x0058b3a0` is the scalar natural-exponential helper, `0x0058b480`,
  `0x0058b4a0`, `0x0058b4c0`, and `0x0058b500` are the scalar square-root, absolute-value,
  ceil-style, and floor-style helpers, `0x0058b540` and `0x0058b580` are the adjacent
  `frexp`-style split and `ldexp`-style scale helpers, `0x0058b5de` and `0x0058b600` are the
  compact `modf`-style split and `fmod`-style remainder helpers, `0x0058b660` returns one
  cosine/sine-style lane pair from one caller angle,
  `0x0058b780` is the paired scalar sine-lane helper used when callers only need that one branch
  duplicated, and `0x0058b9e0` is the broader scalar `pow(x, y)` owner that stitches the adjacent
  log and exponential strips back together. After that point the strip stops looking like separate
  command leaves and turns back into broader owner bodies. The next adjacent command leaves are
  bounded the same way:
  `shell_command_dispatch_scenario_followon_0x437d70_if_active` `0x00441340` is a guarded hop into
  the real cheat-code owner `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats`
  `0x00437d70`. That owner increments the shared shell counter at `[0x006d401c+0xc60]`, opens the
  localized cheat prompt `2922` `Do I detect a cheater in the house?\n\nEnter code (or <ESC> to
  cancel):`, and then scans the fixed 26-entry table at `0x005ee2c8`. The active selector strip is
  now grounded: winner/loss strings `3618/3619/3620/3622` route through `0x004367c0`, selector `1`
  jumps to the out-of-line reset branch at `0x004d676c` that clears the selected-company stat bands
  rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`, selectors `2` and `3`
  post deltas into the selected company and selected chairman profile through `0x0042a080` and
  `0x00476050`, selector `4` resolves one locomotive by primary or alias stem through
  `0x00461c00` and applies it to every selected-company train through `0x004aefb0`, selector `5`
  forces territory-access byte `1` across the live territory table through `0x00424030`, selector
  `7` now reads more tightly as the train-crash branch because `0x004ad7a0(1)` is also the direct
  shell-command owner behind the `365` warning `There is no train available to crash!`, and
  selectors `6/8/9/10` toggle bytes `[state+0x4c8f/+0x4c8e/+0x4c8d/+0x4c8c]`. The same table also
  contains the later cheat labels
  `3634` `Orca` and the alias-only tail `Katie..Seymour`, but those rows currently sit above the
  visible jump-table bound `0x0a`, so the safest static read is that they are unreached or handled
  elsewhere rather than active cases in this owner. By contrast
  `shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0` `0x00441360`
  requires the same single-profile gate, resolves one subject through `0x0040b2d0(0, 1)`, and then
  forwards that result into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`.
  The neighboring current-train command strip is bounded now too. Shared helper `0x00441790`
  resolves either the currently focused world-view train or one fallback train, but only keeps it
  when the owner company matches the current scenario-selected company. On top of that resolver,
  `0x00441810` is the direct `Current train crashes` command: it opens localized warning `365`
  when no owned train survives, otherwise it forwards the train into the crash owner
  `0x004ad7a0(1)`. `0x004418a0` is the paired `Current train breaks down` command with the same
  gate and warning `366`, but it forwards into the named breakdown owner `0x004ada00(1)`.
  `0x00441870` is the simpler `Current train whistles` command, which resolves the same owned train,
  finds the train-side visual owner through `0x004a77b0`, and writes request dword `1` into
  `[owner+0x33a]`. The immediately adjacent helper strip is bounded now too: `0x004a77d0` is a
  tiny two-float query over the same linked route object, defaulting both caller outputs to `10.0f`
  when `[train+0x41]` is empty and otherwise tail-calling the lower linked-route metric helper
  `0x0041add0`; and `0x004a7810` is the neighboring linked-route row-band refresh that walks
  `[route+0x316]` / `[route+0x31a]`, treats literal `steam` emitter definitions specially through
  `effect_name_matches_literal_steam` `0x004749a0`, and flips row byte `[row+0x1d8]` accordingly.
  The shell command strip on the other side is tighter too: `0x00441900`, `0x00441940`,
  `0x00441980`, `0x004419c0`, and `0x00441a00` are the five repeated `Overview.win` page toggles
  over detail-manager mode `9`, each closing the current page through
  `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when that exact page is already
  active and otherwise requesting mode `9` with page ordinals `0..4`.
  `shell_station_list_format_freight_and_express_availability_summary` `0x00506e50` feeds the
  station-list summary `%1 has %2 freight loads and %3 express loads available for hauling...`, and
  the paired modifier helper `shell_station_list_handle_center_or_rename_action` `0x00506d50` owns
  the visible Shift-center and Ctrl-rename row actions. The list owner itself is tighter now too:
  `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30` is the real
  `StationList.win` row and status refresh pass, clearing and repopulating controls `0x61a9` and
  `0x61aa`, wiring the visible summary and modifier callbacks, mirroring the shared selected-station
  latch at `[0x006cec78+0x4cba]` when it still belongs to the current company, and updating the two
  status labels `0x61af` and `0x61b0`. The row-side callout lane is tighter too:
  `shell_station_list_row_callback_publish_station_callout_card` `0x00506ac0` is the actual
  row callback beneath both list controls, resolving the selected station, deriving one category
  header through `0x0053de00` and `0x00552560`, and then publishing the station-name plus freight
  and express callout card through repeated `shell_publish_text_callout_presentation` calls. The
  side-selector branch is tighter too:
  `shell_station_list_window_handle_message` no longer just re-enters the raw `StationPick.win`
  constructor. It flips the active side bit at `0x006d1710` and then re-enters the modal helper
  `shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`, which
  allocates one helper window, runs `shell_station_pick_window_construct` `0x00507620`, brackets the
  modal show path, and returns the staged selected station id from `0x00622ae8`. Inside that helper
  family, `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event`
  `0x005075c0` now bounds the small message-normalization strip beneath controls `0x80e8..0x80ea`.
  The Shift-center side is tighter now too:
  the shared helper `0x00433900` takes one object pointer plus one small mode, derives one
  mode-specific `(distance,height)` preset from the target's virtual classification, and then
  re-enters `0x0043c9a0` to center the live world view on that object. The report side is clearer
  as well:
  `0x004d3060` is the dedicated `Stats - Trees` constructor over `map_editor_tree_stats_report`,
  `0x004d3080` is the actual `General Validation` constructor over
  `map_editor_general_validation_report`, and the same page table also now grounds `Stats - Cargo`,
  `Stats - City/Region`, `Stats - City Count`, `Event Variable Values`, and the neighboring
  event-validation page. The remaining open editor edge is therefore mostly the deeper gameplay
  meaning of those site-side service scores and flag bits, not page ownership.
--- a/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md
+++ b/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md
@ -0,0 +1,423 @@
 # Input, Save/Load, and Simulation: Event Editors, CompanyDetail, and LoadScreen
 ### Event Editors and Scenario Action Windows
 The event side is tighter too:
  that `0x00433130` pass in turn materializes each live event record through
  `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. Current shell-side xrefs
  now tighten that event branch too: the first rebuilt linked row family under `0x0042db20` aligns
  with the standalone condition list later queried by `EventConditions.win`, while the second
  rebuilt family aligns with the four grouped effect lists later deep-copied through
  `scenario_event_clone_runtime_record_deep_copy` `0x0042e050` during event duplication and effect
  staging. The condition side is tighter now too: the tiny helper cluster
  `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is no longer just "some adjacent list scans".
  Current evidence bounds it as four predicates over the standalone `0x1e`-row condition list,
  testing class bits `0x01`, `0x02`, `0x04`, or any of those bits in the static table
  `0x005f3e04 + id*0x81`, with special fallback checks through event fields `[event+0x7f9]`,
  `[event+0x7fa]`, and `[event+0x7f0] == 0x63`. The shell side is tighter too: vtable slot
  `0x005d0cd8` now binds `shell_event_conditions_window_handle_message` `0x004d59e0`, and vtable
  slot `0x005d0cf8` binds `shell_event_effects_window_handle_message` `0x004d7060`. The effects
  side is tighter too: the lower helper trio is no longer anonymous. `0x004d5d00` now reads as the
  effect-type selector refresh under control family `0x4fb2`, `0x004d5f50` reads as the selected
  effect parameter-row repaint, `0x004d6090` is the heavier staged-effect editor refresh over the
  `0x4fc7/0x4fce/0x4ff6/0x4ff9/0x4ffc/0x5041/0x5044/0x5046/0x5047` bands, and `0x004d67f0`
  commits the current editor state back into the staged effect row at `[this+0x78]`. The verb side
  is tighter now too: `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0` and
  `shell_open_event_effects_modal_and_return_result` `0x004d9e40` are the shared modal openers
  above the two editor windows; `0x004da640`, `0x004da700`, and `0x004d9ed0` now read as the add,
  edit, and remove verbs for standalone condition rows; `0x004da7c0`, `0x004da860`, and
  `0x004da920` are the matching add, edit, and remove verbs for grouped effect rows; and
  `0x004d8120` is now the heavier condition-row list panel refresh those condition-side verbs
  re-enter after mutation. The conditions-side refresh split is tighter too: `0x0042d700`
  aggregates standalone condition-list class or modifier flags, `0x0042d740` aggregates grouped
  effect-row type flags for one selected grouped list, `0x004d9970` owns the condition-class
  summary and grouped-row status bands, `0x004d77b0` owns the grouped summary-band affordance gate
  for `0x4fed..0x4ff0` when selector `0x5000` lands on `0x5002`, `0x004d9d10` owns the smaller
  grouped-effect territory-target affordance on control `0x500b`, `0x004d9f50` owns the selected-event mode
  strip and summary text panels, and `0x004d9390` is the mode-dependent detail-row switch beneath
  that strip. `0x004da0f0` is tighter too: selector `0x5001` now has the strongest current
  RT3.lng fit as the condition-side `Test against...` mode above `0x004d9970`, while selector
  `0x5002` has the strongest current fit as the grouped-effect-side `Apply effects...` mode.
  That `0x5002` branch now clearly builds control `0x5014` from RT3.lng `1160..1164` as `to the
  company/player/player (i.e. chairman)/territory for which the condition is TRUE` before
  enabling the adjacent `0x5005`, `0x500a`, and `0x5014..0x501c` family. The strongest current
  RT3.lng fit for the remaining visible target-scope strip is now `0x5015 = to the whole game`,
  `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories`, and
  `0x501a..0x501c = to all/human/AI players`; the grouped effect-row type mask matches that split
  directly through bits `0x08`, `0x01`, `0x04`, and `0x02`. The
  selected-event strip is tighter now too: `0x004db120` is the broader selected-event repaint and
  navigation refresh above those smaller helpers, `0x004db520` and `0x004db5e0` are the previous
  and next selected-event stepping verbs, `0x004db8b0` is the add-or-clone event modal helper,
  `0x004dba90` is the rename verb, `0x004d9360` is the delete verb, `0x004db6a0` is the live
  selected-event id setter behind control `0x4e84`, and `0x004db6f0` is the callback-binding plus
  pending-selection bootstrap path that seeds the strip during window bring-up. The larger
  dispatcher at `0x004dbb80` now makes the strip explicit: `0x4e85..0x4e8a` are previous, next,
  add blank, clone selected, rename, and delete event, while the later grouped band commits current
  summary state through `0x004d8d50` before changing grouped selector `[this+0x9c]` via `0x004dbf93`.
  The selection bootstrap side is tighter too: `0x004daf40` is now the placeholder reset helper for
  the selected-event summary controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`.
  The grouped target-scope side is tighter too: `0x004d8ea0` now reads as the commit helper for current
  selected-event text panels before selection or grouped-action changes, `0x004d8d50` now records
  the hidden selector family `0x5006..0x500e -> 0..8`, and `0x004dab60` projects that ordinal
  one-to-one onto the visible grouped-effect target-scope display strip `0x5014..0x501c`. That
  split is firmer now: `0x5006..0x500e` are the canonical hidden selectors that get stored into
  `[event + group + 0x7fb]`, while `0x5014..0x501c` are the visible mirror rows republished from
  that same ordinal rather than a second independently named selector family. The grouped row and
  stored-summary refresh side is tighter too: `0x004d88f0` is now the selected grouped-effect
  row-list renderer for `0x4ed5`, formatting the grouped `0x28`-byte rows through RT3.lng
  `1154..1159`, and `0x004da9a0` is the current grouped-summary-state republisher that reloads
  `0x500a`, `0x500b`, and visible action selection `0x5014..0x501c` from `[event + group + ...]`
  before tailing back into `0x004da0f0`,
  `0x004dbfca` as the grouped target-scope mode selector that persists the chosen control id into
  `0x00622074`, with `0x5001/0x5002` now strongest-fit as `Test against...` and
  `Apply effects...`, `0x004dbeeb` as the pending shared summary-text triplet publish helper for
  `0x4eac/0x4ed9/0x4edb`,
  `0x004d91e0` as the selected-event summary-header and grouped-mode commit helper above
  `0x004d8d50`, and `0x004dbe7a` as the narrower `0x4ec6/0x4ec7` choice-event single-player-only
  warning modal branch rooted at RT3.lng `3887`. The remaining gaps on
  this lane are narrower again because the grouped-band `0x4dc09c` table now closes one earlier
  overclaim: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into
  `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` only route to the smaller
  `0x004d9d10` affordance path and the rest of `0x4ff1..0x5013` are default no-ops. The open
  question is therefore no longer whether those visible target-scope rows are direct selector verbs;
  current evidence says they are not.
  The local slot records are rooted at
  `[world+0x69d8]`,
  `[slot+0x01]` polarity and the external role gate at `[world+0x0bc3+slot*9]` are now grounded, and
  `[slot+0x03]` now looks like the distinguished primary-human-seat marker because current grounded
  writes seed it only on slot zero and later logic moves it solely by whole-record compaction. The
  open question is no longer whether the seeded trio lands in the visible shell company roster;
  current evidence says it does, and ordinary `Start New Company` now looks like a fresh-company
  allocator through `start_new_company_dialog_commit_create_company` and
  `start_new_company_request_create_company`, not like the path that claims one of the seeded named
  railroads. The immediate post-roster station branch is now clearly separate: current grounded
  resource names and handlers put mode `8` on `StationDetail.win`, mode `5` on `StationList.win`,
  and the subordinate modal selector helper on `StationPick.win` through
  `shell_station_pick_window_open_modal_and_return_selected_station_id` above
  `shell_station_pick_window_construct`. The company-side ownership question has therefore moved
  down a layer rather than staying open. We now have a recovered `CompanyDetail.win`
  owner family through `shell_company_detail_window_refresh_controls`,
  `shell_company_detail_window_construct`, and `shell_company_detail_window_handle_message`; the
  same owner now has one broader bounded read-side lane too, because control `0x9470` uses
  `shell_company_detail_render_financial_history_panel` to draw the five-step Revenue or Expenses or
  Interest or Profit or Lifetime strip, sibling control `0x9471` reuses
  `shell_format_company_financial_summary_card` through
  `shell_company_detail_render_company_summary_card`, controls `0x947d` and `0x947e` now ground a
  bond maturity and repay panel through `shell_company_detail_render_bond_maturity_and_repay_panel`,
  control `0x9488` now grounds the debt or credit or rate summary block through
  `shell_company_detail_render_debt_credit_and_rate_summary_panel`, control `0x948a` now grounds the
  share-value and dividend-payout block through
  `shell_company_detail_render_share_value_and_dividend_summary_panel`, while the broader six-row
  per-share stock-data family is now bounded under `shell_format_company_stock_data_panel`, and the
  adjacent territory selector lane is bounded through
  `shell_company_detail_select_territory_access_row`,
  `shell_company_detail_render_territory_access_row`,
  `shell_company_detail_sync_selected_territory_from_picker`, and
  `shell_company_detail_refresh_selected_territory_access_summary`; the first finance-action layer
  beneath it is bounded through the bond, stock-issue, stock-buyback, and dividend-rate helpers; the
  territory-access side is bounded too through
  `shell_company_detail_refresh_selected_territory_access_summary`,
  `shell_company_detail_buy_territory_access_rights_flow`, and the underlying company access-rights
  helpers; and the full takeover and merger vote-result lane is now grounded through
  `shell_resolve_chairmanship_takeover_vote_and_commit_outcome`,
  `shell_present_chairmanship_takeover_vote_outcome_dialog`,
  `shell_resolve_merger_vote_and_commit_outcome`, and `shell_present_merger_vote_outcome_dialog`.
  The remaining company-side uncertainty is therefore narrower than before: the broader support and
  valuation side is now tighter too because
  `company_compute_cached_recent_per_share_performance_subscore`,
  `company_compute_five_year_weighted_shareholder_return`, and
  `company_compute_public_support_adjusted_share_price_scalar` bound the recent per-share
  performance and investor-support/share-price blend beneath those vote resolvers; the recent
  per-share feeder now has a grounded four-lane tail too, with current partial-year weight
  `(5 * [world+0x0f]) - 5`, prior full-year weights `48/36/24/12` on `0x1f/0x1e`, dividend
  non-decline pair weights `9/8/7/6` on `0x20`, lane weights `40/10/20/30`, the startup age ramp
  `0/0/0/100 -> 25/25/35/100 -> 50/50/65/100 -> 75/75/85/100 -> 100/100/100/100`, a strongest-lane
  `*1.25` boost, a weakest-lane `*0.8` reduction, and separate bounded-intermediate versus final
  difficulty applications under `0x005f33b8`; the next consumer `0x00424fd0` is also tighter now,
  with the young-company interpolation against `[company+0x57]`, caller pressure clamped to
  `[-0.2, 0.2]`, one `(shares / 20000)^0.33` share-count growth term, and the later threshold
  ladder `0.6 / 0.45 / 0.3 / 1.7 / 2.5 / 4.0 / 6.0` before the issue-`0x37` multiplier,
  `scenario_state_compute_issue_opinion_multiplier` now bounds the
  next layer of optional company, chairman, and territory-specific opinion overrides on the active
  scenario state, and the broader stat-reader family around
  `company_read_control_transfer_metric_slot` and
  `company_read_year_or_control_transfer_metric_value` is no longer just a merger-premium helper.
  Current grounded callers show the same metric family feeding the annual shareholder-revolt and
  creditor-liquidation lane surfaced by localized ids `300..304`, while the debt-side shell and
  bond lane now separately close `0x38` as `Credit Rating` and `0x39` as `Prime Rate`. That means
  the remaining gap is now mostly gone on the UI side too: issue `0x37` is already bounded to the
  same investor-confidence family as the equity-support and governance-pressure paths, and current
  grounded UI evidence still stops at the investor-attitude sentence family rather than one
  standalone caption. The calendar side is tighter now too:
  `[world+0x15]` is the absolute counter for the same mixed-radix `12 x 28 x 3 x 60`
  year-plus-subfield tuple packed by `0x0051d3c0` and unpacked by `0x0051d460`, not just a vague
  “calendar-like” blob. The `TrackLay.win` family now clearly owns `Lay single track.` `Lay double track.`
  and `Bulldoze` as its three primary modes, its bridge selector, its wrapped frequency preferences,
  and a strongly aligned pair of `Auto-Hide Trees During Track Lay` and `Auto-Show Grade During
  Track Lay` toggles; the `StationPlace.win` family now clearly owns its six top-level category
  buttons, the station-style scroller, and the station-rotation controls. The older `Building
  placement center` string 671 no longer looks like a live StationPlace control label in the current
  recovered flow, because the active constructor, preview, refresh, and dispatcher paths all use
  neighboring ids such as 669 and 2208 without a direct recovered lookup of 671. On save or load the
  broad serialize-versus-restore split is now grounded, the non-Quicksave `.gmp/.gmx/.gmc/.gms`
  families are separated, and the auxiliary `.gmt` path is at least bounded to the preview-surface
  side owner. The higher-value shell-facing gap has therefore shifted upward to the remaining
  semantics of the post-load generation phases, the later recurring structure-population cadence,
  the deeper vote-weight formulas inside takeover and merger resolution, and the still-open meaning
  of the packed simulation calendar tuple.
 ### CompanyDetail and Section Ownership
 The shell detail family now has an explicit
  section-selector lane in addition to the read-side panels already mapped. Controls
  `0x9472..0x9475` directly select the four visible CompanyDetail sections through `0x006cfe60`,
  `0x9476..0x9479` are the companion visual controls for that same tab strip, and section `0` is now
  bounded more tightly as the chairman or governance slice around the portrait-backed chairman band
  on `0x9480` plus the dynamic overview widget `0x947f`. That widget is no longer just a vague
  status line: the section-0 refresh binds it through a dedicated stack-built dynamic text path,
  and the strongest current shared formatter candidate is
  `shell_format_company_governance_and_economy_status_panel` at `0x004e5cf0`, which first renders a
  five-line company-metric preamble through localized ids `1211..1215`: `Revenues` from slot
  `0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load
  mile` from the derived `slot 0x2c / slot 0x17` branch, and `Average speed` from slot `0x26`
  rendered through `1216` `%1 m.p.h.`. It then splits the governance summary more concretely: no
  linked chairman emits `3045`, wholly owned companies emit `3046` for the scenario-selected
  chairman or `3047` for another linked chairman, and investor-owned companies emit the
  investor-attitude lines `3048/3049` with one adjective from the table at `0x00622170`. That
  branch is no longer using unnamed helpers either: `company_get_linked_chairman_profile_record`
  `0x00426ef0` resolves the linked chairman profile and `chairman_profile_owns_all_company_shares`
  `0x004768c0` is the full-ownership test behind the `3046/3047` split. The salary side is tighter
  too: the formatter computes one signed delta from `[company+0x14f]` and `[company+0x0d59]`, then
  chooses `3050..3052` for the scenario-selected chairman or `3053..3055` for another linked
  chairman depending on whether that delta is negative, positive, or zero. The bonus line is
  narrower still: it only appears when the display year matches `[company+0x34f]`, using amount
  `[company+0x353]` with `3056` or `3057`. It then appends the
  `1218` `Economy status - %1.` tail caption and stages the adjacent selected-company report or
  list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`,
  `1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`,
  `1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`.
  Current evidence still does not recover separate `CompanyDetail.win` action controls for that
  strip under `shell_company_detail_window_handle_message`, so it currently reads as staged
  overview text or help content rather than as a closed launcher family. The direct `0x947f`
  formatter call is still indirect, but the widget boundary is tighter too: the generic shell
  helpers `shell_control_refresh_matching_dynamic_text_payload` `0x00540a47` and
  `shell_control_release_dynamic_text_payload` `0x005639d2` now show that type `0x6f` controls
  free or swap one heap-backed text payload and then short-circuit as a special dynamic-text case,
  which strengthens the reading of `0x947f` as a display-only overview widget rather than a normal
  callback control. One adjacent boundary is tighter now too: the broader overview wrapper at
  `shell_render_company_overview_panel_header_and_optional_change_affordance` `0x004e5a80` owns
  the fallback no-company texts `1210`, `3043`, and `3888`, styles controls `0x3f06` and `0x3f07`,
  and on the narrower selected-company branch appends `3044` `Click to change company name and
  logo.` plus the neighboring `1941` `Change` affordance before falling through into the shared
  `0x004e5cf0` text body. That keeps the name/logo affordance outside the ordinary
  `CompanyDetail.win` action dispatcher and makes the `0x947f` alignment cleaner. The message-side
  action band is tighter too: `0x94b5` grounds
  territory-access purchase, `0x94b6` grounds bankruptcy, `0x94cf..0x94d2` ground bond issue, stock
  issue, stock buyback, and dividend-rate changes, `0x9493` routes into the destructive
  company-clear helper that deactivates the selected company and clears chairman/share links,
  `0x94d6` grounds bankruptcy, `0x94d7..0x94da` ground bond issue, stock issue, stock buyback, and
  dividend-rate changes, `0x94db` grounds merger, `0x94dc` grounds resignation, and `0x9538` grounds
  chairmanship takeover. The finance-side dialog family is tighter too: the bond-issue lane now has
  the dedicated modal renderer `shell_company_detail_render_issue_bond_offer_dialog` `0x004c3560`
  for underwriter terms `968..972`, the stock-issue lane has
  `shell_company_detail_render_issue_stock_offer_dialog` `0x004c3b50` for the staged offer lines
  `975..978`, and the buyback lane has
  `shell_company_detail_render_stock_buyback_offer_dialog` `0x004c4300` for broker lines
  `981..984`. The compact summary card on sibling control `0x9471` is tighter too:
  `shell_format_company_financial_summary_card` at `0x004bfb30` now clearly renders `Cash:`,
  `Revenue:`, and `Profits:` from company slots `0x0d`, `0x2c`, and `0x2b`, rather than one looser
  unnamed finance block. The dividend lane is now split the same way:
  `shell_company_detail_setup_dividend_rate_adjust_controls` `0x004c4c70` binds the paired adjust
  controls `0x99e8` and `0xc0f9`,
  `shell_company_detail_render_change_dividend_rate_dialog` `0x004c4e30` renders localized ids
  `988..990`, and
  `shell_company_detail_handle_change_dividend_rate_dialog_message` `0x004c5140` clamps the staged
  dividend rate against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260` and
  raises localized id `991` when the board refuses a higher dividend, all before the existing
  company commit path. All four finance verbs now converge through the shared
  callback-driven modal opener `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, which
  is also reused by the multiplayer staged text-entry lane. The front controls in section `0` are
  tighter too: `0x948b` is a
  tutorial-guarded escape or back control that shows localized id `3724` `This option is disabled in
  the tutorial.` before falling back to the shell detail-manager escape path, `0x9491` and `0x9492`
  only restyle the paired visuals `0x948f` and `0x9490`, and `0x9494` opens localized id `3635`
  `Enter the amount that your company's cash should be` and writes the accepted value directly into
  the selected company cash pair. The neighboring debt section is tighter now too: controls
  `0x947d` and `0x947e` no longer read as one-off bond widgets, but as the owners of two repayable
  bond-slot row bands, `0x94e8..0x950f` and `0x9510..0x9537`. Those row controls now clearly
  converge on the same repayment path in the message dispatcher: they reject unaffordable repayment
  through localized id `2990`, open the early-repayment confirmation rooted at `2991`, and then
  either commit through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70` or package
  the request through the multiplayer shell transport. The render-side owner is tighter too:
  `shell_company_detail_render_bond_maturity_and_repay_panel` formats `Due %1` and `Repay this
  bond.` for the selected debt slot while the tiny binder
  `shell_company_detail_bind_bond_row_band_for_active_panel` switches between the two row bands.
  Current `0xcb` dispatch does not treat `0x948f`, `0x9490`, `0x94d4`, or `0x94d5` as standalone
  action cases. The message-side jump table now makes that passive/action split explicit too: in the
  dispatch byte map rooted at `0x004c6640`, controls `0x94d6..0x94dc` map to cases `0x06..0x0c`,
  control `0x9538` maps to case `0x0d`, and the neighboring companion rows `0x94d4` and `0x94d5`
  stay on the default path. The refresh-side ownership is tighter too: the helper now explicitly
  loops over `0x94d4..0x9537` as the selected-company-owned band and over `0x9538..0x959b` as the
  linked-chairman-owned band, and those two loops do not use the same style polarity.
  `0x94d4..0x9537` take style `0x65` when the selected company matches the scenario-selected
  company and `0x87` when it differs, while `0x9538..0x959b` take style `0x87` when the selected
  company's linked chairman matches the scenario-selected chairman and `0x65` otherwise. The
  selected-company action side
  is tighter now too: scenario toggle `0x006cec78+0x4a8f` re-enables bankruptcy `0x94d6` together
  with passive companion row `0x94d4`, `+0x4a8b` re-enables issue bonds `0x94d7` together with
  passive companion row `0x94d5`, `+0x4a87` re-enables stock issue and stock buyback
  `0x94d8..0x94d9`, `+0x4a93` re-enables dividend `0x94da` together with the same passive
  companion row `0x94d5`, `+0x4adb` re-enables merger `0x94db`, `+0x4acb` re-enables resignation
  `0x94dc`, and `+0x4acf` re-enables chairmanship takeover `0x9538`. That makes `0x94d4/0x94d5`
  read more like passive companion or heading widgets than hidden verbs. The constructor boundary
  is tighter too: current `CompanyDetail.win` setup still only binds explicit callbacks for
  `0x9470`, `0x9471`, `0x947d`, `0x947e`, and `0x948c..0x948e`, not for the wider section-0 row
  bands. That keeps the remaining `0x94d4..0x959b` content looking more like resource-defined
  display rows that are gated and restyled by refresh than like individually code-rendered widgets.
  That leaves the main remaining CompanyDetail-specific shell edge at the exact `0x947f` formatter
  binding plus the still-unsplit render-side governance rows inside `0x94d4..0x959b`.
 ### Adjacent LoadScreen.win Report Family
 The neighboring shell lane around controls
  `0x3ef6..0x4073` is now separated from `CompanyDetail` instead of being treated as one more
  extension of the `0x947f` overview path. The real outer owner is
  `shell_load_screen_window_construct` `0x004ea620`, which binds `LoadScreen.win`, randomizes the
  `LoadScreen%d.imb` background family, stores the singleton at `0x006d10b0`, and seeds the first
  visible page-strip controls. Above the older page-specific work, the real message owner is now
  `shell_load_screen_window_handle_message` `0x004e3a80`: it owns page id `[this+0x78]`,
  page-local substate `[this+0x7c]`, page-kind `[this+0x80]`, current company `[this+0x88]`,
  current chairman profile `[this+0x8c]`, display year `[this+0x9c]`, and the page-local report
  row latch `[this+0x118]`, then fans back into the shared selector
  `shell_load_screen_select_page_subject_and_refresh` `0x004e2c10`, the company-step helper
  `0x004e3a00`, and narrower page branches such as `0x004e45d0`. The matching render-side owner is
  now bounded too: `shell_load_screen_render_active_page_panel` at `0x004ea060` formats the common
  heading and panel frame, then switches on page id `[this+0x78]` and hands control down into the
  active page body. That older branch is now demoted to what it actually is:
  `shell_load_screen_profile_stock_holdings_page_handle_message`, the page-specific handler beneath
  the stock-holdings slice. Inside that same family,
  `shell_load_screen_render_profile_stock_holdings_summary_panel` at `0x004e5300` grounds the
  selected-profile holdings page: it resolves the current chairman profile from `[this+0x8c]`,
  renders the top summary rows `1204` `Stock Value:`, `1205` `Total Assets:`, and
  `1206` `Stock Holdings:`, then walks the active company roster and formats one row per positive
  holding through `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`,
  falling back to `1209` `None` when no positive holdings survive. It also appends `3029`
  `Click to change player name and portrait.` plus the adjacent `1941` `Change` affordance only
  when the rendered profile matches the scenario-selected chairman. The earlier pages are tighter
  now too: `0x004e68e0` is the selected-company financial ranking page using the active company
  roster plus `1235..1245` for revenue, profit, cash, track mileage, and report affordances; and
  `0x004e6ef0` is the active-chairman wealth ranking page using the chairman profile collection
  plus `1237`, `1241`, `1246..1250` for cash, stock, total, and purchasing-power style comparisons.
  The later sibling renderers are broader than that one holdings page now too: `0x004e7670` is the
  selected-company train list page using `1235..1267`, `0x004e8270` is the selected-company
  building list page using `1268..1278`, `0x004e8bb0` is the selected-company station list page
  using `1279..1288`, and `0x004e9460` is the map-wide cargo list page using `1289..1298` over the
  live candidate collection rather than one company roster. The last broad early-page owner is
  tighter now too: `0x004e9b20` is the shared multi-year company report-table renderer for page
  `4` `Income Statement`, page `5` `Balance Sheet`, and page `6` `Haulage Report`, all driven from
  `0x004ea060` with one caller-supplied mode byte and yearly company rows built through
  `company_read_year_or_control_transfer_metric_value`. The row families are bounded too:
  income-statement rows `1301..1315`, balance-sheet rows `2816` and `1317..1322`, and
  haulage-report rows `1323..1335`. The only special rows inside that family are now tighter too:
  `0x00425880` and `0x004258c0` provide the negative-cash and positive-cash interest-rate inserts
  for the `%1/%2` placeholders in strings `2815` and `2816`, so they are no longer anonymous
  private math blobs. The adjacent early siblings are tighter now too: `0x004e5130` is the
  selected-company `Stock Data` page wrapper that falls back through `1299` and otherwise reuses
  `0x004c0160` to render the `Largest Shareholders`, `Shares`, and `Per Share Data` family;
  `0x004e6ef0` is the `Player List` page; `0x004e5300` is the `Player Detail` holdings page; and
  `0x004e51ea` is the `Game Status` briefing panel that pulls current scenario briefing text from
  the live scenario text store and appends the `1772/1773` `Briefing` affordance. The active-page
  renderer at `0x004ea060` is now tighter too because its 13-byte page descriptor table at
  `0x006220a0` has been decoded directly as `{ page kind, title string id, `0x3ef8` backlink
  page, selected-company-header flag }`. The currently grounded rendered title order is:
  `XXX`, `COMPANY OVERVIEW`, `COMPANY LIST`, `INCOME STATEMENT`, `BALANCE SHEET`,
  `HAULAGE REPORT`, `STOCK DATA`, `PLAYER LIST`, `PLAYER DETAIL`, `GAME STATUS`,
  `TRAIN LIST`, `TRAIN DETAIL`, `STATION LIST`, `STATION DETAIL`, `CARGO LIST`,
  and `INDUSTRY LIST`. Its live body bindings are now bounded too: page `0` falls back to
  `1203` `Unable to display page`, page `1` is the company overview wrapper, page `2` is the
  company list page, pages `3..5` are income statement, balance sheet, and haulage report, page
  `6` is stock data, page `7` is player list, page `8` is player detail, page `9` is game status,
  page `0x0a` is train list, page `0x0b` currently falls back to `1203`, page `0x0c` is station
  list, page `0x0d` currently falls back to `1203`, page `0x0e` is cargo list, and page `0x0f`
  is industry list. The row-click path is tighter now too: player-list rows re-enter page `8`
  directly, but train, station, and industry rows leave `LoadScreen.win` through the shell
  detail-panel manager at `0x004ddbd0` instead of switching to title-table pages `0x0b` or
  `0x0d`. Page `0` is tighter now too: its descriptor is kind `0`, title `1200` `XXX`, backlink
  `0`, and header flag `0`, and no current post-constructor selector path has been recovered for
  it. The descriptor side now also bounds the only known reverse route for the dormant detail
  titles: `0x3ef8` is the table-driven backlink affordance, so if page `0x0b` or `0x0d` were ever
  selected, the known reverse path would return to train-list page `0x0a` or station-list page
  `0x0c` respectively rather than through a separate detail-only owner.
  The launcher side is tighter too: current grounded `shell_open_or_focus_load_screen_page`
  callers cover pages `1`, `2`, `3`, `4`, `5`, `6`, `7`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`,
  and no current recovered opener or row-click route selects `0x0b` or `0x0d`. So the
  `LoadScreen.win` family now has a much cleaner shape: one outer message owner
  `0x004e3a80`, one active-page render owner `0x004ea060`, and then the narrower page-specific
  handlers and renderers beneath them. The launcher side is tighter now too: `0x004e4ee0` is the
  shared open-or-focus ledger-page owner above this family. Outside sandbox it either re-enters
  `shell_load_screen_select_page_subject_and_refresh` on the live runtime at `0x006d10a8` or
  allocates that transient runtime, seeds it through `0x004e4b10`, and enters the visible modal
  loop; inside sandbox it raises localized id `3899` `The ledger is not available in sandbox mode.`
  instead.
  The direct shell-command strip above that opener is now explicit too: `0x00440700..0x0044086e`
  are just tiny `scenario-present -> open page` wrappers for pages `1`, `3`, `4`, `5`, `6`,
  `0x0a`, `0x0c`, `0x0f`, `0x0e`, `2`, `7`, and `9` respectively. So the recovered launcher range
  is no longer only “callers of `0x004e4ee0`” in the abstract; each of those small shell-command
  stubs now just forwards one fixed page id into the shared opener.
  instead. That narrows the remaining `LoadScreen.win` gap again: `TRAIN DETAIL` and
  `STATION DETAIL` now read as dormant title-table entries unless some still-unrecovered nonstandard
  selector reaches them. The live auto-load boundary is tighter now too: hook-driven
  `shell_transition_mode(4, 0)` now completes old-mode teardown, reconstructs and republishes
  `LoadScreen.win`, and returns cleanly, but the later post-transition service ticks still keep
  `[0x006cec78] = 0`, `[shell_state+0x0c]` on the same `LoadScreen.win` singleton, and
  `[LoadScreen.win+0x78] = 0` through at least counts `2..8`. So the next runtime edge is no
  longer the old mode-`4` teardown or publish band; it is the `LoadScreen.win` message owner
  `0x004e3a80` itself, because later service alone is not promoting the plain load screen into the
  separate startup-runtime object path. One later runtime probe did not actually reach that edge:
  the `0x004e3a80` hook installed, but the run never produced any ready-count, staging,
  transition, post-transition, or load-screen-message lines, only ordinary shell node-vcall
  traffic. So that result is now treated as a gate-or-cadence miss rather than as evidence against
  the `LoadScreen.win` message path itself. The newer shell-state service trace tightens it again:
  on a successful staged run the later service ticks do execute in `mode_id = 4`, but the
  `0x004e3a80` message hook still stays silent while the state remains frozen in the plain
  `LoadScreen.win` shape. So the next runtime boundary is now the shell-runtime prime call
  `0x00538b60` beneath `shell_state_service_active_mode_frame` `0x00482160`, not the message owner
  alone. The first direct `0x00538b60` probe run is not trustworthy yet, though: it stopped
  immediately after the first shell-state service-entry line, before any ready-count or
  runtime-prime entry logs. So that result is currently treated as probe validation work, not as a
  real boundary move inside RT3. The static service branch is conditional too: `0x00482160` only
  enters `0x00538b60` when `[shell_state+0xa0] == 0`, so silence from the runtime-prime hook does
  not yet prove the shell stops before that call unless the service-entry logs also show the `+0xa0`
  gate open. The newer run now closes that condition: `[shell_state+0xa0]` is `0`, and the
  `0x00538b60` runtime-prime hook enters and returns cleanly. The newer run closes the next owner
  too: `0x00520620` `shell_service_frame_cycle` also enters and returns cleanly on the same frozen
  mode-`4` path, and the logged fields match its generic branch rather than a startup-promotion
  lane (`[+0x1c] = 0`, `[+0x28] = 0`, `flag_56 = 0`, `[+0x58]` pulsed then cleared, and
  `0x006cec78` stayed `0`). The static body under the same owner is tighter now too: `0x00538b60`
  first re-enters `0x0054f6a0`, refreshes the primary timed-text lane from `[owner+0x1c]` through
  `0x005386e0` when that deadline has expired, walks the registered shell-window list from tail
  `[owner+0x04]` backward through `+0x54` while servicing each node through `0x0053fda0` and
  `0x0051f1d0`, and only then conditionally presents the secondary and primary text lanes through
  `0x005519f0`. So the next runtime boundary under the same shell-state service pass is now one
  level deeper: the per-object service walker `0x0053fda0` beneath `0x00538b60`. The newer run
  closes that owner too: it enters and returns cleanly while servicing the `LoadScreen.win` object
  itself, with `field_1d = 1`, `field_5c = 1`, and a stable child list under `[obj+0x70/+0x74]`,
  and its first child-service vcall target at slot `+0x18` stays `0x005595d0`. Since `0x006cec78`
  still stays `0` through those clean object-service passes, the next runtime boundary is now the
  child-service target `0x005595d0`, not the higher object walker. The newer child-service run
  narrows that again: the first sixteen `0x005595d0` calls are stable child lanes under the same
  `LoadScreen.win` parent, with `[child+0x86]` pointing back to the load-screen object,
  `field_b0 = 0`, and a split where earlier children carry `flag_68 = 0x03` and return `4` while
  later siblings carry `flag_68 = 0x00` and return `0`. The static body matches that read too:
  `0x005595d0` is gated by `0x00558670` and then spends most of its work in draw or overlay
  helpers `0x54f710`, `0x54f9f0`, `0x54fdd0`, `0x53de00`, and `0x552560`, so it now reads as
  another presentation-side service lane rather than the missing startup-runtime promotion. The
  widened allocator-window trace then reconciled the runtime with
  the static mode-`4` branch one step further: the first transition-window allocation is `0x7c`,
  which matches the static pre-construct `0x48302a -> 0x53b070` alloc exactly, and the later
  `0x111/0x84/0x3a/0x25...` allocations all occur before `LoadScreen.win` construct returns, so
  they now read as constructor-side child or control setup. That means the allocator probe did not
  disprove the still-silent startup-runtime slice; it simply exhausted its log budget inside the
  constructor before the post-construct block. The later reset-at-return run is now the decisive
  one: after `LoadScreen.win` construct returns there are still no further allocator hits before
  publish and transition return, which matches the corrected jump-table decode because mode `4`
  does not own the `0x46c40 -> 0x4336d0 -> 0x438890` startup-runtime path.
--- a/docs/control-loop-atlas/input-save-load-and-simulation.md
+++ b/docs/control-loop-atlas/input-save-load-and-simulation.md
--- a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md
+++ b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md
@ -0,0 +1,652 @@
 # Input, Save/Load, and Simulation: Post-load Generation, PaintTerrain, and Save/Load Restore
 ### Post-load Generation, PaintTerrain, and Save/Load Restore
 The same brush strip is tighter now too:
  `0x004bc210` stores the selected ordinal and refreshes one scalar caption
  from table `0x00621e24`, `0x004bc260` exposes the cached world coordinate pair plus the
  currently selected scalar, and `0x004bc290` restyles the ordinal strip `0x0fa1..0x0fa7` plus
  the mapped mode strip `0x0faa..0x0faf` against the current mode dword `[0x006d0818+0x8c]`. The
  next unresolved layer is narrower and more semantic: the setup side now has one grounded
  owner, `world_run_post_load_generation_pipeline`, and its building-side branch is no longer just
  one opaque block. We now have a region family, a region-border overlay rebuild, a region-owned
  structure-demand and placement dispatcher, and a deeper per-region worker that computes category
  demand, subtracts existing coverage, and tries candidate placements. The category map is tighter
  too: category `0` falls back to `House`, category `2` is the year-gated weighted region-profile
  family that also feeds the localized `Industry Weightings` stats panel, and category `3` now
  reaches a separate pool-driven picker whose fallback label is `Commercial` but whose aligned
  player-facing stats bucket is `City Support`. The normalized region band is tighter too:
  `world_region_normalize_cached_structure_balance_scalars` `0x00422320` no longer just writes an
  anonymous cached preview band at `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. Current growth-report
  evidence now grounds `[region+0x2e2]` as the weighted-profit-margin scalar and `[region+0x2ee]`
  as the annual-density-adjust scalar later formatted as a percent in `Stats - City/Region`, with
  `[region+0x2e6/+0x2ea]` left as the intermediate normalized-delta and clamped companion slots
  beneath that final adjust term. The per-region prepass feeding that normalization is tighter too:
  `0x00420d40` clears `[region+0x306/+0x30a/+0x30e]`, walks the linked placed-structure chain from
  `[region+0x383]`, accumulates two local placed-structure metrics through `0x0040ca70` and
  `0x0040ca80`, and only for class-0 candidates also folds source field `[source+0x141]` through
  `0x0040cec0` into the third accumulator before tailing into the later scalar refresh. That tail
  helper `0x00420560` is tighter now too: on class-0 regions it revisits the same linked chain and
  folds a class-mix contribution into `[region+0x312]`, with one source-derived term for candidate
  class `0`, a separate branch keyed by `[candidate+0x78c]` and `[site+0x246]` for class `2`, one
  fixed increment for class `3`, and no current contribution from class `1`. One neighboring
  collection-side dispatcher is tighter now too: `0x00433b80` only runs when global mutation depth
  `0x0062be40` is back at zero and then conditionally fans into the optional refresh hooks
  `0x00481430`, `0x00413860`, `0x004b2a90`, and `0x004931e0`. The periodic boundary
  side is narrower now too. `0x00422100`, reached only from
  `simulation_service_periodic_boundary_work` `0x0040a590`, first requires several live world
  state gates to stay clear, derives one year-sensitive random threshold from selected-year fields
  plus world width, then scans the region collection for eligible class-0 regions whose transient
  dwords `[region+0x276]` and `[region+0x302]` are both clear and which fail the city-connection
  peer probe `0x00420030(1,1,0,0)`. When the gate passes it picks one random eligible region,
  derives one small severity bucket from `[region+0x25e]`, stores the scaled amount back into
  `[region+0x276]`, and appends one queued `0x20`-byte record through `0x004337c0` with literal
  kind `7`, the chosen region id, that amount, the fixed payload `0x005c87a8`, and sentinel dwords
  `-1/-1`. That append helper is now grounded directly too: `0x004337c0` allocates one zeroed
  linked `0x20`-byte node, copies one string or payload seed into `[node+0x04..]`, stores the six
  trailing caller dwords at `[node+0x08..+0x1c]`, and appends the finished node to the singly
  linked list rooted at `[state+0x66a6]`. The gameplay label for that queued-record family is still
  open, but the structural link from periodic region selection into the scenario-state queue is now
  direct instead of speculative. One neighboring narrow counter is bounded too: `0x00422850`
  counts class-0 regions that pass a second `0x00420030` peer-probe variant with fixed flags
  `(1,1,1)` plus one caller-supplied trailing dword, and current callers are the query/script
  dispatch at `0x0042f856` and the later region-stats formatter at
  `0x004d2088`. The
  remaining setup-side uncertainty has therefore narrowed
  again: the region seed and border-overlay pair clearly complete before the `Setting up Players and
  Companies...` banner is posted; `[0x006cec74+0x174]` now looks like the direct building-population
  gate; `[0x006cec74+0x178]` now looks like the direct seeding-burst gate and selected-year-adjust
  policy; and `[0x006cec74+0x68]` now aligns with editor-map mode because the same flag forces the
  `.gmp` family in the shell file coordinators while suppressing the later building and seeding
  branches and diverting the deeper region worker into alternate logic. One write side for that
  `[shell+0x178]` policy is now grounded too: inside `shell_dispatch_ui_command` `0x00464410`,
  command ids `0x9d26..0x9d28` store `command_id - 0x9d26` directly into `[0x006cec74+0x178]`,
  yielding live values `0`, `1`, and `2`. That means the later restore branch is no longer gated
  by an abstract hidden shell latch; at least one of its adjustment inputs is an explicit UI
  launch policy and current evidence still does not show that value being recovered from saved
  state. The `319` lane itself is no longer the
  open structural gap; it now clearly owns chairman-profile slot seeding, profile-record
  materialization, a shell editor surface over the same local record family, and a separate
  live-company presentation path through the company-list window. The later interior order of that
  same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` it
  refreshes the auxiliary route-entry tracker collection `0x006cfcb4`, then runs
  `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`,
  then a flagged world-grid cleanup sweep through the compact grid-flag query
  `0x00448af0` plus the neighboring local chunk-cell write helper `0x00533fe0`, and only after
  that the later route-entry post-pass at `0x00491c20`. The same `319` lane is tighter internally
  now too:
  before that later world and shell reactivation tail, `world_entry_transition_and_runtime_bringup`
  runs one distinct post-bundle status and runtime refresh phase that posts progress ids `0x196`
  and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes the
  live event collection at `0x0062be18` through
  `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the
  scenario-side port-or-warehouse cargo recipe runtime tables through `0x00435630`, and then runs
  the named-candidate availability preseed through `0x00437743`. One later subphase is tighter now
  too: before the broad world-reactivation sweep it posts progress ids `0x32dc/0x3714/0x3715`,
  reloads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged
  runtime-profile bytes back into `0x006cec7c` while latch `[profile+0x97]` is set, mirrors the
  grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world
  bytes `[world+0x66de]` and `[world+0x66f2]`, and restores the selected year/profile lane through
  a tighter two-stage calendar path than before. Current local disassembly now shows the raw saved
  lane at `[profile+0x77]` first feeding helper `0x0051d3f0` with constant components
  `(month=1, day=1, subphase=0, tick=0)`, which writes the resulting Jan-1-style tuple dwords
  into `[world+0x05/+0x09]`. Only after that seed does the same lane enter one mode-sensitive
  adjustment branch: non-editor startup mode can decrement the lane by `1` or `3` depending on
  shell-state editor gate `[0x006cec74+0x68]`, shell-side selected-year-adjust policy
  `[0x006cec74+0x178]`, and the saved special-condition slot `[0x006cec78+0x4af7]`, and only that
  adjusted lane then feeds
  helper `0x0051d390` before `world_set_selected_year_and_refresh_calendar_presentation_state`
  `0x00409e80` stores the final absolute counter into `[world+0x15]` and refreshes
  `[world+0x0d/+0x11]`. That means the restore no longer reads as a direct
  `[profile+0x77] -> [world+0x15]` copy; the raw lane seeds the tuple immediately, but the final
  absolute-counter restore still depends on live shell/startup context. That dependency is tighter
  now too: current local evidence shows `[shell+0x178] == 1` decrementing the restored lane by
  `1`, `[shell+0x178] == 2` subtracting `3`, and otherwise a nonzero
  `[0x006cec78+0x4af7]` supplying the fallback `-1` branch. That field is no longer unresolved:
  current local disassembly now shows `0x00436d10` bulk-zeroing the dword table rooted at
  `[startup+0x4a7f]` through `rep stos`, which includes `+0x4af7`, while the editor-side special
  conditions owner at `0x004cb2b0/0x004cb8e0` counts and commits that same 49-entry table from the
  static rule descriptors at `0x005f3ab0`. The `.smp` save or restore family now grounds that live
  band directly too: `world_runtime_serialize_smp_bundle` `0x00446240` writes `49` dwords from
  `[world+0x4a7f..+0x4b3f]` plus one trailing scalar at `[world+0x4b43]`, and
  `world_load_saved_runtime_state_bundle` `0x00446d40` restores the same fixed `0xc8`-byte band
  symmetrically. Slot `30` in that table is localized pair `3722/3723`
  `Disable Cargo Economy`, so `+0x4af7` now reads as the live copy of that saved scenario rule,
  not a startup-runtime-only mystery latch. The neighboring fixed reads line up with the same rule
  cluster too: `+0x4aef` is slot `28` `Completely Disable Money-Related Things`, `+0x4af3` is slot
  `29` `Use Bio-Accelerator Cars`, `+0x4afb` is slot `31` `Use Wartime Cargos`, `+0x4aff` is slot
  `32` `Disable Train Crashes`, `+0x4b03` is slot `33` `Disable Train Crashes AND Breakdowns`, and
  `+0x4b07` is slot `34` `AI Ignore Territories At Startup`. So the remaining loader gap is
  narrower than before: the restore still depends on live shell policy `[shell+0x178]`, but the
  `+0x4af7` input itself is save-derived scenario rule data rather than something that requires
  runtime tracing to discover. Its read-side family is no longer isolated to the selected-year
  restore either: it also shapes the chunk size in
  `simulation_run_chunked_fast_forward_burst` `0x00437b20` and appears in candidate/local-service
  selection and station-detail-side scoring branches around `0x0047f910`, `0x00410d87`, and
  `0x005069c6`, which now makes this whole slot cluster look like broader runtime consumers of
  scenario special conditions rather than one startup-only mode enum. One file-side anchor is now
  tighter too: the checked classic and 1.05 `gmp/gms/gmx` corpus does expose the same aligned
  `0x0d64..0x0e2c` `50`-dword band as the grounded `.smp` runtime save or restore copy into
  `[world+0x4a7f..+0x4b43]`, but most checked file families only populate a sparse subset of that
  band. The first `36` dwords still behave like the older inferred fixed rule matrix with hidden
  slot `35` fixed to sentinel value `1`, while the trailing `13` unlabeled rule lanes plus one
  scalar vary much more selectively by file family. Current local corpus scans make that split
  concrete: the grounded 1.05 scenario-save family (`p.gms`, `q.gms`) stably lights lanes
  `35, 37, 39, 44, 45, 46, 47, 48`; the base 1.05 save family (`Autosave.gms`, `nom.gms`) only
  shares lane `35` stably and otherwise varies sparsely through `42`, `45`, and `47`; the checked
  grounded 1.05 maps, the lone 1.05 alt save, and the visible sandbox-family `.gmx` files keep
  only the sentinel lane `35` nonzero. So the current loader boundary is narrower than before: the
  `.smp` path still gives a grounded direct runtime-band restore, and checked `gmp/gms/gmx` files
  now show a partially populated projection of that same aligned band rather than a wholly separate
  fixed record family. The overlap against the later scalar window is now explicit too: trailing
  band indices `36..49` are byte-identical with post-window offsets `0x00..0x34`, so every nonzero
  lane in that prefix of the post-sentinel scalar window is also a nonzero lane in the aligned
  runtime-rule band. That means the real “other fields” boundary inside the post-sentinel window
  starts only at `0x0e2c`: `0x0df4..0x0e2c` is the aligned-band overlap prefix, while
  `0x0e2c..0x0f30` is the later tail that still looks like save-side scalar state. Local corpus
  scans now make that tail split more specific. The base 1.05 save family
  (`Autosave.gms`, `nom.gms`) shares a stable tail subset at relative offsets
  `0xb4`, `0xc0`, `0xe0`, `0xfc`, and `0x100`, with additional per-file lanes around them. The
  1.05 scenario-save family (`p.gms`, `q.gms`) has a much denser stable tail covering
  `0x08`, `0x0c`, `0x10`, `0x14`, `0x20`, `0x24`, `0x28`, `0x30`, `0x34`, `0x3c`, `0x5c`,
  `0x6c`, `0xa0`, `0xa8`, `0xbc`, `0xc0`, `0xc4`, `0xc8`, `0xcc`, `0xdc`, `0xe0`, `0xe4`,
  `0xe8`, `0xf4`, `0xf8`, and `0xfc`; those values still differ per save, but the occupancy is
  stable. The lone 1.05 alt save (`g.gms`) only lights `0x20`, `0x34`, `0xf0`, and `0xf4`.
  Grounded map families and classic saves keep the tail zeroed, while the only current map-side
  outlier remains `Tutorial_2.gmp` under the broad unknown map-family bucket. The immediately
  following fixed file window at `0x0df4..0x0f30` is now bounded separately as well: checked maps
  and classic saves leave that whole post-sentinel band zeroed,
  while checked 1.05 saves carry sparse nonzero dwords there, many of which decode cleanly as
  normal little-endian `f32` values. That makes the adjacent band look like a 1.05 save-only
  runtime band rather than scenario-static payload, even though its semantics are still open.
  One numeric alignment inside that band is now exact too: the tail start `0x0e2c` is the same
  relative distance from the aligned runtime-rule base `0x0d64` as live object offset `+0x4b47`
  is from grounded world-rule base `[world+0x4a7f]`, so the bounded tail window
  `0x0e2c..0x0f30` is offset-aligned with live bytes `[world+0x4b47..+0x4c4b]`. The first
  grounded live field at that boundary is no longer anonymous. `0x004367c0` sets one outcome mode
  in `[world+0x4a73]`, zeros `[world+0x4d]`, snapshots the selected-year lane to `[world+0x4c88]`,
  and then copies localized id `2923` `You lose.` or `2924` `You win, cheater...` into
  `[world+0x4b47]`; `0x00472dd0` formats localized id `3918` `%1 has won the game!` with one live
  profile name and writes that string into the same destination; and one compact runtime-effect
  branch inside `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20` resets
  the same destination to the fixed placeholder token at `0x005c87a8`. That gives a grounded live
  interpretation for the start of the tail: `[world+0x4b47]` is the start of a victory or outcome
  status-text buffer, not a float lane. The same evidence also gives a useful caution: those live
  helpers copy up to `0x12c` bytes into `[world+0x4b47..+0x4c73]`, so the current bounded file-tail
  window `0x0e2c..0x0f30` cuts through the first `0x104` bytes of a grounded text field rather
  than ending on a clean live-field boundary. One small continuation probe now tightens that edge:
  the remaining file window `0x0f30..0x0f58` is exactly the last `0x28` bytes needed to reach the
  clean live-field boundary at `[world+0x4c73]`, and checked 1.05 saves still carry sparse nonzero
  bytes in that continuation window rather than a trailing text-looking suffix. Checked 1.05 save
  bytes in the aligned region therefore still do not resemble preserved text; they stay mostly zero
  at the beginning and many nonzero lanes decode as ordinary `f32` values. So the safest current
  note is: the tail is offset-aligned with the live object beyond `+0x4b43`, but it is not yet a
  validated byte-for-byte mirror of the live `[world+0x4b47]` status-text buffer, and the current
  nonzero save-side content continues right up to the first clean field edge at `0x0f58`. The next
  exact grounded fields after that edge are byte lanes, not restored dwords: `0x0f59` maps to
  `[world+0x4c74]` `Auto-Show Grade During Track Lay`, `0x0f5d` maps to `[world+0x4c78]`
  `Starting Building Density Level`, `0x0f61` maps to `[world+0x4c7c]` `Building Density Growth`,
  `0x0f65` maps to grounded dword `[world+0x4c80]` `leftover simulation time accumulator`, and
  `0x0f6d` maps to byte `[world+0x4c88]` `selected-year lane snapshot`. The first later grounded
  dword after that is `[world+0x4c8c]` at `0x0f71`. That means the simple 4-byte file-lane model
  stops matching grounded live field boundaries immediately after the text-buffer edge: the post-
  `0x0f58` file bytes are still offset-correlated to live state, but they are no longer naturally
  dword-aligned with the next grounded object fields. The new byte-neighborhood probe makes the
  mismatch more concrete. In checked 1.05 scenario saves, the exact grounded byte offsets
  themselves do not look like clean selector values: `p.gms` carries `0x33` at `0x0f5d` and `0x8c`
  at `0x0f6d`, while `q.gms` carries `0xcc` and `0xba` at those same offsets. The only clean
  float-looking starts in that neighborhood instead appear one byte earlier, at `0x0f5c` and
  `0x0f6c`: `p.gms` decodes those as roughly `7.6` and `6.0172`, while `q.gms` decodes them as
  roughly `23.6` and `44.6824`. That tightens the current read further: the checked save bytes
  remain offset-correlated to the live `[world+0x4c74..+0x4c8c]` neighborhood, but they are still
  not a validated byte-for-byte mirror of the exact live field layout. Local
  A second byte-oriented neighborhood immediately after that now has the same kind of split rather
  than a clean restored-field mirror. The earlier grounded anchors in that band all stay zero in
  the checked 1.05 saves: exact file offset `0x0f87` maps to selected-year bucket companion scalar
  `[world+0x4ca2]`, while `0x0f93` and `0x0f97` map to the two startup-dispatch reset-owned bands
  `[world+0x4cae]` and `[world+0x4cb2]`, and the local corpus leaves all three exact dword starts
  zeroed. The same is true for the later exact byte-owned policy lanes: file offsets `0x0f78`,
  `0x0f7c`, `0x0f7d`, and `0x0f7e` map cleanly to grounded byte fields `[world+0x4c93]` and
  `[world+0x4c97..+0x4c99]`: the linked-site removal follow-on gate plus the three editor
  locomotives-page policy bytes `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All
  Electric Locos Avail.`. In the checked 1.05 save corpus those four exact byte lanes all stay
  `0`, which is at least structurally clean. The later grounded dword fields in the same
  neighborhood are less direct again. Exact file offset `0x0f9f` maps to `[world+0x4cba]` (the
  station-list selected-station mirror) and exact offset `0x0fa3` maps to cached
  available-locomotive rating `[world+0x4cbe]`, but the checked save bytes at those exact dword
  starts do not look like clean preserved ids or floats. The only stable float-looking starts sit
  three bytes earlier, at `0x0f9c` and `0x0fa0`: `p.gms` yields roughly `96.8754` and `186.4795`,
  `q.gms` yields `329.9467` and the same `0x0fa0`-side candidate shape, `g.gms` yields `7.0` and
  `95.8507`, and `Autosave.gms` only shows the later `0x0fa0` candidate at about `68.2629`. So
  this later band now has the same conservative read as the post-text one: the save bytes are
  still offset-correlated to grounded live fields, but the exact live byte or dword layout is not
  yet validated as a direct on-disk mirror.
  One more structural cut is now grounded beyond that neighborhood. The aligned scalar plateau
  `0x0fa7..0x0fe7` ends exactly at the later recipe-book root `[world+0x0fe7]` already grounded in
  the port-or-warehouse cargo editor and runtime rebuild path. We still do not have live semantic
  names for the plateau itself, but its aligned dword run now splits cleanly by save family. The
  base 1.05 saves (`Autosave.gms`, `nom.gms`) carry one stable signature with
  `0x0faf = 0x8000003f`, `0x0fb3 = 0x75c28f3f`, repeated `0x75c28f3c` lanes through `0x0fbf`, a
  sign-flipped lane `0x0fc3 = 0xa3d70a3c`, one tiny marker at `0x0fc7 = 0x0000003b`, and
  `0x0fcb = 0x00300000`. The scenario-save family (`p.gms`, `q.gms`) carries a different stable
  plateau over the same offsets, beginning `0x0faf = 0x4000003f`, `0x0fb3 = 0xe560423f`, then
  `0x03126f3b`, `0x1374bc3c`, and paired `0x23d70a3c` lanes at `0x0fbf/0x0fc3`, with
  `0x0fc7 = 0x0000003c`. The alt-save family (`g.gms`) follows the base signature through
  `0x0fc7`, then diverges sharply into the same `0xcdcdcd..` fill pattern already seen in its
  earlier header lanes. So the current best fit for `0x0fa7..0x0fe7` is a family-shaped aligned
  scalar plateau that belongs to save-side runtime state and terminates immediately before the
  grounded recipe-book block, not one more directly named live-field mirror. One conservative
  loader-side summary probe now starts exactly at that recipe root instead of extending the plateau
  model further. The fixed recipe-book block spans twelve books from `0x0fe7` with stride `0x4e1`,
  and the checked map/save pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp ->
  p.gms`, and `Spanish Mainline.gmp -> g.gms` preserve that rooted block byte-for-byte in the
  sampled local corpus. The current probe therefore treats it as preserved scenario payload rather
  than save-only runtime drift and only reports per-book signatures: a coarse head kind over the
  pre-line region, the raw `book+0x3ed` annual-production dword, and one raw summary for each of
  the five fixed `0x30`-byte cargo lines beginning at `book+0x3f1`: coarse line kind, raw mode
  dword, raw annual-amount dword, and the raw supplied/demanded cargo-token dwords at `+0x08` and
  `+0x1c`. That is enough to separate zero, `0xcd`-filled, and mixed books or lines without
  overstating line semantics beyond the grounded editor/runtime ownership already documented below.
  Local
  corpus clustering now makes the remaining split more specific. The base 1.05 save family
  (`Autosave.gms`, `nom.gms`) shares a narrow tail-heavy subset with stable relative offsets
  `0xec`, `0xf8`, `0x118`, `0x134`, and `0x138`, while still varying in value across files. The
  1.05 scenario-save family (`p.gms`, `q.gms`) shares a much broader stable set spanning almost the
  whole window from `0x04` through `0x134`, again with per-file scalar differences but consistent
  occupancy. Pairwise compare runs tighten that read further: `Autosave.gms` vs `nom.gms` does not
  preserve one common numeric tail signature even at the shared base-save offsets, and `p.gms` vs
  `q.gms` keeps the broad scenario-save occupancy pattern but still changes every shared value, with
  `q.gms` additionally lighting two extra lanes at `0x78` and `0x84`. So the current best fit is
  “family-shaped live scalar state” rather than family-default constants. The lone 1.05 alt-save
  sample (`g.gms`) only lights up four lanes at `0x58`, `0x6c`,
  `0x128`, and `0x12c`. The checked 1.05 maps and classic saves stay zero in that same bounded
  window, which strengthens the current read that this is runtime-save scalar state rather than
  generic map payload. One older unknown map-family outlier in the local corpus does still carry a
  populated window: `Tutorial_2.gmp` under the classic install tree. So the safest current note is
  “zero for grounded map families and classic save families, nonzero for observed 1.05 save
  families, with one older unknown-map exception.” Static consumer grounding is still sparse for
  that tail: direct object-offset hits currently only name the trailing scalar `[world+0x4b43]`
  through the editor panel and `.smp` save or restore family, while local opcode searches do not
  yet surface equally direct reads for the intervening `+0x4b0b..+0x4b3f` tail lanes. So the
  save-file family clustering is now strong, but those later tail scalars remain structurally
  bounded rather than semantically named. The
  same branch is no longer world-entry-only either: current local
  disassembly now shows the identical lane-adjust and
  `0x51d3f0 -> 0x51d390 -> 0x409e80` sequence in the post-fast-forward selected-year tail at
  `0x004370e0`, which lines up with the existing post-fast-forward callers already mapped under
  `0x00433bd0`, `0x00435603`, `0x0041e970`, and `0x00436af0`. That restore now
  also has some neighboring slot semantics bounded well enough to carry in the loader notes. Slot
  `31` `[0x006cec78+0x4afb]` is no longer best read as an unnamed runtime cargo-economy latch:
  local disassembly now ties it directly to the saved special-condition table entry `Use Wartime
  Cargos`, and the strongest current runtime owner is
  `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`. Inside that
  candidate-collection sweep the branch at `0x0041ed37` only activates when slot `31` is set and
  then treats the string family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and
  `Diesel` as one special cargo set before writing the live candidate filter byte `[entry+0x56]`.
  That makes the old read-side note around `0x00412560` tighter too: the neighboring descriptor
  gate is now best understood as using the live copy of the `Use Wartime Cargos` scenario rule,
  not an anonymous cargo-economy mode byte. Slot `34` `[0x006cec78+0x4b07]` is similarly bounded
  on the runtime side: the wrapper at `0x004013f0`, which sits immediately above the broader
  company-start or city-connection chooser `0x00404ce0`, snapshots region dword `[entry+0x2d]`
  across all `0x18` live region records in `0x006cfc9c`, zeros that field while the chooser runs,
  and then restores the original values on exit. That is a strong current fit for the editor rule
  `AI Ignore Territories At Startup`, even though the exact meaning of region field `+0x2d`
  remains open. Slot `29` `[0x006cec78+0x4af3]` is less semantically tidy but still worth carrying
  as a bounded consumer family: the branch at `0x0041d286` activates one later placed-structure or
  building-side scoring path only when that slot is nonzero and the linked candidate or era record
  at `[entry+0x41]` equals `5`, while two already-grounded world helpers
  `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` and
  `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670` also gate on the same
  slot. So the identity of slot `29` as saved rule data is grounded, but the downstream runtime
  semantics are still mixed enough that the loader should preserve the raw value without trying to
  rename its whole consumer family yet. The neighboring train-safety slots are now bounded enough
  to keep as a cautious runtime split too. Slot `33` `[0x006cec78+0x4b03]`
  `Disable Train Crashes AND Breakdowns` is the coarse gate in the currently recovered train-side
  deterioration family around `0x004af8a0`: the very first branch at `0x004af8ab` jumps straight
  to the function tail when the slot is set, bypassing the year-scaled threshold build, the later
  random or threshold comparison, and the two follow-on state transitions at `0x004ad7a0` and
  `0x004ada00`. Slot `32` `[0x006cec78+0x4aff]` `Disable Train Crashes` is narrower in the same
  family: after the threshold path has already run, the branch at `0x004af9c1` uses slot `32` to
  suppress only the lower failure-transition path and force the milder follow-on at `0x004ada00`.
  That same slot-`33` read also appears in the smaller train-side scalar query at `0x004ac460`,
  where setting it returns one fixed float immediately before the ordinary route-object-dependent
  calculation runs. So the current best loader-facing read is: slot `33` is the broad train
  deterioration bypass, slot `32` is the narrower crash-only branch inside that same family, but
  the exact player-facing names of the two unnamed train helpers still need one more naming pass.
  That restore now
  also has one concrete file-side correlation in the classic `.gms` family: local save inspection
  now consistently finds `0x32dc` at `0x76e8`, `0x3714` at `0x76ec`, and `0x3715` at `0x77f8` in
  `Autosave.gms`, `kk.gms`, and `hh.gms`, leaving one exact `0x108`-byte span from `0x76f0` to
  `0x77f8` between `0x3714` and `0x3715`. That span already carries staged-profile-looking payload
  text such as `British Isles.gmp`, so the current static-file evidence now supports the atlas-side
  `0x108` packed-profile note for the classic save family even though the exact field layout inside
  that block is still unresolved. The same classic corpus is tighter now too: inside that
  `0x108` span the map-path C string begins at relative offset `0x13`, the display-name C string
  begins at `0x46`, the block is otherwise almost entirely zeroed, and the three local samples are
  byte-identical except for the leading dword at `+0x00` (`3` in `Autosave.gms` and `hh.gms`,
  `5` in `kk.gms`). The currently atlas-tracked bytes `[profile+0x77]`, `[profile+0x82]`,
  `[profile+0x97]`, and `[profile+0xc5]` are all `0` in that classic sample set, so the current
  file-side evidence grounds the block boundaries and the embedded strings but does not yet show
  live examples of those branch-driving latches being set. One 1.05-era file-side analogue is now
  visible too, but only as an inference from repeated save structure rather than a disassembly-side
  field map: local `.gms` files in `rt3_105/Saved Games` carry one compact string-bearing block at
  `0x73c0` with the same broad shape as the classic profile slab, including a leading dword at
  `+0x00`, one map-path string at `+0x10`, one display-name string at `+0x43`, and a small
  nonzero tail around `+0x76..+0x88`. In that 1.05 corpus the analogue bytes at relative `+0x77`
  and `+0x82` are now nonzero in every checked sample (`Autosave.gms`/`nom.gms` show `0x07` and
  `0x4d`; `p.gms`/`q.gms` show `0x07` and `0x90`; `g.gms` shows `0x07` and `0xa3`), while
  relative `+0x97` and `+0xc5` remain `0`. The compared 1.05 save set is tighter now too:
  `Autosave.gms` and `nom.gms` cluster together on `Alternate USA.gmp` with `+0x82 = 0x4d`,
  `g.gms` carries `Spanish Mainline.gmp` with `+0x82 = 0xa3`, and `p.gms`/`q.gms` cluster on
  `Southern Pacific.gmp` with `+0x82 = 0x90`; across all five files the same inferred analogue
  lane at `+0x77` stays fixed at `0x07`, while the same map- or scenario-sensitive tail word at
  `+0x80` tracks those `0x4d/0xa3/0x90` byte lanes (`0x364d0000`, `0x29a30000`, `0x1b900000`).
  The leading dword at `+0x00` also splits the same corpus, with `Autosave.gms` alone at `3` and
  the other four checked 1.05 saves at `5`. That is enough to say the wider save corpus does
  contain nonzero candidates for two of the atlas-tracked profile lanes, and that one of them
  varies coherently with the loaded scenario family, but not yet enough to claim that the 1.05
  block reuses the exact same semantic field assignments as the classic one. The loader-side
  family split is tighter now too: `p.gms` and `q.gms` no longer live under a generic fallback;
  their save headers now classify as one explicit `rt3-105-scenario-save` branch with preamble
  words `0x00040001/0x00018000/0x00000746` and the early secondary window
  `0x00130000/0x86a00100/0x21000001/0xa0000100`, while `g.gms` now classifies as a second
  explicit `rt3-105-alt-save` branch with the different preamble lane
  `0x0001c001/.../0x00000754` and early window
  `0x00010000/0x49f00100/0x00000002/0xa0000000`. That branch now carries the same bootstrap,
  anchor-cycle, named 1.05 trailer, and narrow profile-block extraction path as the other 1.05
  saves. The bridge just below that trailer is now explicit too: the common 1.05 save branch
  carries selector/descriptor `0x7110 -> 0x7801` in `Autosave.gms` and `0x7110 -> 0x7401` in
  `nom.gms`, and both still reach the same first later candidate at
  `span_target + 0x189c`, well before the packed profile at `span_target + 0x3d48`; the
  `rt3-105-alt-save` branch instead carries `0x54cd -> 0x5901` and its first later candidate
  lands at `packed_profile + 0x104`, essentially on the profile tail; the scenario-save branch
  still diverges locally with `0x0001 -> 0x0186` and never enters that later `0x32c8`-spanned
  bridge at all. The common-branch bridge payload is narrower now too: both checked base saves
  expose the same 0x20-byte primary block at `0x4f14` followed by the same denser secondary block
  at `0x671c`, `0x1808` bytes later, and that secondary block now appears to run intact up to the
  packed-profile start at `0x73c0` for a total observed span of `0xca4` bytes. The trailing slice
  of that secondary block is now typed one level further: a small header at `secondary+0x354`
  carries the observed stride `0x22`, capacity `0x44`, and count `0x43`, followed by a fixed-width
  67-entry name table starting at `secondary+0x3b5` and running through names like
  `AluminumMill`, `AutoPlant`, `Bakery`, `Port00..11`, and `Warehouse00..11`, with a short footer
  (`dc3200001437000000`) after the last entry. The trailing per-entry word is now surfaced too:
  most entries carry `0x00000001`, while the currently observed zero-trailer subset is
  `Nuclear Power Plant`, `Recycling Plant`, and `Uranium Mine`. That footer is tighter now too:
  it parses directly as `0x32dc`, `0x3714`, and one trailing zero byte, so the shared
  map/save catalog currently ends on the same two grounded late-rehydrate progress ids that the
  classic staged-profile band already exposed. The strongest structural read is therefore that the
  entire `0x6a70..0x73c0` catalog region is shared verbatim between `Alternate USA.gmp` and the
  derived `Autosave.gms`, not rebuilt independently during save. Combined with the earlier
  grounded record-layout work under `0x00437743`, `0x00434ea0`, and `0x00434f20`, the current
  safest semantic read is that this shared catalog is the bundled source form of the scenario-side
  named candidate-availability table later mirrored into `[state+0x66b2]`, with each entry's
  trailing dword now reading as the same availability override bit later copied into
  `[candidate+0x7ac]`. The loader-side coverage is tighter now too: the same table parser now
  attaches both to the common-save bridge payload and directly to the fixed source range in
  `.gmp` files and the non-common `rt3-105-scenario-save` / `rt3-105-alt-save` branches. That
  makes the scenario variation explicit instead of anecdotal. `Alternate USA` keeps only three
  zero-availability names in this table (`Nuclear Power Plant`, `Recycling Plant`, `Uranium
  Mine`), `Southern Pacific` widens the zero set to twelve (`AutoPlant`, `Chemical Plant`,
  `Electric Plant`, `Farm Rubber`, `FarmRice`, `FarmSugar`, `Nuclear Power Plant`, `Plastics
  Factory`, `Recycling Plant`, `Tire Factory`, `Toy Factory`, `Uranium Mine`), and `Spanish
  Mainline` widens it again to forty-two, including `Bauxite Mine`, `Logging Camp`, `Oil Well`,
  `Port00`, and the `Warehouse00..11` run while also flipping `Recycling Plant` back to
  available. The header lanes just ahead of the table vary coherently with those scenario
  branches too: `Alternate USA` carries `header_word_0 = 0x10000000`, `Southern Pacific`
  carries `0x00000000`, and `Spanish Mainline` carries `0xcdcdcdcd`, while the structural
  fields from `header_word_2` onward remain stable (`0x332e`, `0x1`, `0x22`, `0x44`, `0x43`)
  and the 9-byte footer still decodes as `0x32dc`, `0x3714`, `0x00` in all three checked maps.
  A wider corpus scan over the visible `.gmp`/`.gms` files makes those two anonymous header
  lanes less mysterious too: the parser currently sees only three stable
  `(header_word_0, header_word_1)` pairs across 79 files with this table shape, namely
  `(0x00000000, 0x00000000)`, `(0x10000000, 0x00009000)`, and
  `(0xcdcdcdcd, 0xcdcdcdcd)`. The zero-availability count varies widely underneath the first and
  third pairs (`0..56` under the zero pair, `14..67` under the `0xcdcdcdcd` pair), so those two
  lanes no longer look like counts or direct availability payload; the safest current read is
  that they are coarse scenario-family or source-template markers above the stable
  `0x332e/0x22/0x44/0x43` table header, with `0xcdcdcdcd` still plausibly acting as one reused
  filler or sentinel lane rather than a meaningful numeric threshold. Current exported
  disassembly notes still do not ground one direct loader-side or editor-side consumer of
  `header_word_0` or `header_word_1` themselves, so that family-marker read remains an
  inference from corpus structure rather than a named field assignment.
  The new loader-side compare command makes the save-copy claim sharper too: for the checked
  pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> p.gms`, and
  `Spanish Mainline.gmp -> g.gms`, the parsed candidate-availability table contents now match
  exactly entry-for-entry, with the only reported differences being the outer container family
  (`map` vs `save`) and source-kind path (`map-fixed-catalog-range` vs the save-side branch).
  has the explicit companion `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, which
  rebuilds the dependent selected-year bucket floats after the packed year changes; and then
  rehydrates the named locomotive availability collection at `[world+0x66b6]` through
  `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`.
  That locomotive-side restore is tighter now too: its tail explicitly re-enters
  `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`, which rebuilds one
  cached available-locomotive rating at `[state+0x4cbe]` from the current year plus the strongest
  surviving available locomotive-side rating scalar `[loco+0x20]`, and the tiny query sibling
  `0x00434080` is now bounded as the shell-side clamped read helper over that same cached field,
  with the grounded shell-side reader later bucketing that value against `40/50/70/85/100`. The
  same rehydrate band also refreshes the live structure-candidate filter and year-visible counts
  through `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`,
  rebuilding the paired per-slot bands at `[candidates+0x246]` and `[candidates+0x16e]` and the
  aggregate counts at `[candidates+0x31a]` and `[candidates+0x242]`; the same late checkpoint also
  re-enters `placed_structure_collection_seed_candidate_subtype2_runtime_latch` `0x00434d40`,
  which seeds runtime dword `[candidate+0x7b0]` across subtype-`2` candidate records before the
  later world-wide reactivation sweep. That checkpoint also now has an explicit shell-facing scalar
  publisher: `world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides`
  `0x004354a0` writes one clamped `0..255` value into the current shell presentation object,
  sourcing it either from the shell selector override pairs or from the scenario-side year-threshold
  band rooted at `[state+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`; and just ahead of the later
  scenario-side recipe rebuild, the same band also re-enters
  `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, which only falls into its
  heavier rebuild body while `[state+0x3a] < 2` and otherwise leaves the derived year-threshold
  companion slots `[state+0x51/+0x55/+0x59/+0x5d/+0x61]` unchanged. The neighboring late status
  checkpoints around progress ids `0x196` and `0x197` also share one explicit stage gate now:
  `world_query_global_stage_counter_reached_late_reactivation_threshold` `0x00444dc5` compares the
  global counter `0x00620e94` against threshold `0x9901`, and the two current callers use a
  negative result to clear `[world+0x39]` before the broader world and shell reactivation sweep.
  The later reactivation tail is tighter now too: it includes the region-center world-grid flag
  reseed pass
  `0x0044c4b0`, which clears bit `0x10` across the live grid and then marks one representative
  center cell for each class-`0` region through `0x00455f60`; its immediate sibling `0x0044c450`
  then reruns `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` across every
  live grid cell. The small secondary-raster premark helper `0x0044c570` is bounded now too: it
  only admits cells whose current raster byte has no bits in mask `0x3e` and whose parallel class
  query `0x00534e10` is false, then rewrites that masked class field to `0x02` and widens the same
  cached bounds-and-count band `[world+0x21c6..+0x21d6]`. The next helper `0x0044ce60` scans the secondary raster at `[world+0x2135]`
  for cells with any bits in mask `0x3e`, caching min/max bounds plus a marked-cell count in
  `[world+0x21c6..+0x21d6]`; the larger sibling `0x0044c670` then consumes those cached bounds to
  normalize the same raster and rebuild one dependent overlay/cache surface before the later
  route-style rebuild, shell-window, and briefing branches. That overlay side is tighter now too:
  after `0x0044c670` resolves scaled surface dimensions through `0x00534c50`, it walks one local
  `3 x 32` sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only
  secondary-raster classes `4..0x0d`, folds several interpolated `0x0051db80` samples into one
  strongest local score, writes packed overlay pixels into the staged surface buffer, and only then
  publishes that staged overlay through `0x00534af0`. The lower helper layer under that overlay
  pass is tighter now too: `0x00534e10` is the reusable secondary-raster class-set
  predicate for classes `1/3/4/5`, `0x00534e50` is the smaller neighboring class-subset predicate
  for `1/4`, `0x00534ec0` covers `2/4/5`, `0x00534f00` covers `3/5`, `0x00534e90` is the
  marked-bit query over the same 3-byte cell family, and the nearby local counter `0x0044bdb0`
  is now bounded as the 8-neighbor count companion for that same `2/4/5` subset, walking the
  shared `0x00624b28/0x00624b48` offset tables and re-entering `0x00534ec0` on each bounded
  neighbor cell. The first caller cluster around `0x0044bf9d..0x0044c37b` therefore reads as a
  secondary-raster neighborhood service band rather than a generic map scan.
  `0x00533e70` and `0x00534160` are the coarser siblings over the overlay table at `[world+0x1685]`:
  the first clears coarse chunk objects across one clamped rectangle, while the second ensures one
  chunk object and seeds local marks through its deeper stamp helper. One level up, the neighboring
  rect owner `0x005374d0` now reads as the shared secondary-overlay refresh pass: it reruns the
  local sample and unsigned-word reducers `0x00536230/0x00536420`, rebuilds the signed vector byte
  planes through `0x00536710`, and then rebuilds the multiscale support surfaces through
  `0x00533890`, whose inner reducers now explicitly target the packed sample-triplet buffer plus
  the float and unsigned-word support planes rooted at the five-entry per-scale families
  `[world+0x15f1..+0x1601]`, `[world+0x1605..+0x1615]`, and `[world+0x1619..+0x1629]`. The setup
  side of that same family is tighter now too:
  `0x005375c0` is the shared ensure-and-seed owner that allocates the sample, sidecar, mask,
  raster, vector, and coarse-cell tables together; crucially, it seeds `[world+0x1655]` with byte
  `0x02` and `[world+0x1659]` with byte `0x01`, which closes the default-fill split. The local
  component-walk owner under the same neighborhood band is tighter now too: `0x0044c200`
  allocates a temporary `width*height` visit bitmap at `0x0062c128`, seeds one class-`2/4/5`
  starting cell, derives an initial direction index through the remap table `0x005ee5d4`, and then
  fans into the deeper recursive walker `0x0044be20`. That deeper walker widens dirty bounds
  `[world+0x21ad..+0x21b9]`, stamps one companion-word orientation lane through `0x005ee5cc`,
  reuses `0x00534ec0` plus `0x0044bdb0` to filter admissible neighbors, tracks temporary
  visitation in `0x0062c128`, and then applies the local byte-1 edge-bit `0x04/0x08` updates
  before returning. So the `0x0044bf9d..0x0044c422` cluster now reads as a real connected-component
  walk plus edge-flag refresh layer over the secondary raster rather than only a loose group of
  local neighbor counters. The adjacent mutation strip is tighter now too: `0x0044dcf0` refreshes
  companion-word bit `0x200` in one local rectangle by checking whether any neighbor belongs to
  class set `2/4/5`, while `0x0044df10` clears three local sidecar byte planes, demotes class `4`
  to `1` and class `5` to `3`, and then reruns that marked-bit refresh over the surrounding
  `+/-1` window. One level up, `0x0044e500` is the rect-wide owner that recomputes byte-1 edge
  bits `0x04/0x08` for class-`2/4/5` cells, dispatches `0x0044df10` on incompatible local
  patterns, and finally consumes the pending global seed pair at `[0x006d1304+0x78/+0x7c]`
  through `0x0044c200`. The shell-side owner of that pending pair is tighter now too:
  `[0x006d1304]` is the live `PaintTerrain.win` shell singleton while the callback-heavy side also
  keeps a second rooted pointer at `0x006d1334`; the tool constructor snapshots the broader
  terrain-paint state into both families while the world-side raster owner still only consumes
  `[0x006d1304+0x78/+0x7c]` as one pending component-seed pair. Its radial sibling `0x0044e7d0`
  is narrower:
  after validating world-space
  coordinates through `0x00414bd0`, it stamps class-`2` marks into the secondary raster by walking
  one clamped bounding box and admitting cells only when the radial falloff helper `0x0051db80`
  stays positive before re-entering `0x0044c570`. The two small support predicates under that same
  strip are now explicit too: `0x00414bd0` is the float grid-bounds gate, and `0x00449df0` is the
  integer rectangle clamp-and-validity helper shared by the local mutation owners. One level up,
  the broader rect-scoped owner is tighter now too:
  `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`
  first reclamps the caller rectangle through `0x00449df0`, reruns the local edge-refresh owner
  `0x0044e500`, lazily ensures one presentation target through
  `0x0051f090/0x00534910/0x00534920/0x00534930`: the first helper resolves the shared
  world-presentation owner, `0x00534910/0x00534920` expose the current staging flag and buffer
  root, and `0x00534930` captures one normalized-bounds rect into that staging buffer before the
  later publish step `0x00534af0`. The same family then resolves scaled target dimensions through
  `0x00534c50` before allocating one temporary `width*height` mask. Its main scan then
  walks the live secondary raster `[world+0x165d]` through the same class predicates
  `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four
  sidecar byte planes `[world+0x1631..+0x163d]`, while the broader per-cell pass writes packed
  values into the ensured target through `0x00534730` and also updates nibble lanes at byte offsets
  `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it
  notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the
  temporary mask, expands the caller rectangle by dirty bounds `[world+0x21ad..+0x21b9]` through
  `0x00536710`, and finally seeds companion byte `[world+0x162d]` with `0xc4` on cells selected
  from mask plane `[world+0x1655]`. So the `0x0044e500 -> 0x0044e940` band is now a real
  derived-surface and companion-plane rebuild family rather than only a loose collection of local
  raster mutations. The local
  evidence now also supports a stronger negative conclusion: unlike `[world+0x1655]`, that second
  mask plane is not part of the actively rebuilt runtime overlay path, and in the grounded local
  corpus it behaves only as a separately seeded, cleared, and persisted sibling plane. One level
  lower, the
  base-plane allocator `0x00532c80` now reads more cleanly too: it is the narrower owner that
  clears `[world+0x15e1]`, optionally applies the current grid dimensions, allocates the base
  float-summary plane `[world+0x1605]`, the four sidecar byte planes `[world+0x1631..+0x163d]`,
  both one-byte mask planes `[world+0x1655/+0x1659]`, and the packed secondary raster
  `[world+0x165d]`, then seeds those planes with the same `0x02/0x01/0x00` default split. The
  load-side owner for those same planes is tighter now too: the constructor thunk `0x0044e910`
  immediately feeds the heavier payload body `0x0044cfb0`, which reads the rooted chunk families
  `0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, allocates the core world-grid
  and secondary-raster arrays `[world+0x2129..+0x2141]` plus the route-entry collection
  `0x006cfca8`, initializes every grid-cell record through `0x0042ae50`, and only then hands off
  into `world_compute_transport_and_pricing_grid` `0x0044fb70`, the neighboring presentation
  refresh `0x00449f20`, and the shell-mode pulse `0x00484d70`. So the `0x0044e910 -> 0x0044cfb0`
  load side is now bounded as the heavy world-grid and secondary-raster bundle-load body rather
  than just another anonymous constructor tail. One
  level higher again, the broader world-presentation reinitializer `0x00537e60` now sits above
  that base allocator and the larger support-family ensure path `0x005375c0`: it stores the live
  grid dimensions, hard-resets the whole overlay runtime family through `0x00532590`,
  and that reset strip is no longer opaque either: the immediately preceding local helpers
  `0x00532310..0x00532550` now bound one compact overlay-local state family under the same owner.
  `0x00532310/0x00532360/0x00532370/0x00532380` own the seven-dword companion block
  `[world+0x15b5..+0x15cd]` together with live flag byte `[world+0x15b4]`; `0x005323f0`,
  `0x00532460`, and `0x00532490` are the ensure, publish, and query strip for cached surface root
  `[world+0x478]` using saved dimensions `[world+0x159c/+0x15a0]`; `0x005324e0/0x00532500` are the
  live-flag setters for `[world+0x159b]`; `0x00532510` is the direct setter for mode byte
  `[world+0x159a]`; and `0x00532520/0x00532550` own the four-dword saved dimension quad
  `[world+0x15a4..+0x15b0]`. So the broader `0x00532590` reset really does sit at the base of a
  concrete local cached-surface and companion-block owner family, not just a pile of unrelated
  presentation fields. The reinitializer then
  reinitializes the secondary-overlay family for those dimensions, and then republishes the
  neighboring overlay constants and support owners used by both the world-side reattach branch and
  the `.smp` restore-side presentation rebuild path, including several owners that all funnel
  through the shared static-template slot allocator `0x00532ad0` over the local `0x100` pointer
  band at `[world+0x08]`. Those neighboring owners are tighter now too: `0x00535070` is the small
  primary overlay-surface-or-template setup owner; `0x00535100` is the heavier requested-dimension
  apply and four-slot overlay-surface rebuild owner used by the setup-side regenerate branch and
  the load-side bundle path; while `0x005356e0` and `0x00535890` seed two
  larger static-template slot bands rooted at `[world+0x1568/+0x156c/+0x1574/+0x1578]` and
  `[world+0x1560/+0x1564]` respectively; the remaining heavier sibling `0x00535430` now reads as a
  shared four-slot overlay-surface rebuild owner that resamples one source or fallback descriptor
  into a short local slot strip above `[world+0x155c]`. The immediate helper strip under that same
  family is tighter now too: `0x00534f60` is the small presentation-owner base init above
  `0x00532590`; `0x00534f80` releases one transient surface handle at `[world+0x478]` and clears
  byte `[world+0x159b]`; `0x00532760` releases the current overlay slot chosen by selector
  `[world+0x1558]`; `0x005327a0` clamps two requested surface dimensions down to supported
  power-of-two sizes while also enforcing shell display caps from `[0x006d4024+0x114243/+0x114247]`;
  `0x00532860` is the local twelve-slot stitching pass over the parallel bands rooted at
  `[world+0x08/+0x0c/+0x18]`, copying terminal rows and edge dwords between those sibling slot
  surfaces before finalizing the primary band through `0x00541c10`;
  `0x00532960` is the adjacent paired projection helper that maps two caller counters through the
  current `16x16` and `4x4` rounded grid quanta and writes the resulting coarse offsets back to two
  out-pointers;
  `0x005329e0` maps one `(x,y)` pair into a `1`-based coarse `4x4` overlay region id using the
  current rounded grid dimensions; `0x00532a30` is the direct getter for local dword `[world+0x1554]`,
  which still reads only as the live count or tag for this overlay slot band;
  `0x00532a40` and `0x00532aa0` are the time-selected query helpers over the first and second
  template-seeded slot bands rooted at `[world+0x1568/+0x156c]` and `[world+0x1560/+0x1564]`; and
  `0x00532a90` is the direct getter for trailing fallback slot `[world+0x1578]`. The next adjacent
  owner is tighter now too: `0x00532b30` is the shared release/reset path for the local overlay
  slot band at `[world+0x08]`, with a split release policy keyed by shell flag
  `[0x006d4024+0x11422e]` and a special forced-direct range for slot ids `1..0x10`, after which it
  clears band fields `[world+0x1554/+0x1568/+0x1570/+0x155c/+0x1560/+0x1564]`. The tail of that
  same reinitializer is tighter one level up too: `0x00527ce0` is the broader ensure owner that
  watches current grid extents plus world tag `[world+0x2121]`, re-enters `0x00532860` when those
  cached values change, rebuilds or releases local helper `[this+0x65]`, and then clears the two
  large global scratch planes rooted at `0x008f2520` and `0x00b33530`. The tail of that same
  reinitializer is
  tighter now too: after the larger support-family setup it seeds one seven-entry default overlay
  companion set through `0x005373b0`, whose inner allocator `0x00535950` populates the local
  `0x1b`-entry slot table from the static template rows `0x005dd300..0x005dd378`. The lifecycle
  side is tighter in the same way now: `0x00536044` is the shared teardown owner that frees those same
  three five-entry support families together with both mask planes, the packed secondary raster,
  the vector-byte planes, the local staging buffer, and the neighboring sidecar or coarse-cell
  tables. The remaining base-float lane is tighter too: the larger rebuild owner
  `0x00538360` now clearly writes one base float-summary field into `[world+0x1605]`, clears both
  one-byte mask planes, and then only repopulates the primary mask plane `[world+0x1655]` for the
  qualifying class-`1` interior cells before re-entering `0x00532d90` to normalize that base
  float-summary plane globally and `0x00532f60` to expand positive cells through one caller radius.
  That asymmetry is now enough to close the local semantic edge: `[world+0x1655]` is the actively
  rebuilt primary overlay mask, while `[world+0x1659]` is only the separately seeded and persisted
  secondary mask sibling with no comparably grounded distinct read-side consumer. The only grounded
  getter call to its root accessor `0x00533b60` is the shell staging branch at `0x00525bad`, and
  that branch immediately discards the returned pointer. The bundle side is now explicit too:
  `.smp` save-load treats the two mask planes as separate payloads with chunk ids `0x2cee` for
  `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, while the neighboring `0x2d49/0x2d50`
  branches are the separate packed secondary-raster import lanes rather than alternate consumers
  of the second mask plane. So, in the mapped local code, `0x1659` is best treated as a persisted
  compatibility or seed-state sibling, not as a second actively consumed runtime overlay mask. The
  transport/pricing preview side is tighter now too: `0x00538060` sits directly beneath
  `0x0044faf0`, first seeds one preview handle through `0x00535430` using the short `C_`
  descriptor, temporarily overrides shell globals
  `[0x006d4024+0x11423b/+0x11423f/+0x114254/+0x114255]`, and then loads `%1.tga` through
  `0x0053c1c0 -> 0x00541970`. It clamps that sampled image into the `0x401 x 0x401` range,
  rewrites `[world+0x1605]` plus the mask/raster family `[world+0x1655/+0x1659/+0x165d]` from the
  sampled pixels, optionally re-enters `0x00532d90/0x00532f60`, republishes the seeded preview
  handle through `0x0053c000`, and then re-enters `0x005375c0(1, 0, 0)`. The small shell-global
  owner it also touches is tighter now too: `0x006d401c` is constructed by `0x00538640`,
  `0x005386e0` publishes the primary timed text lane, `0x005387a0` publishes the secondary fixed
  `10000` ms lane, `0x00538810` finds the first registered shell window containing one child
  control id by walking each window through `0x0053f830`, and `0x00538840/0x00538880/0x00538890`
  manage the owner's local `1000`-slot active-token table keyed by child control id. The adjacent
  list strip is tighter too: `0x00538990` is the registered-window virtual-slot-`0` gate that
  stops on the first zero return, `0x005389c0` is the shared unlink helper for the same doubly
  linked list rooted at `[owner+0x00/+0x04]`, `0x00538a60` is the zero-counter gate over
  `[owner+0xc60]`, `0x00538a70` is the matching full reset-and-release body used during bootstrap
  teardown, and `0x00538a10/0x00538a20/0x00538a30/0x00538a40` are the direct getter, setter,
  increment, and clamped decrement helpers for the owner's scalar lanes `[+0xc5c]` and `[+0xc60]`.
  The next shell-runtime strip is tighter now too: `0x005388d0` is the shared `12`-dword
  descriptor dispatcher with the optional override validator at `[owner+0xc75]` and the recursive
  `kind 6 -> 0xb7` rewrite; `0x00538c70` is the prioritized cached-text owner over
  `[owner+0xbd8/+0xbdc/+0xbe0/+0xbe4]` that emits descriptor kind `0xae` through `0x005388d0`;
  `shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars` `0x00538e00` is the five-scalar
  descriptor-synthesis wrapper above that same dispatcher;
  `0x00538e50` is the sorted registered-window insert owner over node key `[node+0x21]`;
  `0x00538ec0` is the refresh sweep over the indexed helper collection rooted at `[owner+0xc69]`;
  and `0x00538f10` is the broader optional-window publish plus blocking descriptor loop used by
  modal launchers and some shell transition paths.
--- a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md
+++ b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md
--- a/docs/control-loop-atlas/station-detail-overlay.md
+++ b/docs/control-loop-atlas/station-detail-overlay.md
@ -0,0 +1,148 @@
 # Input, Save/Load, and Simulation: Station-detail Overlay
 ### Station-detail overlay
 The shell-side candidate preview pair now has a grounded world consumer
  too. `world_render_station_candidate_service_map_overlay` at `0x0043f640` reads the active
  `(station id, candidate id)` pair from
  `world_store_station_detail_candidate_service_preview_pair_globals` `0x0043f620` and
  `world_clear_station_detail_candidate_service_preview_pair_globals` `0x0043f610`, scans the
  placed-structure collection, and then splits the legend by candidate mode. When the active candidate carries a
  nonzero route-style byte at `[candidate+0x46]`, the overlay uses the heavier helper
  `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` in both
  directions between the preview station and each scanned site and formats the resulting directional
  rows as `3874` `Coming To %1` and `3875` `Going From %1`. When that byte is zero, the same overlay
  falls back to the direct local-service path through
  `placed_structure_query_candidate_local_service_metrics` and formats the two legend rows instead
  as `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes
  collapse to `3878` `--None--`, and one title lane falls back to literal `All`. Current disassembly
  no longer supports treating `3872` `Already Connected by Another Company` or `3873` `Not
  Connected` as direct overlay-body emits.
 #### Corrected boundary
 The neighboring connection-state note pair now appears
  to live in a city connection-bonus label formatter, not in `0x0043f640`. That formatter is now
  bounded as `city_site_format_connection_bonus_status_label` at `0x004207d0`: it directly chooses
  localized ids `3868` through `3873` after consulting the reusable city-peer scan
  `city_connection_bonus_exists_matching_peer_site` at `0x00420030`. Separately, `3879` `Out of
  Sync` is grounded under the multiplayer preview dataset path instead:
  `multiplayer_preview_dataset_service_launch_state_and_warn_out_of_sync` at `0x0046b780` checks
  global `0x006cd91c`, raises the `Out of Sync` shell status through `0x5386e0`, and then continues
  through the wider multiplayer preview launch-state service. So the station-detail overlay
  currently owns only the `Coming To`, `Going From`, `Current Supply`, `Current Demand`, `--None--`,
  and `All` legend lanes.
 #### Ownership side
 One reusable site helper is grounded now too.
  `placed_structure_query_linked_company_id` at `0x0047efe0` resolves the current placed structure's
  linked instance through `0x0062b26c` and returns its company id from `[instance+0x276]`; the
  adjacent city bonus formatter at `0x004207d0` compares that id against the active company selector
  before choosing whether a scanned site should carry `3871` `Connected By Another Company` or
  `3872` `Already Connected by Another Company`. The larger caller boundary is no longer open
  either: the first bounded announcement owner above this formatter family is now
  `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, which re-enters the
  peer-route candidate builder at `0x004046a0` and later publishes one of the localized
  city-connection bonus news strings `2888`, `2890`, or `2921` through the shell news path.
 #### Peer-selector side
 The city bonus formatter no longer depends only on
  boolean peer existence. The companion helper
  `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` is now grounded as the
  first-match selector paired with `city_connection_bonus_exists_matching_peer_site`: it walks the
  same city-peer candidate set, applies the same site-class table plus the narrower
  station-or-transit and linked-instance class-byte flags, and returns one representative matching
  peer site id instead of a boolean. `city_site_format_connection_bonus_status_label` reuses that
  selector after the note checks so it can recover one linked company context from the selected
  peer. The remaining open edge here is therefore above this formatter family, not inside the
  peer-scan pair itself.
 #### Caller side
 The reusable bridge between the status formatter and the
  company news lane is now bounded too. `city_connection_bonus_build_peer_route_candidate` at
  `0x004046a0` reuses `city_connection_bonus_select_first_matching_peer_site` with both selector
  flags forced on, samples the selected peer's derived coordinates through `0x0047df30` and
  `0x0047df50`, and then either tries the shared heavy builder
  `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0` or falls
  back to the smaller wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry`
  `0x00404640` before handing the result back to the company-side announcement sweep at
  `0x00406050`. The score side of that announcement lane is tighter now as well:
  `city_compute_connection_bonus_candidate_weight` at `0x004010f0` provides the per-city opportunity
  weight, `company_query_min_linked_site_distance_to_xy` at `0x00405920` provides the nearest
  linked-site distance term, `company_count_linked_transit_sites` at `0x00426590` provides one of
  the company-side caps, `company_compute_connection_bonus_value_ladder` at `0x00425320` supplies
  the bounded company-side value scalar, and
  `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580` now bounds the
  shared prime-rate-side helper that this lane reuses beside the raw issue-`0x39` total,
  `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` now bounds the raw additive
  issue-total helper beneath that term, and `company_connection_bonus_lane_is_unlocked` at
  `0x00427590` is the small boolean gate above the ladder. Wider governance and CompanyDetail xrefs
  now tighten slot `0x2b` into the rolling net-profits lane reused by annual finance checks and a
  per-share/history formatter, while the report-history descriptor table now aligns raw slot `0x09`
  with the Income Statement fuel-cost lane surfaced by tooltip `1309`. The wider result now reads
  more like recent net profits minus recent fuel burden than a governance-pressure term. That now
  also sharpens the annual finance lane at `0x00401c50`: the first bankruptcy branch reads as
  sustained cash-and-debt stress over recent profits and fuel burden, the later fallback branch as
  a deeper `-300000` cash / three bad years cleanup trigger, and the later stock-issue branch reads
  as a price-to-book-versus-coupon approval ladder rather than a generic support vote. The tail is
  cleaner now too: it compares total retired versus newly issued principal to choose the `2882..2886`
  debt headline family, then publishes `2887` separately from the accumulated repurchased-share
  count. The sibling news owner above the same
  city-pair route family is bounded now too:
  `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`
  filters and scores candidate city entries, re-enters the same shared heavy builder through
  `city_connection_try_build_route_between_region_entry_pair` `0x00404c60` for the dense pair
  sweep and the final retry, and then publishes `2889` `%1 has started a new company - the %2`
  or `2890` `%1 has connected %2 to %3.` through the shell news path. The remaining open edge on
  this branch is therefore narrower now: it is mostly whether `0x39` should be read as the
  narrower city-connection public-opinion lane or as part of a broader management-attitude family,
  not the ownership of the connection-bonus formatter, peer-route candidate path, or company news
  gate.
 #### Route-list side
 The neighboring helper
  `placed_structure_append_unique_route_entry` at `0x0047f010` is now grounded as the
  append-if-missing builder for the six-byte route-entry list rooted at `[site+0x462]` and
  `[site+0x466]`. That matters here because the directional overlay query at `0x0047e690` consumes
  the same list, so the remaining uncertainty is no longer list ownership. It is down to the exact
  semantics of each entry's `u32` payload.
 #### Route-entry and Cache Side
 The adjacent helper strip is tighter now too.
  `placed_structure_service_candidate_local_service_comparison_cache_decay_and_row_propagation`
  `0x0047df70` is the recurring age-and-propagation service pass over the paired comparison-cache
  float tables `[site+0x3e]` and `[site+0x112]` with age stamps at `[site+0x1e6]`; it zeroes stale
  entries older than `0x1d8800`, decays younger ones by the fixed `0x005ce900/0x005ce8f8` scales,
  and then propagates stronger marked row values back through the three five-float row bands rooted
  at `[site+0x24/+0x28/+0x2c]`. The wrapper
  `placed_structure_query_candidate_route_or_local_service_comparison_score` `0x0047e9a0` is now
  bounded too: it delegates to `placed_structure_query_candidate_directional_route_overlay_summary`
  `0x0047e690` when the requested candidate carries a grouped routing class, otherwise it uses the
  simpler local `[cell+0x103]` lane and the current sample list at `[site+0x34/+0x38]` before
  writing back into the same comparison-cache bands. The route-entry strip beneath the linked-peer
  family is no longer open either: `placed_structure_resolve_route_entry_anchor_record`
  `0x0047f310` is the direct resolver over `[site+0x08]`, and
  `placed_structure_route_anchor_matches_or_reaches_route_entry_id` `0x0047f250` is the boolean
  gate above it, first checking a direct match against `[site+0x08]` and then re-entering
  `0x0048e050(mode 2, fallback -1)` on the resolved route-entry record. The route-link companion
  `route_link_route_entry_reaches_peer_site_route_group` `0x0047f2d0` is tighter now too: it reads
  the peer site's route-entry anchor from `[peer+0x08]`, resolves the current link's own anchor,
  and re-enters `0x0048e3c0` to test whether the two anchors belong to the same reachable
  route-side family. One smaller linked-peer-side setter is grounded as well:
  `placed_structure_set_overlay_mark_byte_and_refresh_linked_peer_overlay_if_changed` `0x0047f290`
  updates byte `[site+0x5bc]` and then re-enters
  `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0` when the
  byte changes.
 #### Terrain-class Side
 The nearby linked-instance raster wrappers are no
  longer anonymous. `world_resolve_secondary_raster_class_record_at_float_xy` `0x0044e270` is the
  world-side float-XY lookup over `[world+0x2131]` plus class table `0x006cfc9c`;
  `placed_structure_query_linked_instance_secondary_raster_class_id` `0x0047f170` is the raw
  linked-instance wrapper that returns the shifted class id directly; and the paired
  record-returning wrappers `placed_structure_resolve_linked_instance_secondary_raster_class_record`
  `0x0047f0e0` and
  `placed_structure_resolve_linked_instance_secondary_raster_class_record_via_world_query`
  `0x0047f1f0` now bound the two record-returning lanes used by the later world-side and
  linked-peer filters. That means the remaining uncertainty in this neighborhood is no longer the
  route-entry or terrain-class helper ownership; it is the broader user-facing meaning of the later
  callers that consume those gates.