From aaf9310e620bd320dc6a0d1375000c95f5acc556 Mon Sep 17 00:00:00 2001 From: Jan Petykiewicz Date: Tue, 14 Apr 2026 01:57:02 -0700 Subject: [PATCH] Tighten atlas seam annotations for transport and load/save --- artifacts/exports/rt3-1.06/function-map.csv | 59 +++-- docs/control-loop-atlas/editor-breadth.md | 62 +++-- .../multiplayer-session-and-transport-flow.md | 29 ++- ...tion-paintterrain-and-save-load-restore.md | 243 +++++++++++++----- ...ntime-roots-camera-and-support-families.md | 26 +- 5 files changed, 299 insertions(+), 120 deletions(-) diff --git a/artifacts/exports/rt3-1.06/function-map.csv b/artifacts/exports/rt3-1.06/function-map.csv index 6577f3f..2e7313b 100644 --- a/artifacts/exports/rt3-1.06/function-map.csv +++ b/artifacts/exports/rt3-1.06/function-map.csv @@ -265,7 +265,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0041e970,121,structure_candidate_collection_refresh_filter_and_year_visible_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide counter refresh over the live structure-candidate pool at `0x0062ba8c`. The helper clears aggregate counts `[this+0x242]` and `[this+0x31a]`, then walks all `0x35` candidate slots through the collection accessors. For each live slot it stores the cargo-economy or editor-filter flag `[entry+0x56]` into one per-slot band rooted at `[this+0x246]`, increments `[this+0x31a]` when that flag is nonzero, re-enters `structure_candidate_is_enabled_for_current_year` `0x0041e220`, stores that result into the paired per-slot band rooted at `[this+0x16e]`, and increments `[this+0x242]` when the year-visible gate succeeds. Current grounded callers include the periodic boundary-service path at `0x0040a56a`, the post-fast-forward setup tail at `0x00437192`, the cargo-economy filter refresh family at `0x0041eac0/0x0041f584`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring locomotive-side bridge at `0x00464aa8`, so this is the safest current read for the shared candidate-collection filter and year-visible count rebuild rather than a one-off world-entry helper.","objdump + local disassembly + caller correlation + candidate-count correlation + year-visible correlation" 0x0041f4e0,77,structure_candidate_collection_construct_and_stream_load_records_then_refresh_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the live structure-candidate collection rooted at `0x0062ba8c`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c997c`, clears the three named-candidate id slots `[this+0x88/+0x8a/+0x8c]`, seeds the collection through `0x00518570` with literal tuple `(1, 0xd0, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` `0x0041ede0` plus `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`. Current grounded caller is the world-entry load branch at `0x00438c5c`, which stores the finished object into global `0x0062ba8c`, so this is the safest current read for the constructor above the structure-candidate tagged load seam rather than a generic collection allocator.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation" 0x0041f530,89,structure_candidate_collection_release_live_entries_reimport_tagged_records_and_refresh_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation + reset-path correlation,3,"Reset-side sibling over the live structure-candidate collection at `0x0062ba8c`. When the collection currently holds live entries, the helper walks every live id through `0x00518380/0x00518140` and dispatches entry vtable slot `+0x08` to release per-entry state, then clears the three named-candidate id slots `[this+0x88/+0x8a/+0x8c]`, re-enters `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` `0x0041ede0`, and finally reruns `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`. Current grounded callers are the later post-load count-refresh family and nearby world-entry restore branches, so this is the safest current read for the in-place candidate reset or reimport sibling rather than a standalone destructor.","objdump + local disassembly + caller correlation + reset-path correlation + entry-release correlation" -0x0041e9f0,87,cargo_collection_find_entry_by_exact_name,map,thiscall,inferred,objdump + local disassembly + collection-correlation,3,"Exact string matcher over the live cargo collection at `0x0062ba8c`. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the caller-supplied token string against each entry name at `[cargo+0x04]` through `0x005a57cf`, and returns the first matching cargo entry pointer or null. Current grounded callers are the recipe-runtime importer `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and its neighboring collection service branches around `0x0041ea50`, so this now looks like the shared live cargo-name resolver beneath recipe import and setup-side cargo text matching rather than an anonymous collection walk.","objdump + local disassembly + collection-correlation + caller correlation" +0x0041e9f0,87,cargo_collection_find_entry_id_by_exact_name,map,thiscall,inferred,objdump + local disassembly + collection-correlation,3,"Exact string matcher over the live cargo collection at `0x0062ba8c`. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the caller-supplied token string against each entry name at `[cargo+0x04]` through `0x005a57cf`, and returns the first matching live cargo entry id from `0x00518380` or `0` on failure. Current grounded callers are the recipe-runtime importer `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and its neighboring collection service branches around `0x0041ea50`, so this now looks like the shared live cargo-name-to-id resolver beneath recipe import and setup-side cargo text matching rather than an anonymous collection walk.","objdump + local disassembly + collection-correlation + caller correlation + return-value correction" 0x0041ea50,179,structure_candidate_collection_run_post_load_local_service_setup_phase,map,cdecl,inferred,objdump + local disassembly + caller context,3,"Post-load world-generation subphase over the live structure-candidate collection at `0x0062ba8c`. The helper derives one modulo-`6` bucket from current world byte `[0x006cec78+0x0f]`, then walks the full collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. When the caller-supplied phase flag is zero it only dispatches candidates whose loop ordinal falls into that current modulo bucket; otherwise it runs the full pass. Every selected candidate is then forwarded into `structure_candidate_rebuild_local_service_metrics` `0x0041e2b0`. Current grounded callsite is the early candidate sweep inside `world_run_post_load_generation_pipeline` `0x004384d0` immediately before the localized progress update `Setting up Players and Companies...`, so this is a candidate-local post-load setup phase rather than a building-collection owner.","objdump + local disassembly + caller context + collection-correlation + modulo-bucket correlation" 0x0041e220,52,structure_candidate_is_enabled_for_current_year,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper.","objdump + caller xrefs + callsite inspection + cargo-economy filter correlation" 0x0041e650,142,structure_candidate_query_route_style_or_local_availability_metric,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + collection-correlation,3,"Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader.","objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation" @@ -383,13 +383,14 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00435b50,1764,world_service_year_threshold_news_and_structure_milestone_notifications,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"World-side year-threshold and structure-milestone news owner beneath periodic simulation and startup bring-up. The helper reads the current packed year at `[0x006cec78+0x0d]`, suppresses itself when scenario gate `[0x006cec78+0x46c38]` is live or when cached prior-year field `[0x006cec78+0x05]` already matches, and then services several threshold families. Fixed threshold years `0x749/0x767/0x780/0x7a6` (`1865/1895/1920/1958`) publish paired localized ids `0x157..0x15e` through `0x005193f0` and append the resulting fixed records into collection `0x006cea4c` through `0x00473f80`. Years `0x73a/0x76c/0x79e` build three formatted numeric fragments through `0x0051b700`, splice them into localized id `0x15f`, and publish the finished notice through `0x004337c0`. The later milestone branch resolves specific candidate stems through `0x00412af0`, counts matching live placed structures through `0x004138f0`, and for year `0x755` also combines those counts with localized text fragments `0x161..0x165` before queueing one news record through `0x004337c0`; the single-stem branches at `0x7a4/0x789/0x794` instead publish localized ids `0x166/0x167/0x168` directly when at least one matching live structure exists. Current grounded caller is the periodic boundary work branch at `0x0040a6f7`, so this is the safest current read for the shared year-threshold and structure-milestone news owner rather than a generic date-change helper.","objdump + local disassembly + caller correlation + year-threshold correlation + structure-milestone correlation + news-record correlation" 0x0043ad50,227,world_view_query_city_label_alpha_byte_from_normalized_xy_and_view_scalars,shell,thiscall,inferred,objdump + local disassembly + caller xrefs,3,"Small bounded-byte helper beneath the city-site label formatters at `0x004207d0` and `0x004613d0`. The caller supplies rounded normalized `(x,y)` values, while the helper samples the current world-view state at `0x0062be68`: it first tests the view scalar at `[this+0x14]` against a three-band threshold ladder, returning `0` on the lowest band, `0xff` on the saturated band, and otherwise deriving one provisional byte through scaled subtraction and integer rounding. It then folds in the auxiliary view scalars at `[this+0x1c]` and `[this+0x24]` through the shared x87 rounding helper `0x005a10d0` and finishes by returning one bounded byte-like priority or alpha value in `EAX`. Current grounded callers use any nonzero result to arm a highlighted city-label style and only splice the returned byte into the top color lane when it stays below `0xff`, so the safest current read is a world-view-dependent city-label alpha-byte query rather than a generic camera scalar helper.","objdump + local disassembly + caller xrefs + city-label correlation" 0x00434ea0,124,scenario_state_query_named_candidate_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named candidate-availability collection at `[this+0x66b2]`. The helper normalizes the first byte of the caller-supplied candidate name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x1e]`; otherwise it returns zero. The insert sibling `0x00434f20` shows the exact record shape now too: each collection entry is a zero-initialized `0x22`-byte blob with a fixed zero-terminated name slot at `[entry+0x00..+0x1d]` and one trailing availability dword at `[entry+0x1e]`. Current grounded callers are the runtime refresh pass `0x00412c10`, the editor-side detail and summary formatters at `0x004cc209`, `0x004cdfa3`, `0x004d14b8`, and `0x004d1684`, and the same startup-side candidate filter family that later writes `[candidate+0x7ac]`. This is therefore the current safest read for the candidate-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation" -0x00434f20,272,scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437743` and `0x00436ad7` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation" +0x00434f20,272,scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437737` and `0x00436ad7` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation" 0x00435030,124,scenario_state_query_named_locomotive_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named locomotive-availability collection at `[this+0x66b6]`. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x3d]`; otherwise it returns zero. The insert sibling `0x004350b0` shows the exact record shape now too: each collection entry is a zero-initialized `0x41`-byte blob with a fixed zero-terminated locomotive-name slot at `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`. Current grounded callers are the shell-side `Locomotives` availability page constructor `map_editor_locomotive_availability_panel_construct` `0x004cd680`, the locomotive-side stats and summary branches at `0x004d0e5f` and `0x00461ed5`, and the neighboring startup or restore-side upsert family at `0x00438d6b` and `0x004478ea`. This is therefore the safest current read for the locomotive-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-availability correlation + record-layout correlation" 0x004350b0,249,scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named locomotive-availability record into the scenario-side collection at `[this+0x66b6]` and then refreshes dependent runtime locomotive usage state. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches existing names through `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the locomotive-availability dword at `[entry+0x3d]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x41`-byte record, copies the supplied zero-terminated locomotive name into `[entry+0x00..+0x3c]`, and seeds that same trailing dword. When the live locomotive pool `0x006ada84` exists it then re-enters `0x00461e00`, where the queried value is later stored into `[loco+0x7b]`. The write-side caller set is now tight enough to close the remaining semantic gap here too: the grounded startup or restore-side seeding lanes at `0x00438d6b`, `0x004478ea`, and `0x00461eab` and the shell-side `Locomotives` availability handler family at `0x004cf178`, `0x004cf1fe`, `0x004cf2f9`, and `0x004cf3fc` all supply only boolean values, so `[entry+0x3d]` now reads safely as a real locomotive-availability override bit rather than a broader policy enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-runtime-refresh correlation + record-layout correlation + callsite-argument correlation" 0x004351c0,1099,scenario_state_rebuild_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Broader rebuild owner for the compact scenario-side year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. The helper first samples one shell presentation scalar through `0x006d4024 -> [controller+0x18] -> [object+0x15]`, chooses one of three range profiles from that scalar (`<0x28`, `<0x46`, or later), and seeds base lane `[this+0x61]` to `0xff`, `0xc8`, or `0xe6` together with one paired year-span scalar derived from the fixed `0x5a0` multiplier. It then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` on the current year `[this+0x15]`, queries three companion shell integers through `0x00527cc0`, folds those shell-side values into one normalized offset, and writes the rebuilt threshold quartet into `[this+0x51]`, `[this+0x55]`, `[this+0x59]`, and `[this+0x5d]` through the shared x87 rounding helper `0x005a10d0`. The same owner also contains the shell-facing follow-on hidden by the tiny ensure wrapper `0x00435603`: when the caller stack flag is nonzero, or when the current shell progress scalar falls outside the rebuilt band, it computes one interpolated or clamped `0..255` presentation value from current year `[this+0x15]`, base byte `[this+0x3a]`, floor `[this+0x61]`, and the rebuilt threshold quartet, then republishes that value into the current shell presentation object through `0x00523d60`. Current grounded callers are the ensure wrapper `0x00435603`, the shell command `0x004412e0`, the shell-state setter path around `0x00482878`, the compact runtime-effect side branch at `0x00431e03`, and the world-entry late rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the actual year-threshold rebuild owner beneath selected-year restore and shell progress refresh rather than another anonymous math body.","objdump + local disassembly + caller correlation + year-threshold-band correlation + shell-progress-followon correlation" +0x00436c70,37,scenario_state_check_special_tutorial2_signature_gate,map,cdecl,inferred,objdump + local disassembly + string inspection + caller correlation,2,"Small special-case gate immediately above the broader scenario reset owner `0x00436d10`. The helper returns true only when the caller selector equals `0x10`, the current world root at `0x0062c120` reports map dimensions `0x180 x 0x1c0`, the live city collection `0x0062bae0` reports exactly `0x41` entries, the first live city name at `[entry+0x356]` matches `Italy - North`, the current shell-side file or scenario root at `0x0062be18` passes `0x4331e0 == 0x16`, and its row `7` subtype byte `[row+0x7ef]` equals `6`. The nearby string table points at `Tutorial_2.gmp`, so the safest current read is one hard-coded tutorial-signature predicate rather than a generic map-size or city-count checker.","objdump + local disassembly + string inspection + caller correlation + special-case-signature correlation" 0x00436af0,384,scenario_state_refresh_cached_available_locomotive_rating_from_year_baseline_and_live_availability_gates,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]` with explicit tiers `110.0` through year `2000`, `200.0` after `2000`, and `300.0` after `2010`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, resolves the linked era through `[loco+0x72]`, filters each locomotive through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. The winning rating is forced to at least `1.0`, normalized, and clamped into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper.","objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation + year-baseline correlation" 0x004367c0,92,world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + RT3.lng strings,3,"Small world-side outcome-status helper. The caller-supplied mode dword is stored into `[this+0x4a73]`, world flag `[this+0x4d]` is cleared, and the current selected-year snapshot byte `[this+0x15]` is copied into `[this+0x4c88]`. The helper then copies one fixed localized string into status buffer `[this+0x4b47]`: id `2923` `You lose.` when the incoming mode equals `1`, otherwise id `2924` `You win, cheater...`. Current grounded callers are the cheat-modal owner `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and the scenario follow-on command branch around `0x004648e1`, so this is the safest current read for the cheat-owned outcome-mode setter rather than a generic prompt publisher.","llvm-objdump + local disassembly + caller correlation + RT3.lng strings + outcome-buffer correlation" -0x00436d10,522,scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges,map,thiscall,inferred,objdump + caller xrefs + local disassembly,4,"Broader scenario-state reset or initialization owner over active world state `0x006cec78`. The helper first zeroes one contiguous late-state slab from `[this+0x4cc2]` for `0x9b` dwords plus one trailing byte, then separately clears the much larger late runtime slab rooted at `[this+0x66be]`. It seeds fixed default years `[this+0x66ca/+0x66ce/+0x66d2] = 0x726/0x7d0/0x74e`, seeds the sixteen 9-byte chairman-slot rows at `[this+0x69dc]` with default tuning `0x186a0`, and clears several now-grounded latch families explicitly: `[this+0x19/+0x21/+0x25/+0x29/+0x31/+0x3d/+0x41/+0x45/+0x49/+0x4d]`, outcome and cheat bands `[this+0x4a73/+0x4a77/+0x4a7b]`, the scenario-rule table `[this+0x4a7f..+0x4b3f]` plus trailing scalar `[this+0x4b43]`, the outcome text root `[this+0x4b47]`, the byte-policy and cached-scalar cluster `[this+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, and the trailing float strip `[this+0xbce..+0xbf6]` before reseeding the same six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `map_editor_economic_cost_slider_dispatch` `0x004ca980`: `+0xbde/+0xbe2 = 1.0f`, `+0xbe6/+0xbea/+0xbee/+0xbf2 = 0x3c75c28f`, and `+0xbf6 = 0x3ba3d70a`. It then zero-fills the twelve scenario recipe books at `[this+0x0fe7]` before copying one fixed default book template from `0x005c9f78` into each `0x4e1`-byte slot. It also destroys and recreates the two named-availability collections at `[this+0x66b2]` and `[this+0x66b6]` with fixed record sizes `0x22` and `0x41`, rebuilds selected-year and calendar state from the live profile plus shell gates into `[this+0x05/+0x09/+0x0d/+0x1d]` through `0x0051d3f0`, `0x0051d390`, `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, and `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, then re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0` before clearing several shell-controller-side cached state dwords under `0x006d4024+0x11425a..+0x114276`. Current grounded callers are the startup-profile dispatcher `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` and the world-entry coordinator `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared scenario-state reset-and-rebuild owner beneath startup and load paths rather than a smaller recipe-only helper.","objdump + caller xrefs + local disassembly + default-state correlation + economic-tuning-band correlation + named-availability-collection correlation + recipe-template correlation + selected-year-refresh correlation + runtime-bridge correlation + late-state-reset-cluster correlation" +0x00436d10,522,scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges,map,thiscall,inferred,objdump + caller xrefs + local disassembly,4,"Broader scenario-state reset or initialization owner over active world state `0x006cec78`. The helper first zeroes one contiguous late-state slab from `[this+0x4cc2]` for `0x9b` dwords plus one trailing byte, then separately clears the much larger late runtime slab rooted at `[this+0x66be]`. It seeds fixed default years `[this+0x66ca/+0x66ce/+0x66d2] = 0x726/0x7d0/0x74e`, seeds the sixteen 9-byte chairman-slot rows at `[this+0x69dc]` with default tuning `0x186a0`, and clears several now-grounded latch families explicitly: `[this+0x19/+0x21/+0x25/+0x29/+0x31/+0x3d/+0x41/+0x45/+0x49/+0x4d]`, outcome and cheat bands `[this+0x4a73/+0x4a77/+0x4a7b]`, the scenario-rule table `[this+0x4a7f..+0x4b3f]` plus trailing scalar `[this+0x4b43]`, the outcome text root `[this+0x4b47]`, the byte-policy and cached-scalar cluster `[this+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, and the trailing float strip `[this+0xbce..+0xbf6]` before reseeding the same six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `map_editor_economic_cost_slider_dispatch` `0x004ca980`: `+0xbde/+0xbe2 = 1.0f`, `+0xbe6/+0xbea/+0xbee/+0xbf2 = 0x3c75c28f`, and `+0xbf6 = 0x3ba3d70a`. It then zero-fills the twelve scenario recipe books at `[this+0x0fe7]` and only seeds their per-book name lane through the fixed format string `# %1` at `0x005c9f78`, using generated ordinal strings `1..12` via `0x0051b700` and `0x00518de0`; current local disassembly does not show it preloading any default line modes, amounts, or cargo-token strings into the later `+0x3ed/+0x3f1` recipe payload. It also destroys and recreates the two named-availability collections at `[this+0x66b2]` and `[this+0x66b6]` with fixed record sizes `0x22` and `0x41`, rebuilds selected-year and calendar state from the live profile plus shell gates into `[this+0x05/+0x09/+0x0d/+0x1d]` through `0x0051d3f0`, `0x0051d390`, `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, and `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, then re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0` before clearing several shell-controller-side cached state dwords under `0x006d4024+0x11425a..+0x114276`. Current grounded callers are the startup-profile dispatcher `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` and the world-entry coordinator `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared scenario-state reset-and-rebuild owner beneath startup and load paths rather than a smaller recipe-only helper.","objdump + caller xrefs + local disassembly + default-state correlation + economic-tuning-band correlation + named-availability-collection correlation + recipe-book-name-template correlation + selected-year-refresh correlation + runtime-bridge correlation + late-state-reset-cluster correlation" 0x0043cb00,295,world_view_step_heading_quadrant,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag.,objdump + caller xrefs + callsite inspection 0x0043cc30,437,world_view_step_zoom_bucket,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4.,objdump + caller xrefs + callsite inspection 0x0043d050,111,world_view_set_focus_position_xyz,shell,thiscall,inferred,objdump + caller xrefs,4,Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d.,objdump + caller xrefs @@ -530,10 +531,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004b3160,530,train_route_list_insert_staged_entry_at_index,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection + RT3.lng strings,4,"Inserts one staged `0x33`-byte route-entry record into the same train-owned route list at one caller-selected index. Before insertion the helper seeds parts of the staged record from the prior terminal route entry and preserves the currently grounded lower route-entry subflags `0x40`, `0x20`, and `0x10` in field `+0x28`. That same flag byte also carries the top-level entry split: sign bit clear entries use one live placed-structure id in field `+0x29`, while sign bit set entries use one direct route-node payload in field `+0x2b`. Only the live site-reference branch can re-enter the narrower tutorial gate `tutorial_validate_train_route_station_indicator_step` at `0x00516d00`, and only when the staged placed-structure id is station-or-transit-like and the shell tutorial family rooted at `0x006d3b4c` is active. The helper then allocates a `(count+1)` replacement buffer, copies the prefix rows, writes the staged record at the requested insertion index, copies the suffix rows, frees the old buffer, bumps the count, repairs the selected index, and refreshes the linked train-side state. Current grounded callers include the local `TrainDetail.win` insertion or staging branch at `0x00515417`, the multiplayer-side handlers at `0x004718e5` and `0x004097eb`, and the nearby validation path that surfaces localized reachability warnings `3090` `This train cannot reach the station you've selected.` and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the route-stop or waypoint insertion helper above that validation family rather than as a generic record copier.","objdump + caller xrefs + state-layout inspection + RT3.lng strings + insertion-buffer correlation + route-warning correlation + route-entry flag split + subflag preservation" 0x00516be0,284,tutorial_advance_step_and_refresh_expected_control_ids,shell,cdecl,inferred,objdump + caller xrefs + local disassembly + tutorial-table inspection,4,"Advances one active shell tutorial step and refreshes the small expected-control cache under `0x00622b34..0x00622b3c`. The helper first returns immediately when the tutorial-active flag at `0x006d3b4c` is zero; otherwise it increments the current tutorial step index at `0x006d3b50`, consults the `0x40`-byte descriptor table rooted at `0x00622b48`, and skips several currently grounded step codes when their extra world or shell-state predicates fail. After choosing the next live step it copies the previous expected control id from `0x00622b34` into `0x00622b38`, then loads the new expected control id and one current alternate-accepted control id from descriptor offsets `+0x34` and `+0x38` into `0x00622b34` and `0x00622b3c`. Current shell-command correlation is now tight enough to support that narrower reading: the generic shell control path around `0x004de199` and `0x004de724` compares incoming control ids directly against `0x00622b3c` and suppresses the tutorial-only `3587` rejection when they match, which makes `0x00622b3c` look like a current companion control id rather than a page or mode selector. The helper also rate-limits one small shell-side nudge through `0x0045ea20` while the tutorial runs. Current grounded callers are the generic shell control path at `0x00540cca` and the train-route tutorial validator at `0x00516d93`, which makes this the current best owner for the tutorial step-advance and expected-control cache instead of leaving `0x00622b34/38/3c` as anonymous globals.","objdump + caller xrefs + local disassembly + tutorial-table inspection + control-cache correlation + shell-command correlation" 0x00516d00,143,tutorial_validate_train_route_station_indicator_step,shell,thiscall,inferred,objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings,4,"Small shell-side tutorial gate used before one live station-or-transit site id is committed into the train route-entry list. The helper only matters while the tutorial state family rooted at `0x006d3b4c` is active: it consults the current tutorial step index at `0x006d3b50`, reads that step's code from the `0x40`-byte tutorial descriptor table rooted at `0x00622b48`, and accepts only the currently grounded step codes `0x172` and `0x17c`, which align with localized tutorial prompts `3777` `Click on the yellow station indicator for Milan.` and `3778` `Now click on the station indicator for Turin`. For accepted steps it stages the caller-supplied site id into `0x006d3b5c` and, in the second step, advances the surrounding tutorial state through `0x00516be0` only when the incoming site differs from the currently staged one. For incompatible tutorial steps it opens one callback-driven shell modal through `0x004c98a0` and returns `0`, which causes `train_route_list_insert_staged_entry_at_index` at `0x004b3160` to abort before the record is inserted. Current evidence is therefore tight enough to treat this as the tutorial-side train-route station-indicator validator rather than a general `TrainDetail.win` row-kind gate.","objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings + modal correlation" -0x00517d40,66,indexed_collection_entry_id_is_live,simulation,thiscall,inferred,objdump + caller inspection + collection-bitset inspection,4,"Shared indexed-collection presence test over the common collection layout that uses `[this+0x14]` as the upper id bound and `[this+0x34]` as the tombstone or disabled-bitset. The helper rejects nonpositive or out-of-range ids and otherwise returns `1` only when the bit for the requested id is clear, i.e. when the entry is currently live. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it guards ordinary candidate ids before `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and neighboring collection walkers that treat the same ids as positive live-record selectors rather than zero-based dense ordinals.","objdump + caller inspection + collection-bitset inspection + callsite correlation" +0x00517ce0,9,indexed_collection_base_init_vtable_5d1aa0,simulation,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Tiny common base initializer for the shared indexed-collection family. The helper only installs base vtable `0x005d1aa0` at `[this+0x00]` and returns the same pointer, leaving the actual collection-shape metadata to the later constructor helper `0x00518570`. Current grounded callers are the world-load constructors across support, candidate, era, train, profile, and region families, where this is the common first step before each concrete collection installs its own vtable and layout tuple.","objdump + local disassembly + constructor correlation + collection-base correlation" 0x00517cf0,3,indexed_collection_slot_count,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Tiny shared accessor that returns the current slot-count field `[this+0x18]` from the common indexed-collection layout. Current grounded callers use it as the upper bound for zero-based slot walks before resolving one nth live entry id through `indexed_collection_get_nth_live_entry_id` `0x00518380`.","objdump + caller inspection + collection-layout inspection + slot-walk correlation" +0x00517d40,66,indexed_collection_entry_id_is_live,simulation,thiscall,inferred,objdump + caller inspection + collection-bitset inspection,4,"Shared indexed-collection presence test over the common collection layout that uses `[this+0x14]` as the upper id bound and `[this+0x34]` as the tombstone or disabled-bitset. The helper rejects nonpositive or out-of-range ids and otherwise returns `1` only when the bit for the requested id is clear, i.e. when the entry is currently live. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it guards ordinary candidate ids before `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and neighboring collection walkers that treat the same ids as positive live-record selectors rather than zero-based dense ordinals.","objdump + caller inspection + collection-bitset inspection + callsite correlation" +0x00517d90,506,indexed_collection_serialize_header_and_live_entry_payload_band,simulation,thiscall,inferred,objdump + local disassembly + collection-layout inspection + caller correlation,4,"Shared indexed-collection save helper over the common collection layout. The serializer first writes the fixed scalar header dwords `[this+0x04/+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c]`, then four repeated auxiliary-band descriptors rooted at `[this+0x20..+0x2c]` with their paired dwords at `[this+0x48..+0x54]` and `[this+0x58..+0x64]`; when one auxiliary band is active after the first slot it also writes the corresponding `count*0x0c` payload table from `[band+0x18]`. It then writes the live/tombstone bitset from `[this+0x34]` as `ceil(([this+0x14]+8)/8)` bytes and walks every positive live entry id, skipping tombstoned rows through the same bitset. For direct collections with nonzero `[this+0x04]` it writes one fixed-stride record from `[this+0x30] + [this+0x08]*id`, optionally clamping to the caller-supplied byte limit and zero-filling the remainder of the stride. For indirect collections with zero `[this+0x04]` it instead writes one `u16` payload length plus the pointed variable-size payload for each live id. Current grounded callers are the tagged save owners across support, region, train, company, route-entry tracker, neighboring world families, and the early non-`.smp` package-save prelude on the two named-availability collections `[world+0x66b2]` and `[world+0x66b6]`, so this is the shared collection-header-and-live-entry serializer even for those named-availability saves rather than a helper limited to the larger tagged collection families.","objdump + local disassembly + collection-layout inspection + caller correlation + direct-vs-indirect payload correlation + save-helper correlation + named-availability caller correction" +0x00517f90,163,indexed_collection_grow_payload_bitset_and_auxiliary_link_bands_for_additional_ids,simulation,thiscall,inferred,objdump + local disassembly + constructor/load/add-entry correlation + collection-layout inspection,4,"Shared indexed-collection growth helper used by the constructor, load helper, and add-entry path. The helper expands the live-id bound from old `[this+0x14]` to the new requested total, reallocates the direct-or-indirect payload slab at `[this+0x30]` to `stride=[this+0x08] * new_bound` while copying old contents forward, reallocates the tombstone bitset at `[this+0x34]` to `ceil((new_bound+8)/8)` bytes while preserving old bytes and filling the newly added range with `0xff` so fresh ids start tombstoned, and then grows the three auxiliary link tables rooted at `[this+0x3c/+0x40/+0x44]` to the corresponding `id*3*4` byte bands while zero-filling each extension. It writes the new live-id bound back to `[this+0x14]` and resets the small cache band `[this+0x68..+0x74]` to `-0x10`. Current grounded callers are constructor helper `0x00518570`, load helper `0x00518680`, and the add-entry path `0x00518b90`, where this is the common grow-payload-bitset-and-aux-band owner rather than one family-specific allocator.","objdump + local disassembly + constructor/load/add-entry correlation + collection-layout inspection + reallocation correlation" 0x00518140,89,indexed_collection_resolve_live_entry_by_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared indexed-collection record resolver over the same common collection layout. The helper rejects nonpositive, out-of-range, or tombstoned ids through the `[this+0x14]` bound and `[this+0x34]` bitset, then returns one live record pointer from the payload rooted at `[this+0x30]`. When collection flag dword `[this+0x04]` is nonzero it treats that payload as a flat `stride=[this+0x08]` record array and returns `base + stride*id`; otherwise it treats the payload as an array of record pointers stored in `stride=[this+0x08]` slots and returns the pointer loaded from `base + stride*id`. Current grounded callers include the company, profile, train, and structure-candidate families, where it is the common bridge from one positive collection id to one concrete live record pointer.","objdump + caller inspection + collection-layout inspection + direct-vs-indirect payload correlation" 0x00518380,364,indexed_collection_get_nth_live_entry_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared nth-live-entry selector over the same indexed-collection layout. With traversal mode `0` it walks slot ids in forward order, skipping tombstoned ids through the bitset at `[this+0x34]`, and returns the positive entry id whose zero-based live ordinal matches the caller-supplied index; recent results are memoized in the small cache bands rooted at `[this+0x68]` and `[this+0x78]`. With nonzero traversal mode it reuses the auxiliary link banks rooted at `[this+0x38]`, `[this+0x48]`, and `[this+0x58]` to step through one alternate live-order chain before returning the resulting id. Current grounded callers across company, profile, structure-candidate, and placed-structure families mostly use traversal mode `0`, where this is the shared bridge from one zero-based live ordinal to one positive collection entry id.","objdump + caller inspection + collection-layout inspection + cache-band inspection + alternate-chain correlation" +0x00518570,138,indexed_collection_construct_seed_record_layout_slot_bounds_and_aux_band_tuple,simulation,thiscall,inferred,objdump + local disassembly + constructor correlation + collection-layout inspection,4,"Shared indexed-collection constructor helper above the base init at `0x00517ce0`. The helper stores the caller-supplied fixed-record flag at `[this+0x04]`, the primary slot stride or record size at `[this+0x08]` (forcing that field to `6` when the incoming flag is zero), the growth tuple at `[this+0x0c/+0x10]`, clears live-count `[this+0x14]`, slot-count `[this+0x18]`, allocator root `[this+0x1c]`, payload root `[this+0x30]`, and tombstone bitset `[this+0x34]`, seeds the four auxiliary-band roots `[this+0x20..+0x2c]` and their paired descriptor dwords `[this+0x48..+0x64]` from the last three caller-supplied arguments plus zeroed defaults, forces `[this+0x20] = 1`, seeds the small live-id cache bands `[this+0x68..+0x74]` to `-0x10`, and then re-enters `0x00517f90` to allocate the initial slot, bitset, and payload backing for the requested starting capacity in `[this+0x0c]`. Current grounded callers are the concrete collection constructors across support, candidate, era, region, profile, train, and multiplayer fixed-record families, where the tuple literals now explain why some file-side save headers look collection-shaped even when a given runtime save path later bypasses the shared serializer family.","objdump + local disassembly + constructor correlation + collection-layout inspection + allocation-followon correlation" +0x00518680,625,indexed_collection_refresh_header_auxiliary_bands_and_live_entry_payloads_from_stream,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + collection-layout inspection,4,"Shared indexed-collection load helper paired with serializer `0x00517d90`. The helper first invokes collection vtable slot `+0x00`, then reads the fixed scalar header dwords back into `[this+0x04/+0x08/+0x0c/+0x10]`, one temporary live-id bound later copied into `[this+0x14]`, current slot-count `[this+0x18]`, allocator root `[this+0x1c]`, the four auxiliary-band roots `[this+0x20..+0x2c]`, and their paired descriptor dwords `[this+0x48..+0x64]`. When the incoming live-id bound exceeds current `[this+0x14]` it re-enters `0x00517f90` to grow the payload and tombstone backing first. It then reloads the tombstone bitset at `[this+0x34]` and walks every positive id below `[this+0x14]`, zero-filling tombstoned rows while rehydrating live payloads either as direct fixed-stride records in `[this+0x30]` when `[this+0x04]` is nonzero or as indirect `u16`-length-plus-pointer payload rows when `[this+0x04]` is zero. The same loop also replays the nonzero auxiliary-band rows through `0x00518260` and refreshes the small live-id cache band `[this+0x68..+0x74]` back to `-0x10`. Current grounded callers are the tagged and packed-state load owners across support, company, train, route-entry, placed-structure, region, event, and city-database families, where this is the shared collection-header-and-live-entry refresh helper rather than one family-specific loader.","objdump + local disassembly + caller correlation + collection-layout inspection + direct-vs-indirect payload correlation + load-helper correlation" 0x0051c920,223,localization_lookup_display_label_by_stem_or_fallback,shell,thiscall,inferred,objdump + caller inspection + language-table correlation + static-table inspection,4,"Shared shell-side label helper that turns one ASCII stem string into one player-facing display label. The helper case-folds the first letter, scans the static `(stem, string-id)` table rooted at `0x006243c8`, compares candidate stems case-insensitively, and returns the localized text for the first matching string id through `0x005193f0` when that localized entry is nonempty. The current table correlation already grounds entries such as `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng ids `3202..3220`. When no table entry matches, the helper falls back to localized id `3866` `Could not find a translation table entry for '%1'`. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it sits directly above candidate field `[record+0x04]`, and several neighboring list and detail renderers that need one display label from the same stem family.","objdump + caller inspection + language-table correlation + static-table inspection + RT3.lng correlation" 0x0051d390,37,calendar_pack_unpacked_components_to_absolute_counter,support,fastcall,inferred,objdump + local arithmetic correlation + restore-path correlation,3,"Tiny calendar helper that converts one unpacked component set into the same mixed-radix absolute counter family later stored at `[world+0x15]`. It combines the fastcall component pair in `ECX/EDX` plus three stack-supplied scalar subfields as one `12 x 28 x 3 x 60` progression and returns the resulting absolute counter. Current grounded load or restore-side caller correlation comes from the selected-year rehydrate path in `world_load_saved_runtime_state_bundle` `0x00446d40`, where the helper is used after the mode-sensitive year adjustment to rebuild the final absolute counter from the staged calendar components before `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` republishes the derived tuple fields.","objdump + local arithmetic correlation + restore-path correlation + mixed-radix decode" 0x0051d3c0,44,calendar_point_pack_tuple_to_absolute_counter,support,fastcall,inferred,objdump + caller inspection + local arithmetic correlation,3,"Tiny packed-calendar helper that converts one local tuple rooted at the caller pointer in `ECX` into the same absolute calendar counter family later stored at `[world+0x15]`. It reads one year word plus four packed calendar subfields from `[tuple+0x00/+0x02/+0x04/+0x05/+0x06]`, combines them as one mixed-radix `12 x 28 x 3 x 60` progression, and returns the resulting scalar for direct subtraction against `[0x006cec78+0x15]`. That is now the strongest current read for the world-side calendar model: a packed year-plus-subfield point converted into one absolute counter rather than a plain year or month stamp. Current grounded finance caller is the stock-issue cooldown gate inside `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, where it converts the current issue tuple at `[company+0x16b/+0x16f]` before comparing that scalar against the active world counter.","objdump + caller inspection + local arithmetic correlation + finance-cooldown correlation + world-calendar-counter correlation + mixed-radix decode" @@ -567,11 +573,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004bc260,43,shell_world_surface_brush_query_cached_world_coords_and_selected_scalar,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny cached-parameter getter beneath the same shell world-surface brush family. The helper copies cached world coordinates `[this+0x80]` and `[this+0x84]` into the two caller out-pointers and returns the current selected scalar from table `0x00621e24[ordinal]`, where the ordinal is stored at `[this+0x78]`, through the third out-pointer. Current local field correlation keeps this bounded as the brush-family cached-parameter query rather than a generic subject getter.","objdump + local disassembly + field correlation + ordinal-table correlation" 0x004bc290,192,shell_world_surface_brush_refresh_ordinal_and_mode_button_rows,shell,thiscall,inferred,objdump + caller inspection + control-family correlation,3,"Shared control refresh helper for the shell world-surface brush family. The first loop restyles the ordinal strip `0x0fa1..0x0fa7` through `0x00540120`, highlighting the current selected ordinal at `[this+0x78]`. The second loop restyles the mode strip `0x0faa..0x0faf` by mapping the current mode dword `[0x006d0818+0x8c]` from `0x0e..0x13` into local indices `0..5` and highlighting the matching button through the same shell control helper. Current grounded callers are the ordinal-strip branch at `0x004bc3fc` and the mode-change path beneath `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the ordinal and mode button-row refresh owner rather than a generic widget restyler.","objdump + caller inspection + control-family correlation + ordinal-mode-strip correlation" 0x004bc350,1496,shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf,shell,thiscall,inferred,objdump + local disassembly + control-family correlation,3,"Shell-side message owner for one world-surface brush family whose current grounded controls are the shared main-world surface `0x07d6`, the ordinal strip `0x0fa0..0x0fa7`, and the mode buttons `0x0faa..0x0faf`. The `0x07d6` branch first resolves world coordinates through `0x00448ac0`, latches drag-active byte `[this+0x7c]`, stores the accepted world coordinate pair into `[this+0x80/+0x84]`, and caches the incoming scalar at `[this+0x88]`. When that latch is active, the helper dispatches the current mode dword `[0x006d0818+0x8c]` across six grounded edit branches: mode `0x0e` and `0x13` re-enter `world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias` `0x0044da70`; mode `0x0f` re-enters `world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate` `0x0044d4e0`; modes `0x10` and `0x11` re-enter `world_raise_companion_float_grid_toward_center_sample_in_rect` `0x0044d880`; and mode `0x12` toggles the secondary-raster low nibble through `world_secondary_raster_xor_cell_byte2_low_nibble_mask` `0x00448e20` before re-entering `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`. The same owner also routes the ordinal strip `0x0fa0..0x0fa7` through `0x004bc210/0x004bc290` and updates the shared brush ordinal at `0x00621e20`, while the mode buttons `0x0faa..0x0faf` dispatch `0x004ddbd0` with mode ids `0x0e..0x13`. Current evidence is strong enough to treat this as a shell world-surface brush and mode dispatcher even though the exact window-family resource name is still open.","objdump + local disassembly + control-family correlation + world-surface correlation + brush-mode correlation" -0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first mirrors the leading editor economic-tuning scalar from `[world+0x0be2]` back into runtime multiplier lane `[world+0x0bde]` and then runs the preliminary candidate-availability prepass at `0x00437743` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early candidate-local service pass `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation + pre-recipe-scalar mirror correlation + economic-tuning-band correlation" -0x00437743,93,world_preseed_named_candidate_availability_records_from_live_pool,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The helper is skipped once global threshold `0x00620e94` reaches `0x26ad`; otherwise it walks the live candidate pool at `0x0062b268` in reverse order, derives one boolean override bit, and upserts each surviving candidate stem into the scenario-side named availability table through `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on `0x006cec78`. That override bit is now tighter than the older structural read: any nonzero availability word at `[candidate+0xba/+0xbb]` forces the upsert with bit `0`, while zero-word candidates derive the bit from the subtype parity check on `[candidate+0x32]` via the local `2 xor subtype` path; those zero-word subtype cases are skipped only when the saved stage counter copy from `0x00620e94` is nonzero. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass that mirrors live candidate subtype or availability state into `[world+0x66b2]` before the visible progress phases begin, rather than another visible progress phase.","objdump + local disassembly + caller correlation + candidate-pool correlation + override-bit-derivation correlation" +0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first mirrors the leading editor economic-tuning scalar from `[world+0x0be2]` back into runtime multiplier lane `[world+0x0bde]` and then runs the preliminary candidate-availability prepass at `0x00437737` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early candidate-local service pass `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation + pre-recipe-scalar mirror correlation + economic-tuning-band correlation" +0x00437737,105,world_preseed_named_candidate_availability_records_from_live_pool,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The real function entry starts at `0x00437737`, where it first checks the shared stage counter at `0x00620e94` against threshold `0x26ad` and returns immediately once that earlier startup window has passed. Otherwise it walks the live candidate pool at `0x0062b268` in reverse order, derives one boolean override bit, and upserts each surviving candidate stem into the scenario-side named availability table through `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on `0x006cec78`. That override bit is now tighter than the older structural read: any nonzero availability word at `[candidate+0xba/+0xbb]` forces the upsert with bit `0`, while zero-word candidates derive the bit from the subtype parity check on `[candidate+0x32]` via the local `2 xor subtype` path; those zero-word subtype cases are skipped only when the copied stage-counter argument is nonzero. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass that mirrors live candidate subtype or availability state into `[world+0x66b2]` before the visible progress phases begin, rather than another visible progress phase.","objdump + local disassembly + caller correlation + candidate-pool correlation + override-bit-derivation correlation + entry-boundary correction" 0x00438890,644,shell_active_mode_run_profile_startup_and_load_dispatch,map,thiscall,inferred,objdump + caller xrefs + debugger comparison,4,"Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, immediately re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, posts several shell progress or status updates through `0x5193f0/0x540120`, mirrors one shell-managed string table off `0x006d4020+0x429b0` into local dword slots `[this+0x46a80..+0x46aa4]`, and allocates the common startup-side runtime pools before the selector jump at all: the cargo collection `0x0062ba8c`, structure-candidate pool `0x0062b268`, auxiliary candidate collection `0x0062b2fc`, support owner `0x0062ba88`, locomotive pool `0x006ada84`, optional world root `0x0062c120`, city-label and manager families `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, `0x006cea4c`, and `0x006acd34`, plus the setup helper at `0x0062b244`. That common pre-branch stage is tighter now too: after allocating the locomotive pool it reverse-walks the live locomotives through `0x00461c80` and pre-seeds named locomotive-availability rows in scenario state through `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` before the later progress lane continues. Only after that common allocation pass does it switch over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438a66..0x00438c00` that first refreshes one support-family type-`7` record from setup path buffer `0x006d1370` through `global_banked_type7_record_refresh_from_openable_path_basename_and_stem` `0x0053d130`, strips the basename extension into a local label buffer, briefly drops the nested mouse-cursor selection hold through `0x0053f310`, builds three progress-text payloads, re-enters the hold through `0x0053f2f0`, and only then allocates `0x0062c120` when absent, runs `0x0044faf0`, and forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(0, 0)` immediately after dismissing the current detail panel and servicing `0x004834e0(0, 0)`. `0x0046b8bc` remains the distinct multiplayer-preview relaunch owner, also entering as `(0, 0)` before a later staged `0x00445ac0` call.","objdump + caller xrefs + manual-load breakpoint comparison + owner-tail disassembly + caller-shape comparison + selector-jump-table decode + tutorial-string correlation + selector-writer correlation + selector2-support-record correlation + cursor-hold choreography correlation + startup-allocation-pass correlation + locomotive-availability-preseed correlation" 0x00435603,10,scenario_state_ensure_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny guard wrapper over one derived scenario-state year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. When the small mode or threshold byte at `[this+0x3a]` is already `>= 2` the helper returns immediately; otherwise it falls back into the heavier rebuild body at `0x004351c0`, which refreshes those companion thresholds from the current year and shell-controller-side values before continuing. Current grounded callers are the post-fast-forward selected-year tail at `0x00437170`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, the compact runtime-effect side branch at `0x00431e03`, and the shell-command lane at `0x004661c0/0x004661e9`, so this is the safest current read for the small year-threshold ensure wrapper rather than a generic boolean probe.","objdump + local disassembly + caller correlation + year-threshold-band correlation" -0x00435630,648,scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables,map,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book runtime band at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared production-cap float that precedes the first line up to a fixed minimum `4.0`, counts active nonzero-mode lines across the fixed five repeated `0x30`-byte line records, writes that count into the paired runtime lane at `[book_runtime-0x3b0]`, and then imports those same five lines into one parallel runtime array of `0xbc`-byte descriptors rooted at `[book_runtime-0x3ac]`. Every runtime slot is first zeroed, seeded with fixed year-window defaults `0x0708..0x270f`, and then filled only when the source line mode is nonzero. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves both token lanes through `cargo_collection_find_entry_by_exact_name` `0x0041e9f0` over the live cargo collection at `0x0062ba8c`, and builds the direct primary-cargo half for modes `1/3` plus the one-row subordinate half for modes `2/3`. Current mode polarity is grounded rather than provisional: the source token at `line+0x08` is the primary or supplied-cargo field because it feeds the direct branch used by `Supply Only` and the primary half of `Production Demand->Supply`, while the source token at `line+0x1c` is the subordinate or demanded-cargo field because it feeds the one-row branch used by `Demand Only` and the subordinate half of `Production Demand->Supply`. The importer-side string behavior is tighter now too: empty token strings in either lane are replaced in-place with the first live cargo name from `0x0062ba8c` before the same exact-name matcher runs, while mode `3` repeatedly compares the two token lanes through `0x005a57cf` and keeps reseeding the primary lane from that first live cargo name until the primary and subordinate strings diverge. The amount semantics are tighter in the same way: `line+0x04` is normalized to at least `1.0` for every nonzero-mode line, copied into `[desc+0x04]` only for modes `1/3`, copied into `[desc+0x48]` for mode `2`, and replaced with literal `1.0` in `[desc+0x48]` for mode `3`. After all twelve books are imported, the helper explicitly re-enters `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` when the live candidate collection `0x0062b268` exists, so this row is the real scenario-to-runtime bridge between the editor-owned recipe books and the candidate-side `0xbc` descriptor arrays plus their later cargo summary tables. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`.","objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation + exact-matcher correlation + runtime-bridge correlation + mode3-divergence correlation" +0x00435630,648,scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables,map,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book runtime band at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared production-cap float that precedes the first line up to a fixed minimum `4.0`, counts active nonzero-mode lines across the fixed five repeated `0x30`-byte line records, writes that count into the paired runtime lane at `[book_runtime-0x3b0]`, and then imports those same five lines into one parallel runtime array of `0xbc`-byte descriptors rooted at `[book_runtime-0x3ac]`. Every runtime slot is first zeroed, seeded with fixed year-window defaults `0x0708..0x270f`, and then filled only when the source line mode is nonzero. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves both token lanes through `cargo_collection_find_entry_id_by_exact_name` `0x0041e9f0` over the live cargo collection at `0x0062ba8c`, and builds the direct primary-cargo half for modes `1/3` plus the one-row subordinate half for modes `2/3`. Current mode polarity is grounded rather than provisional: the source token at `line+0x08` is the primary or supplied-cargo field because it feeds the direct branch used by `Supply Only` and the primary half of `Production Demand->Supply`, while the source token at `line+0x1c` is the subordinate or demanded-cargo field because it feeds the one-row branch used by `Demand Only` and the subordinate half of `Production Demand->Supply`. The importer-side string behavior is tighter now too: empty token strings in either lane are replaced in-place with the first live cargo name from `0x0062ba8c` before the same exact-name matcher runs, while mode `3` repeatedly compares the two token lanes through `0x005a57cf` and keeps reseeding the primary lane from that first live cargo name until the primary and subordinate strings diverge. The return-value side is tighter in the same way: the exact matcher returns one live cargo entry id or `0`, and the importer writes that result directly into runtime descriptor lanes `[desc+0x1c]` and `[desc+0x44]` without any post-match failure guard. The amount semantics are tighter in the same way: `line+0x04` is normalized to at least `1.0` for every nonzero-mode line, copied into `[desc+0x04]` only for modes `1/3`, copied into `[desc+0x48]` for mode `2`, and replaced with literal `1.0` in `[desc+0x48]` for mode `3`. After all twelve books are imported, the helper explicitly re-enters `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` when the live candidate collection `0x0062b268` exists, so this row is the real scenario-to-runtime bridge between the editor-owned recipe books and the candidate-side `0xbc` descriptor arrays plus their later cargo summary tables. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`.","objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation + exact-matcher correlation + runtime-bridge correlation + mode3-divergence correlation + return-value correction" 0x00437b20,218,simulation_run_chunked_fast_forward_burst,simulation,thiscall,inferred,objdump,3,"Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `[0x006cec74+0x178]`, and then overrides that count to literal `0x150` whenever special-condition slot `30` `[0x006cec78+0x4af7]` is nonzero before repeatedly advancing the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path.","objdump + caller context + RT3.lng strings + phase ordering + special-condition override correlation" 0x00434680,435,world_set_game_speed_mode,simulation,thiscall,inferred,objdump + strings,3,"Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.`","objdump + RT3.lng strings + multiplayer handoff" 0x00434850,19,world_adjust_game_speed_mode_delta,simulation,thiscall,inferred,objdump,3,"Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled.","objdump + callee inspection" @@ -582,8 +588,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00433900,160,shell_world_view_center_on_object_with_mode_specific_zoom_policy,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Mode-aware world-view centering helper above the live world-view owner at `0x0062be68`. The helper takes one object pointer plus one small mode argument. Except for the early mode-`2` no-op path, it first refreshes shell control `0x7922`, derives one `(distance,height)` preset from the target object's virtual classification through slots `+0x70`, `+0x6c`, and `+0x28`, optionally overrides that preset for mode `1`, and then re-enters `world_view_center_on_runtime_object` `0x0043c9a0` with the chosen preset and object pointer. Current grounded callers include the shell station and company list modifier paths, several detail-panel and window-side center actions, the tutorial or event-follow branches around `0x00435b2d` and `0x0044c75e`, and broader shell-side center helpers around `0x00505e0c`, `0x005060f7`, and `0x0051486b`. This is therefore the shared shell-facing center-on-object helper with one caller-selected zoom-policy mode rather than a station-only centering path.","objdump + caller xrefs + local disassembly + world-view-center correlation" 0x004339b0,144,scenario_state_set_investor_confidence_issue_lane_and_refresh_company_support_scalars,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Clamps one small scenario-side issue lane and refreshes the company-side support scalar family derived from it. The helper clamps the incoming value to `0..4`, stores the result in `[this+0x2d]`, derives one companion float in `[this+0x29]` through the fixed affine mapping at `0x005c85b8/0x005c8658`, and then walks the live company collection at `0x0062be10`, re-entering `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` on every live company to refresh the dependent support-side cache. Current grounded callers include the compact runtime-effect dispatcher branch at `0x00431db2`, the local setup or reset lane at `0x00436e05`, and the neighboring scenario-side text or collection refresh branch at `0x00434d23`, which keeps this helper bounded as the shared setter for the investor-confidence-style issue lane beneath equity-support and share-price logic rather than a generic scalar write.","objdump + local disassembly + caller correlation + company-support-refresh correlation" 0x00433850,109,scenario_state_refresh_active_chairman_profiles_with_reentrancy_guard,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Re-entrant-safe refresh dispatcher over the active chairman-profile family. The helper uses globals `0x0062be20` and `0x0062be1c` as a guard plus rerun latch: when no refresh is in progress it raises the guard, clears the rerun latch, walks the global persona collection at `0x006ceb9c` through `profile_collection_count_active_chairman_records` `0x00477820` and `profile_collection_get_nth_active_chairman_record` `0x00477860`, and re-enters `0x004771e0` on each active chairman record before dropping the guard. If any nested path re-raises the rerun latch, the outer loop repeats until the latch stays clear. Current grounded callers include the periodic service branch at `0x0040a7ae`, the chairman cash or tuning adjustment paths at `0x00476541` and `0x004771ca`, and several neighboring company-side mutation branches, so this is the safest current read for the shared active-chairman refresh pass rather than a one-off persona walker.","objdump + local disassembly + caller correlation + active-chairman refresh correlation + reentrancy-guard correlation" -0x00437220,279,world_build_chairman_profile_slot_records,map,thiscall,inferred,objdump + strings + caller xrefs,4,"Post-load chairman-profile materialization pass reached under banner id `319` `Setting up Players and Companies...`. The helper first refreshes one local occupancy map through `0x0047bc80`, optionally waits on the multiplayer preview owner at `0x006cd8d8`, then walks the 16 selector bytes at `[0x006cec7c+0x87]` together with the per-slot staging table rooted at `[this+0x69d8]`. Current slot-field semantics are tighter now: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte that combines with the separate per-slot gate at `[this+0x0bc3+slot*9]` to surface `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field copied into the resolved profile. Zero selectors take the random unused-profile path; nonzero selectors map directly onto one persona index; and campaign mode at `[0x006cec7c+0xc5]` can override back through the scenario slot table. Each resolved profile record is pulled from the global persona collection at `0x006ceb9c`, formatted through `0x0050a16f`, and seeded from the static persona table at `0x005f2d28`, whose localized ids include `2730` `Unassigned`, the named-chairman range `2731+`, and the adjacent biography range `2495+`. Both this helper and the neighboring selector seeder treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat marker rather than a generic role byte. The helper leaves one per-slot record family live in the resolved persona objects, stores per-profile numeric tuning from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finishes by writing the selected profile id to `[this+0x25]` plus the linked owner-company id from `[profile+0x1dd]` to `[this+0x21]`. Current grounded callers are the main post-load generation pipeline at `0x004384d0` and the saved-runtime tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`.","objdump + RT3.lng strings + caller xrefs + table inspection + shell editor cross-check" -0x004377a0,693,world_seed_default_chairman_profile_slots,map,thiscall,inferred,objdump + caller xrefs + strings,4,"Seeds the 16 scenario-side chairman selector bytes at `[0x006cec7c+0x87]` from the local chairman-slot table rooted at `[this+0x69d8]` before the later profile-record materialization pass runs. In editor-map mode the helper first compacts the 16 local 9-byte slot records so occupied slots bubble forward whenever a later slot has either the ordinary seat-enable byte `[slot+0x02]` or the special occupied-seat byte `[slot+0x03]` set and an earlier slot has neither; it then clears selectors for empty slots and assigns deterministic defaults for occupied ones, using selector `1` for the first occupied slot and selector `0x64+n` for later occupied slots. The same slot layout is now bounded more tightly by the editor window family around `0x004cc2d0`: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory flag with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field. Current grounded writes seed `[slot+0x03]` on slot zero and the compaction pass moves it only by swapping whole 9-byte records, which matches the selector policy: one distinguished first slot gets selector `1`, and the remaining occupied slots get the `0x64+n` opponent range. After the selector seeding pass it walks the selector array, resolves each chosen persona through the global collection at `0x006ceb9c`, constructs or refreshes the per-profile record through `0x00476140`, copies the numeric tuning field from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finally seeds the scenario-state summary pair from the first persona entry: `[this+0x25]` becomes the selected profile id while `[this+0x21]` becomes the linked owner-company id through `[profile+0x1dd]`. Current grounded caller is the neighboring world bring-up path around `0x00438692`, where this helper runs after the setup-side burst branch and immediately before the localized `Calculating Heights...` progress update.","objdump + caller xrefs + RT3.lng strings + slot-table inspection + shell editor cross-check" +0x00437220,279,world_build_chairman_profile_slot_records,map,thiscall,inferred,objdump + strings + caller xrefs + local disassembly,4,"Post-load chairman-profile materialization pass reached under banner id `319` `Setting up Players and Companies...`. The helper first rebuilds one local `0x29`-byte occupancy mask on the stack through `0x0047bc80`, using two `0x48`-byte staging records rooted at `[this+0x69db]` to mark already-consumed persona ordinals. It then optionally waits on the multiplayer preview owner at `0x006cd8d8`, showing localized progress `0x0e1e/0x0e1f` while that owner finishes, before walking the 16 selector bytes at `[0x006cec7c+0x87]` together with the per-slot staging table rooted at `[this+0x69d8]`. Current slot-field semantics are tighter now: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte that combines with the separate per-slot gate at `[this+0x0bc3+slot*9]` to surface `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field copied into the resolved profile. Selector `0` is the random-unused-persona path: it scans the global persona-state band at `[0x006cec78+0x6987]`, skips already-occupied ordinals from that local mask, honors the campaign-slot override byte `[slot-0x02]` when `[0x006cec7c+0xc5]` is live, and marks the chosen ordinal back into the same mask. Nonzero selectors map directly onto one persona index, with selectors below `0x64` using `selector-1` and selectors `0x64+` using the later-opponent range. Each resolved profile record is pulled from the global persona collection at `0x006ceb9c`, formatted through `0x0050a16f`, and then materialized through `world_seed_or_refresh_chairman_profile_record_from_static_persona_table` `0x00476140` using the static persona table at `0x005f2d28`, whose localized ids include `2730` `Unassigned`, the named-chairman range `2731+`, and the adjacent biography range `2495+`. Both this helper and the neighboring selector seeder treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. That keeps `[slot+0x03]` as the strongest current anchor for the distinguished primary-human-seat marker rather than a generic role byte. The helper stores per-profile numeric tuning from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, can clear `[profile+0x293]` for inactive slots when the multiplayer preview owner is live, can mark `[profile+0x293] = 1` through `0x00434200` on the first resolved local-human seat during the preview side path, and finally writes the selected profile id to `[this+0x25]` plus the linked owner-company id from `[profile+0x1dd]` to `[this+0x21]`. Current grounded callers are the main post-load generation pipeline at `0x004384d0` and the saved-runtime tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`.","objdump + RT3.lng strings + caller xrefs + table inspection + shell editor cross-check + multiplayer-preview correlation + local disassembly" +0x004377a0,693,world_seed_default_chairman_profile_slots,map,thiscall,inferred,objdump + caller xrefs + strings + local disassembly,4,"Seeds the 16 scenario-side chairman selector bytes at `[0x006cec7c+0x87]` from the local chairman-slot table rooted at `[this+0x69d8]` before the later profile-record materialization pass runs. In editor-map mode the helper first compacts the 16 local 9-byte slot records so occupied slots bubble forward whenever a later slot has either the ordinary seat-enable byte `[slot+0x02]` or the special occupied-seat byte `[slot+0x03]` set and an earlier slot has neither; it then clears selectors for empty slots and assigns deterministic defaults for occupied ones, using selector `1` for the first occupied slot and selector `0x64+n` for later occupied slots. The same slot layout is now bounded more tightly by the editor window family around `0x004cc2d0`: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory flag with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field. Current grounded writes seed `[slot+0x03]` on slot zero and the compaction pass moves it only by swapping whole 9-byte records, which matches the selector policy: one distinguished first slot gets selector `1`, and the remaining occupied slots get the `0x64+n` opponent range. After the selector seeding pass it walks the selector array, allocates one fresh persona-record id from the global collection at `0x006ceb9c`, resolves the chosen static persona index from the selector byte, and materializes the final per-profile record through `world_seed_or_refresh_chairman_profile_record_from_static_persona_table` `0x00476140` instead of only formatting a temporary name row. It then copies the numeric tuning field from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, seeds the scenario-state summary pair from the first persona entry so `[this+0x25]` becomes the selected profile id while `[this+0x21]` becomes the linked owner-company id through `[profile+0x1dd]`, and can still tail into `0x0047d440` when no multiplayer preview owner is active and the surrounding shell gates allow the later company-side helper. Current grounded caller is the neighboring world bring-up path around `0x00438692`, where this helper runs after the setup-side burst branch and immediately before the localized `Calculating Heights...` progress update.","objdump + caller xrefs + RT3.lng strings + slot-table inspection + shell editor cross-check + local disassembly + persona-record-allocation correlation" 0x00434870,23,scenario_state_get_selected_chairman_company_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected company record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x21]` as a company id and resolves that id through the live company collection at `0x0062be10`; zero or negative ids return null. This is the clearest direct accessor yet for the summary field written by the post-load chairman-profile lane.","objdump + global-state inspection + caller correlation" 0x00434890,35,scenario_state_set_selected_chairman_profile,map,thiscall,inferred,objdump + global-state inspection,4,"Sets the currently selected chairman profile on the shell-side scenario state object at `0x006cec78`. The helper stores the incoming persona id into `[this+0x25]`, resolves that persona through the global profile collection at `0x006ceb9c`, and then copies the linked owner-company id from `[profile+0x1dd]` into `[this+0x21]`. This grounds the summary pair used by the post-load chairman-profile setup lane: `[state+0x25]` is the selected chairman profile id and `[state+0x21]` is the corresponding owning company id.","objdump + global-state inspection + caller correlation" 0x004348c0,23,scenario_state_get_selected_chairman_profile_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected chairman profile record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x25]` as a profile id and resolves it through the global persona collection at `0x006ceb9c`; zero or negative ids return null. This pairs directly with scenario_state_set_selected_chairman_profile at `0x00434890`.","objdump + global-state inspection + caller correlation" @@ -613,9 +619,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00448fe0,108,world_serialize_four_sidecar_byte_planes_into_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Save-side sibling of world_load_four_sidecar_byte_planes_from_runtime_bundle. The helper opens chunk family `0x9471..0x9472` for output through `0x00531340`, computes the same one-plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four source plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and writes those four buffers through repeated `0x00531030` calls before closing the chunk family. Current grounded callers are the `.smp` serializer inside world_runtime_serialize_smp_bundle `0x00446240` and the neighboring world-side bundle-save branch at `0x00449714`, so this is the safest current read for the shared four-plane runtime-bundle serializer rather than a generic writer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation" 0x00449520,636,world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + bundle-tag correlation,4,"Save-side sibling of `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`. The helper first opens chunk `0x2ee2`, delegates one fixed `0xc8`-byte world-grid header save through `world_serialize_fixed_grid_header_mask_planes_secondary_raster_and_overlay_chunks_into_bundle` `0x00553760`, posts progress notice `0x005caa50`, and then writes the core grid and stride scalars from `[this+0x2145/+0x2149/+0x214d/+0x2151/+0x2155/+0x2159/+0x215d/+0x2161/+0x2201]`. It follows with chunk family `0x2ef4/0x2ef5/0x2ef6` for the three main packed sidecar bands rooted at `[this+0x213d]`, `[this+0x2131]`, and `[this+0x2135]`, chunk family `0x2ee4/0x2ee5` for the extra bitplane and cell-word side rooted at `[this+0x2141]` and `[this+0x212d]`, re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0`, and then walks every live world-grid cell from `[this+0x2129]` through `0x0042b4a0` before closing the `0x2ee5` phase. Current grounded caller is the early package-save owner `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, so this is the safest current read for the early world-grid and secondary-raster bundle-save body rather than a generic header writer.","objdump + caller inspection + local disassembly + bundle-tag correlation + world-grid-array correlation + save-side sibling correlation" 0x0044afa0,439,world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Composed local world-scalar query over the live world root. The helper first derives one distance-like term from the caller cell to global preview anchor fields `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`; distances above `0x32` contribute one clamped bias term. It then samples the companion float raster rooted at `[world+0x1605]` at the caller cell and across two 8-direction rings from the static offset tables `0x00624b28/0x00624b48`, keeps the highest rounded neighbor sample, and folds the local rise above the center sample into the running score. When preview scalar `[0x0062be68+0x20]` exceeds threshold `0x005ca190` it adds one further scaled bias, and when the neighboring shell-mode gate `0x0041fff0` passes it adds `0x32` more before returning the final score plus base offset `0x8c`. Current grounded callers are the shared rounded-coordinate wrapper `0x0041f6b0` and the sibling virtual wrapper `0x004614d0`.","objdump + caller xrefs + local disassembly + float-grid correlation + radial-distance-helper correlation" -0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]`. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation" +0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]`. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437737`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation" 0x0044c670,2544,world_service_secondary_grid_marked_cell_overlay_cache,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Recurring world-side service pass over the secondary raster rooted at `[this+0x2135]` after `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` has cached min/max/count bounds into `[this+0x21c6..+0x21d6]`. The helper first requires shell-state gate `[0x006cec78+0x4af3]`, then consumes the cached bounds to normalize the marked-cell band and rewrite per-cell bits in the same secondary raster. Its later overlay side is tighter now too: after resolving scaled surface dimensions through `shell_world_presentation_query_scaled_surface_dimensions` `0x00534c50`, it walks one local 3-by-32 sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only secondary-raster classes `4..0x0d`, folds several interpolated samples through repeated `0x0051db80` evaluation into one strongest local score, writes packed overlay pixels into the staged surface buffer, and only then publishes that staged overlay through `shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer` `0x00534af0`. The lower helper cluster beneath that owner is now explicit too: `0x00533e70` refreshes the coarse overlay chunks in a rectangle, `0x00534160` ensures one coarse chunk and seeds local marks, and `0x00534e90` is the neighboring marked-bit predicate over the same 3-byte raster family. Current grounded callers are the recurring simulation-maintenance route-style branch at `0x0040a9f4` inside `simulation_service_periodic_boundary_work` `0x0040a590` and one startup-side world branch at `0x00448168`, so this is the safest current read for the shared secondary-grid marked-cell overlay-cache service rather than a one-shot startup helper or a fully player-facing panel renderer.","objdump + local disassembly + caller inspection + secondary-raster correlation + recurring-maintenance correlation + staged-overlay publish correlation" -0x00443a50,4979,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,"First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it explicitly re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The collection-side tagged load strip inside that bringup is now explicit too: before the later runtime rehydrate tail it loads the main route-entry collection `0x006cfca8` through `0x00493be0`, the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, refreshes placed-structure local runtime records through `0x004133b0`, rebuilds one flagged secondary-raster cleanup band through `0x00448af0/0x00533fe0`, reloads the world-manager side family at `0x006ceb9c` through `0x00477780`, reloads the geographic-label database at `0x006ada80` through `geographic_label_database_refresh_records_from_tagged_bundle` `0x00461580`, reloads the city-database entry collection at `0x006cea50` through `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540`, reloads the live region collection at `0x0062bae0` through `world_region_collection_refresh_records_from_tagged_bundle` `0x00421510`, refreshes the neighboring manager at `0x006cfc9c` through `0x00487c20`, reloads the support family at `0x0062b244` through `0x0040b5d0`, and reloads event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The later load-side rehydrate band is tighter now too. Before the final world and shell reactivation it posts shell progress ids `0x32dc/0x3714/0x3715`, restores the late world-status block `[world+0x66be]` from `0x2ee0/0x2ee1`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, reruns `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, the shared stage-threshold compare `0x00444dc5`, the candidate visibility sweep `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`. Only after that does it restore the two named-availability collections rather than only the locomotive side: the candidate table at `[world+0x66b2]` is restored first from fixed `0x22`-byte name-plus-dword rows, keeping only names that survive the built-in stem rejects and still resolve into the live candidate pool through `0x00412b70`, and only after that does the same band restore the named locomotive-availability collection at `[world+0x66b6]` with its older empty-collection fallback into `0x004350b0`, followed by the live locomotive override refresh `0x00461e00`. That later reactivation tail is narrower now too: it includes `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, then `world_rebuild_all_grid_cell_candidate_cargo_service_bitsets` `0x0044c450`, then `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, then the recurring secondary-raster overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, before the later route-style rebuild, shell-window, and briefing branches. Only after that later tail does it re-enter the one-shot world-entry runtime-effect service through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `8`, after which shell-profile latch `[0x006cec7c+0x97]` is cleared. This is therefore the current safest read for the full shell-to-gameplay world-entry transition and runtime bringup owner rather than only the front half of file staging and world allocation.","objdump + analysis-context + caller xrefs + strings + post-load-pipeline correlation + late-tail phase-order correlation + staged-profile-rehydrate correlation + tagged-collection-load-order correlation + named-availability-restore-order correlation + selected-year-reactivation correlation" +0x00443a50,4979,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,"First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it explicitly re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The collection-side tagged load strip inside that bringup is now explicit too: before the later runtime rehydrate tail it loads the main route-entry collection `0x006cfca8` through `0x00493be0`, the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, refreshes placed-structure local runtime records through `0x004133b0`, rebuilds one flagged secondary-raster cleanup band through `0x00448af0/0x00533fe0`, reloads the world-manager side family at `0x006ceb9c` through `0x00477780`, reloads the geographic-label database at `0x006ada80` through `geographic_label_database_refresh_records_from_tagged_bundle` `0x00461580`, reloads the city-database entry collection at `0x006cea50` through `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540`, reloads the live region collection at `0x0062bae0` through `world_region_collection_refresh_records_from_tagged_bundle` `0x00421510`, refreshes the neighboring manager at `0x006cfc9c` through `0x00487c20`, reloads the support family at `0x0062b244` through `0x0040b5d0`, and reloads event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The recipe-runtime lane is now split more tightly than before too: one early restore-side call at `0x00443ebc` rebuilds the scenario-side port-or-warehouse cargo runtime tables immediately after restoring the named candidate-availability collection at `[world+0x66b2]`, and before the neighboring candidate-filter/count refreshes `0x00412c10/0x00412bd0` plus the year-derived follow-ons `0x00434130/0x00436af0`; a second late call at `0x00444ac1` reruns that same recipe rebuild only after the `0x197` checkpoint, shell-progress scalar publish `0x004354a0`, territory-side sweep `0x00487de0`, and before the final named-candidate availability preseed `0x00437737` plus the later candidate-filter refresh `0x00412c10`. The later load-side rehydrate band is tighter now too. Before the final world and shell reactivation it posts shell progress ids `0x32dc/0x3714/0x3715`, restores the late world-status block `[world+0x66be]` from `0x2ee0/0x2ee1`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, reruns `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, the shared stage-threshold compare `0x00444dc5`, the candidate visibility sweep `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`. Only after that does it restore the two named-availability collections rather than only the locomotive side: the candidate table at `[world+0x66b2]` is restored first from fixed `0x22`-byte name-plus-dword rows, keeping only names that survive the built-in stem rejects and still resolve into the live candidate pool through `0x00412b70`, with no later candidate-side fallback preseed if that validated pass stays empty. Only after that does the same band restore the named locomotive-availability collection at `[world+0x66b6]` by raw row insertion, preserving the older empty-collection fallback into `0x004350b0`, followed by the live locomotive override refresh `0x00461e00`. That later reactivation tail is narrower now too: it includes `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, then `world_rebuild_all_grid_cell_candidate_cargo_service_bitsets` `0x0044c450`, then `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, then the recurring secondary-raster overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, before the later route-style rebuild, shell-window, and briefing branches. Only after that later tail does it re-enter the one-shot world-entry runtime-effect service through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `8`, after which shell-profile latch `[0x006cec7c+0x97]` is cleared. This is therefore the current safest read for the full shell-to-gameplay world-entry transition and runtime bringup owner rather than only the front half of file staging and world allocation.","objdump + analysis-context + caller xrefs + strings + post-load-pipeline correlation + late-tail phase-order correlation + staged-profile-rehydrate correlation + tagged-collection-load-order correlation + named-availability-restore-order correlation + selected-year-reactivation correlation + recipe-runtime-double-rebuild correlation" 0x00440530,46,shell_open_or_focus_detail_panel_mode_0x0b_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x0b`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x0b_or_warn` `0x00434db0`; on success it forwards `(-1, 0x0b)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de49a`, which uses the same gate and mode. This is therefore the safest current read for the direct mode-`0x0b` opener rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + mode-transition correlation" 0x00440560,22,shell_open_or_focus_detail_panel_mode_0x01_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 1)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`1` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation" 0x00440580,22,shell_open_or_focus_detail_panel_mode_0x04_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 4)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`4` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation" @@ -714,10 +720,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00453370,405,world_enable_preview_mode_0x15_latch_and_enter_if_idle,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared world-side owner for entering the preview-capable mode `0x15`. The helper first rejects when latch byte `[this+0x21c5]` is already nonzero; otherwise it sets that latch and only continues when current mode `[this+0x2175]` is still `0`. On the active path it releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles prior shell-presenter counters for the neighboring mode families `3` and `7` plus optional flag pair `[this+0x219d/+0x21a1]`, adjusts the shared presenter count lane `[0x006d4024+0x11426e]` from the mode table at `0x005ee5e8/0x005ee6e4`, seeds mode `0x15` into `[this+0x2175]`, clears the local scalar band `[+0x2179..+0x2189]`, seeds both timeout-like dwords `[+0x218d/+0x2191] = 0x1869f`, and re-enters `0x00450520` before tailing through `0x00452d30` according to shell field `[0x006cec74+0x12c]`. Current grounded caller is the shell command strip at `0x00441182`, which dispatches here when active scenario plus world state exist and the same preview latch is still clear. This is the safest current read for the mode-`0x15` preview-latch entry owner rather than a generic world reset.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation" 0x00453510,621,world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared teardown-or-reseed owner for the same world-side preview-mode family rooted at mode byte `[this+0x2175]` and latch `[this+0x21c5]`. The helper first reconciles the auxiliary preview byte `[this+0x2171]` through the small clear tail at `0x00452d30`, then tears down the current mode state through `0x00532360`, `0x00532500`, and `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, clears the current mode dword `[this+0x2175]`, and decrements the same shell-presenter counter families used by the entry sibling for prior modes `3` and `7` plus optional flags `[this+0x219d/+0x21a1]`. When preview latch byte `[this+0x21c5]` is still set, it then replays the same mode-`0x15` reset strip against the live world root `0x0062c120`, re-seeding `[world+0x2175] = 0x15`, the scalar band `[+0x2179..+0x2191]`, and the later `0x00450520 -> 0x00452d30` tail. When that latch is clear it returns with the mode fully torn down. Current grounded callers include the shell-side linked-peer action branch at `0x0040e94c`, the route or preview wrappers at `0x00449467` and `0x00464f2d`, many shell tool-window destructors such as `0x004f3b50`, `0x004f50fa`, `0x004f5784`, and `0x0050db9c`, plus the explicit latch-clear sibling `0x004537a0`. This is therefore the safest current read for the shared preview-mode clear-or-reseed owner rather than a one-window destructor helper.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation + tool-window teardown correlation" 0x00453780,38,world_disable_preview_mode_0x15_latch_and_clear_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny paired exit helper for the same world-side preview-mode family. When latch byte `[this+0x21c5]` is nonzero the helper clears that latch and, if current mode `[this+0x2175]` still equals `0x15`, tail-jumps into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`; otherwise it returns immediately. Current grounded callers are the shell command strip at `0x0044118a` and the neighboring settings-side wrapper at `0x004ff90c/0x004ff94a`, which use it as the direct preview-mode unlatch path when the same mode-`0x15` latch is already active. This is the safest current read for the paired latch-clear helper rather than another generic world-mode toggle.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation" -0x004422d0,96,shell_status_stack_push_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status lanes into one `5`-byte slot selected by the current depth: shell dwords `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. Current grounded callers include the heavier wrappers `0x004423a0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation" -0x00442330,112,shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five status lanes from the selected `0x0062be90` slot back into shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, and returns. Current grounded callers include the higher wrapper `0x004423d0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation" -0x004423a0,48,shell_status_stack_push_and_service_active_tracklay_and_stationplace_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher wrapper over the same shell/startup status-band stack. It first re-enters `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`, then, when the live TrackLay.win tool object at `0x006d1a8c` is present, calls `0x0050e070`, and when the live StationPlace.win tool object at `0x006d1720` is present, tail-jumps into `0x00507a50`. Current grounded callers include the city-connection route builder `0x00402cb0`, the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the neighboring collection-side world branch `0x0046b9f0`, so this is the safest current read for pushing the shared status band and then bracketing active world-tool windows rather than another generic shell transition helper.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation" -0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded callers include the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, the neighboring save-load path `0x00446d40`, and the collection-side world branch `0x0046b9f0`, so this is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation" +0x004422d0,96,shell_status_stack_push_four_shell_byte_latches_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status bytes into one `5`-byte slot selected by the current depth: the low bytes of shell fields `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. Current grounded callers include the heavier wrappers `0x004423a0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation + byte-lane-correction" +0x00442330,112,shell_status_stack_pop_restore_four_shell_byte_latches_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_byte_latches_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five saved bytes from the selected `0x0062be90` slot back into shell fields `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, sign-extending the first three shell byte lanes and zero-extending the fourth before writing them back into the wider shell dwords. Current grounded callers include the higher wrapper `0x004423d0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation + byte-lane-correction" +0x004423a0,48,shell_status_stack_push_and_service_active_tracklay_and_stationplace_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher wrapper over the same shell/startup status-band stack. It first re-enters `shell_status_stack_push_four_shell_byte_latches_and_startup_byte` `0x004422d0`, then, when the live TrackLay.win tool object at `0x006d1a8c` is present, calls `0x0050e070`, and when the live StationPlace.win tool object at `0x006d1720` is present, tail-jumps into `0x00507a50`. Current grounded callers include the city-connection route builder `0x00402cb0`, the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the neighboring collection-side world branch `0x0046b9f0`, so this is the safest current read for pushing the shared status band and then bracketing active world-tool windows rather than another generic shell transition helper.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation + byte-lane-correction" +0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_byte_latches_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded callers include the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, the neighboring save-load path `0x00446d40`, and the collection-side world branch `0x0046b9f0`, so this is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation + byte-lane-correction" 0x00442400,930,shell_setup_load_selected_profile_bundle_into_payload_record,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads the smaller startup payload and preview-surface chunks rooted at ids `0x0001` and `0x03c2`, while the map-style side reads the larger setup payload chunks rooted at ids `0x0004`, `0x2ee0`, and `0x2ee1`, with the exact chunk mix gated by the parsed bundle-header word in the local scratch. Current grounded caller is `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`.","objdump + local disassembly + caller inspection + chunk-family correlation" 0x004425d0,139,shell_setup_validate_selected_profile_bundle_and_stage_launch_profile,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs.","objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation" 0x00442660,209,shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks,shell,cdecl,inferred,objdump + caller inspection + local disassembly + status-notice correlation,2,"Shared progress-sample notice helper in the surrounding save or load strip. The helper measures the current byte counter through `0x00530b70`, derives one rounded kilobyte delta against previous counter `0x0062c11c`, formats that delta through `%5d`, measures elapsed ticks against `0x0062bed0` through `0x0051d890`, formats the elapsed field through `% 4d`, and then packages both fields plus the caller-supplied status stem into the shared shell text builder `0x005193f0 -> 0x00518de0 -> 0x0051d680`. It finally updates `0x0062c11c` to the current byte counter. Current grounded callers include the bundle-service strip at `0x00413469/0x004134b4` and the save-side progress path inside `shell_map_file_world_bundle_coordinator` around `0x00445098`, so this is the safest current read for the shared byte-delta and elapsed-time progress notice helper rather than a one-off formatter.","objdump + caller inspection + local disassembly + status-notice correlation + save-load-progress correlation" @@ -765,14 +771,14 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0044e940,1792,world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Broad rectangle-scoped rebuild owner over the live secondary-raster derived presentation family. The helper first clamps the caller rectangle through `0x00449df0` and reruns `world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component` `0x0044e500`. It then lazily ensures one presentation target through `0x0051f090` plus `0x00534910/0x00534920/0x00534930`, refreshes neighboring world-presentation state through `0x00449f20`, resolves scaled target dimensions through `0x00534c50`, and allocates a temporary `width*height` mask. The main scan then walks the live secondary raster `[this+0x165d]` and class predicates `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four sidecar byte planes `[this+0x1631..+0x163d]`, while the broader per-cell pass computes local windows, emits packed values into the ensured target through `0x00534730`, and also updates nibble lanes at byte offsets `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the temporary mask, expands the caller rectangle by dirty bounds `[this+0x21ad..+0x21b9]` through `0x00536710`, and finally seeds companion byte `[this+0x162d]` with `0xc4` on cells selected from mask plane `[this+0x1655]`. Current grounded callers include the post-load generation path at `0x00444a42`, the shell-mode toggle branch at `0x004480ec`, the sibling owner at `0x0044fac6`, and later world-side branches at `0x004fb1f9`, `0x004fc21e`, and `0x004ffee4`, so this is the safest current read for the broad secondary-raster derived-surface and companion-plane rebuild owner rather than a one-off shell preview draw.","objdump + caller xrefs + local disassembly + secondary-raster correlation + derived-surface publish correlation" 0x00414bd0,112,world_query_float_coords_within_live_grid_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-coordinate bounds predicate over the live world grid. The helper returns true only when both caller-supplied float coordinates are `>= 0` and `<= [world+0x15d9]-1` / `<= [world+0x15d5]-1` respectively; otherwise it returns false. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the radial secondary-raster stamp helper `0x0044e7d0`, several later world-side branches around `0x00480af8`, `0x00498278`, and `0x004982cb`, and the StationPlace world-surface branch at `0x005085a4`, so this is the safest current read for the shared float grid-bounds gate rather than a tool-specific placement check.","objdump + caller xrefs + local disassembly + grid-bounds correlation" 0x00449df0,144,world_clamp_rect_coords_to_live_grid_and_validate_nonempty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small rectangle clamp-and-validate helper over integer world-grid coordinates. The function takes four caller-owned coordinate pointers, clamps the two lower bounds to zero, clamps the two upper bounds to `[world+0x2155]-1` and `[world+0x2159]-1`, and then returns true only when the resulting rectangle is still nonempty and fully within those live dimensions. Current grounded callers include the local marked-bit refresh helper `0x0044dcf0`, the rect-wide secondary-raster edge refresh owner `0x0044e500`, the broader owner `0x0044e982`, later secondary-raster siblings around `0x0044ec93` and `0x0044eee9`, the route-entry window gate `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, and one later world-side caller at `0x00494261`, so this is the safest current read for the shared rect clamp-and-validity predicate rather than a serializer-only rectangle helper.","objdump + caller xrefs + local disassembly + rect-clamp correlation" -0x00444dd0,3301,map_bundle_open_reference_package_and_serialize_early_world_datasets,map,cdecl,inferred,objdump + caller xrefs + local disassembly + chunk-family correlation,4,"Broader package-save prelude beneath the non-`.smp` branch of `shell_map_file_world_bundle_coordinator` `0x00445de0` and the neighboring multiplayer-side fallback path at `0x0046cfcb`. The helper seeds the shared stage/progress globals `0x00620e94 = 0x26ad`, `0x0062bec8 = 0x15`, `0x0062becc = 0`, and `0x0062bed0 = ticks`, optionally runs the editor-map side prepass `0x00436a70` when `[0x006cec74+0x68]` is live, opens one bundle through `0x00530c80(4, 0x30d40, 1)`, and on failure raises the localized modal rooted at `0x0fda` before unwinding the surrounding shell notices. On success it serializes the first broad save/package band in a fixed order with interleaved progress updates through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`: chunk `0x32c8` with the fixed `0x4f2c` world block `[world+0x04]`, chunk `0x32c9` with the fixed `0x0bb9` block `[world+0x4f30]`, chunk family `0x332d/0x332e` with the late world-status band `[world+0x66be]` and then the direct counted named-availability collection saves from `[world+0x66b2]` and `[world+0x66b6]`, chunk `0x32dc`, chunks `0x3714/0x3715` with the `0x108` staged profile block `0x006cec7c`, then the early reference and manager families through `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520`, the shell notifier vtable `+0x08` on `0x0062be68`, `structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks` `0x0041e930`, `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`, `placed_structure_collection_serialize_local_runtime_records_into_bundle` `0x00413440`, direct indexed-collection header serialization on the route-link family `0x006ada90` through `0x00517d90`, `placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle` `0x00481310`, `linked_route_object_collection_serialize_records_into_tagged_bundle` `0x0041d4c0`, `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x004b27a0`, `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, `route_entry_collection_serialize_records_into_tagged_bundle` `0x00491c60`, `aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle` `0x004a4240`, `profile_collection_serialize_records_into_tagged_bundle` `0x004777e0`, `geographic_label_database_serialize_records_into_tagged_bundle` `0x00461650`, `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610`, `world_region_collection_serialize_records_into_tagged_bundle` `0x004215e0`, `territory_collection_serialize_records_into_tagged_bundle` `0x00487cc0`, `support_collection_serialize_tagged_records_into_bundle` `0x0040b6a0`, and `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`. Its fixed tail is tighter now too: after the tagged collections it writes one direct dword from `[world+0x19]`, one zeroed `0x1f4`-byte slab under chunk `0x32cf`, closes the bundle through `0x00530a00`, derives the output path through `0x00442740`, conditionally emits the companion image file branch `0x00441f70` when `[world+0x66c8]` is set, conditionally emits the companion-payload rewrite branch `0x00442900` when `[world+0x66c9]` is set, and otherwise falls back to the localized no-preview notice path through `0x00441ec0`; those same preview/payload flags also add `+1` and `+0x15` respectively into the shared progress bound `0x0062bec8` before the save steps begin. This is therefore the real early reference-package open-and-save owner rather than a generic database opener.","objdump + caller xrefs + local disassembly + chunk-family correlation + save-order correlation + package-tail correlation + progress-bound correlation" +0x00444dd0,3301,map_bundle_open_reference_package_and_serialize_early_world_datasets,map,cdecl,inferred,objdump + caller xrefs + local disassembly + chunk-family correlation,4,"Broader package-save prelude beneath the non-`.smp` branch of `shell_map_file_world_bundle_coordinator` `0x00445de0` and the neighboring multiplayer-side fallback path at `0x0046cfcb`. The helper seeds the shared stage/progress globals `0x00620e94 = 0x26ad`, `0x0062bec8 = 0x15`, `0x0062becc = 0`, and `0x0062bed0 = ticks`, optionally runs the editor-map side prepass `0x00436a70` when `[0x006cec74+0x68]` is live, opens one bundle through `0x00530c80(4, 0x30d40, 1)`, and on failure raises the localized modal rooted at `0x0fda` before unwinding the surrounding shell notices. On success it serializes the first broad save/package band in a fixed order with interleaved progress updates through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`: chunk `0x32c8` with the fixed `0x4f2c` world block `[world+0x04]`, chunk `0x32c9` with the fixed `0x0bb9` block `[world+0x4f30]`, chunk family `0x332d/0x332e` with the late world-status band `[world+0x66be]`, the shared indexed-collection serializer `0x00517d90` over candidate named-availability collection `[world+0x66b2]`, chunk `0x32dc`, chunks `0x3714/0x3715` with the `0x108` staged profile block `0x006cec7c`, then that same shared serializer `0x00517d90` over locomotive named-availability collection `[world+0x66b6]` under `0x32dd`, then the early reference and manager families through `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520`, the shell notifier vtable `+0x08` on `0x0062be68`, `structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks` `0x0041e930`, `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`, `placed_structure_collection_serialize_local_runtime_records_into_bundle` `0x00413440`, direct indexed-collection header serialization on the route-link family `0x006ada90` through `0x00517d90`, `placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle` `0x00481310`, `linked_route_object_collection_serialize_records_into_tagged_bundle` `0x0041d4c0`, `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x004b27a0`, `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, `route_entry_collection_serialize_records_into_tagged_bundle` `0x00491c60`, `aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle` `0x004a4240`, `profile_collection_serialize_records_into_tagged_bundle` `0x004777e0`, `geographic_label_database_serialize_records_into_tagged_bundle` `0x00461650`, `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610`, `world_region_collection_serialize_records_into_tagged_bundle` `0x004215e0`, `territory_collection_serialize_records_into_tagged_bundle` `0x00487cc0`, `support_collection_serialize_tagged_records_into_bundle` `0x0040b6a0`, and `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`. Its fixed tail is tighter now too: after the tagged collections it writes one direct dword from `[world+0x19]`, one zeroed `0x1f4`-byte slab under chunk `0x32cf`, closes the bundle through `0x00530a00`, derives the output path through `0x00442740`, conditionally emits the companion image file branch `0x00441f70` when `[world+0x66c8]` is set, conditionally emits the companion-payload rewrite branch `0x00442900` when `[world+0x66c9]` is set, and otherwise falls back to the localized no-preview notice path through `0x00441ec0`; those same preview/payload flags also add `+1` and `+0x15` respectively into the shared progress bound `0x0062bec8` before the save steps begin. This is therefore the real early reference-package open-and-save owner rather than a generic database opener.","objdump + caller xrefs + local disassembly + chunk-family correlation + save-order correlation + package-tail correlation + progress-bound correlation + named-availability serializer correction" 0x00445ac0,790,shell_map_file_entry_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. At entry it clears the optional success dword, and every successful path later decrements nested open counter `0x0062be6c`, notifies the shared shell owner at `0x0062be68`, sets shell latch `[0x006cec74+0x501] = 1`, and clears live input word `[0x006d4018+0xa8c]`. The direct-seed side is tighter now too: when the caller supplies a path seed the helper increments `0x0062be6c`, and if a live runtime world is already active or flag bit `0x8` is set it copies that stem, appends the fixed `.smp` token from `0x005ca9a4`, and re-enters `world_load_saved_runtime_state_bundle` `0x00446d40`; otherwise it routes straight into the heavier world-entry branch `0x00443a50` with the flag-derived trailing boolean from `(flags>>2)^1`. The quickload side is explicit too: flag bit `0x1` seeds the shared quicksave base stem from `0x005ca9cc`, appends `.gmp` when editor-map flag `[0x006cec74+0x68]` is live and otherwise appends `.gms/.gmc/.gmx` through the same sandbox/campaign/default split used by the interactive chooser, resolves the final path through `0x004839e0`, validates it through `0x00530c20`, and uses the two localized validation branches rooted at ids `0x181/0x182` plus `0x004c98a0` before continuing. The non-Quicksave interactive path is tighter now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using load mode `4=.gmp` when `EditorPanel.win` is live and paired non-editor open modes `8=.gms`, `9=.gmc`, and `10=.gmx`. The shell-state master flag `[0x006cec74+0x68]` reinforces that same mapping on the direct quickload branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence still keeps the non-editor trio concrete: `.gmx` aligns with sandbox mode because the sibling shell branch at `0x004dc923` gates on `0x006cec7c+0x82` and surfaces string `3898` `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because `0x004dc9cd` gates on `0x006cec7c+0xc5` and surfaces string `3018` about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family.","objdump + analysis-context + local disassembly + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection + restore-vs-world-entry split" 0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. At entry it clears the optional success dword and seeds shared save-progress selector `0x0062bec4` from one of the two shell-controller dwords `[0x006d4024+0x11472a]` or `[+0x11472e]` depending on the side-owner gate `0x004839b0`. Its filename-selection side is tighter now too: an explicit caller-supplied stem bypasses the chooser, flag bit `0x1` seeds the Quicksave base stem from `0x005ca9cc`, and flag bit `0x2` seeds the localized `Autosave` stem through string id `387` while also clearing `0x0062bec4`. The non-Quicksave interactive path is explicit now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using save mode `3=.gmp` for the editor-map package path, `0=.gms` for standalone scenarios, `1=.gmc` for campaign-scenario saves, and `2=.gmx` for sandbox saves, plus the auxiliary `11=.gmt` branch reached only when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner at `0x006cd8d8`. The shell-state master flag `[0x006cec74+0x68]` reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. The active-world split is tighter in the same way: when a live runtime world is present the helper copies the chosen stem, appends the fixed `.smp` token from `0x005ca9a4`, re-enters `world_runtime_serialize_smp_bundle` `0x00446240`, and marks success immediately. Only when no active runtime world is present does it continue into the package side: when the auxiliary preview owner is live it packages the chosen stem into the owner-local request block near `0x006cd8d8+0x8f48` and submits it through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7d` and payload size `0x48`; otherwise it falls back to `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`. The campaign mapping is still backed by the numbered `%s%02d.gmc` helper at `0x00517c70`, which formats one campaign-progress slot from `0x006cec7c+0xc4` before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string `3898` on `0x006cec7c+0x82`. Its package-side order is now explicit too: the non-`.smp` branch delegates the early direct-save band to `0x00444dd0`, which itself serializes the route-entry family, auxiliary tracker family, profile, region, territory, support, and event managers with shared progress/sample notices interleaved through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`. One editor-only trailing validation branch is tighter now too: after a successful non-runtime package save, when `[0x006cec74+0x68]` and `[world+0x66de]` are both live, the helper scans the fixed 16-entry stem table `0x00621cf0..0x00621d2c` against format stem `0x005ca9d8` and only opens the localized warning rooted at `0x0fd9` through `0x004c98a0` when no match survives. This makes the helper the save-side sibling of `shell_map_file_entry_coordinator` rather than another restore dispatcher, with `.gmt` bounded as an auxiliary preview-side export path instead of a fourth gameplay save family.","objdump + analysis-context + local disassembly + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct-save branch inspection + active-world split + editor-only validation sweep" 0x00455320,42,runtime_object_collection_construct_vtable_5cae10,map,thiscall,inferred,objdump + world-load correlation + local disassembly,2,"World-load constructor for the `0x005cae10` indexed collection later rooted at `0x006acd34`. The helper enters the common collection base `0x00517ce0`, installs vtable `0x005cae10`, seeds the indexed collection through `0x00518570` with grounded parameters `(record_size=0x21a, initial_slots=0x0a, growth=5, id_base=1)`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting object is stored into global `0x006acd34`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction" 0x00455350,22,runtime_object_collection_release_entries_and_collection_storage_vtable_5cae10,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `runtime_object_collection_construct_vtable_5cae10` `0x00455320`. The helper reinstalls vtable `0x005cae10`, re-enters `0x00518600` to release live entries, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation" 0x00455f60,96,world_region_resolve_center_world_grid_cell,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small region-to-grid resolver that converts one region's cached center coordinate pair into a pointer into the live world-grid cell table rooted at `[0x0062c120+0x2129]`. It reads the cached floats at `[this+0x1ea]` and `[this+0x1e2]`, scales and rounds them through `0x005a10d0`, multiplies the Y-like term by world width `[0x0062c120+0x2145]`, adds the X-like term, and returns the corresponding grid-cell pointer. Current grounded callers include the world-entry region-center flag reseed pass `0x0044c4b0` and several older site- or route-style world-grid query helpers, so this is now the safest current read for the shared region-center world-grid-cell resolver.","objdump + local disassembly + caller inspection + world-grid correlation" -0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it first pushes the nested mouse-cursor selection hold through `0x0053f2f0`, snapshots one startup-side status band through `0x004423a0`, allocates a bundle through `0x00530c80`, seeds many typed records through repeated `0x00531030` and `0x00531340` calls, walks world collections under `0x0062c120` and `0x006ada80`, and emits runtime-state payloads through helpers such as `0x00534e50`, `0x00534ec0`, `0x00534f00`, and `0x00534f40`; at the tail it mirrors the paired status follow-on through `0x004423d0`, pops the same mouse-cursor hold through `0x0053f310`, posts the fixed shell status line through `0x00538c70`, and only then closes the bundle through `0x00530a00`. The status-band choreography is tighter now too: `0x004423a0/0x004423d0` bracket the same four shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` through the `0x0062be90` stack while also servicing active TrackLay.win and StationPlace.win tool windows. The serializer-side fixed header is explicit now too: it writes bundle version `0x400` first, then, for version `>= 0x3f1`, the late world-status block `[world+0x66be]` under chunk ids `0x2ee0/0x2ee1`, followed by the main world-grid dimensions and stride scalars from `[world+0x2155/+0x2159]`. The raster side is tighter in the same way, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before the later fixed-band tail continues. One save-side bridge into the editor economic-tuning band is explicit now too: before the region and named-availability runs, the serializer writes the same six-dword block the map-editor economic cost panel exposes at `[world+0x0be2..+0x0bf6]` as one direct dword from `[world+0x0be2]` plus five successive dwords from `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`. The mid-save state bands are tighter now too: after the core raster tables it serializes the twelve raw `0x4e1` recipe books from `[world+0x0fe7]` book-by-book, writing each shared cap dword at `+0x3ed`, one `0x3d`-byte book header, and the five repeated line records as `mode/amount/supplied-token-window/demanded-token-window` subfields in fixed `0x30`-byte steps. The named-availability, event, and trailing fixed bands are tighter in the same way: the serializer writes a counted run of fixed `0x22`-byte candidate-name-plus-dword records from `[world+0x66b2]`, then a counted run of fixed `0x41`-byte locomotive-name-plus-dword records from `[world+0x66b6]`, writes a counted region row run from `[0x0062bae0]` as `0x29`-byte headers plus companion profile-subcollection counts and `0x22`-byte rows, brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` before delegating the per-event packed-state save to `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`, writes the two direct dwords at `[world+0x4c78/+0x4c7c]`, and at version `>= 0x400` writes `49` dwords from `[world+0x4a7f..+0x4b3f]` plus one trailing dword from `[world+0x4b43]`, which grounds a direct `.smp` save of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred from checked `gmp/gms/gmx` files. Current grounded caller is `0x00445de0` on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-context + local disassembly + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation + cursor-hold choreography correlation + status-stack correlation + mid-save-band correlation + pre-recipe-scalar-band correlation + named-availability-save correlation + region-row-save correlation + event-collection-save correlation + trailing-fixed-band correlation + economic-tuning-band correlation" -0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by `shell_map_file_entry_coordinator` `0x00445ac0`. The helper dismisses the current shell detail controller, optionally tears down the active tool owner through `0x004ddbd0(-1, 0)`, releases the prior world runtime through `world_runtime_release_global_services` `0x00434300`, drives shell mode and status transitions, rebuilds the startup-side runtime roots through `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, allocates a new bundle through `0x00530c80`, and constructs a fresh world root at `0x0062c120` through `0x0044cf70` using `(width+1, height+1)` from the serialized grid scalars. The first restore bands are tighter now too: after bundle version `0x400` it restores the late world-status block `[world+0x66be]` from chunk ids `0x2ee0/0x2ee1` for versions `>= 0x3f1`, immediately re-normalizes that block through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, and otherwise explicitly clears the older compatibility tail at `[world+0x6987]`; then it reads one dword per world-grid cell and forwards those values into `world_write_companion_float_grid_cell_and_optionally_refresh_rect` `0x0044dca0` across the full `(width+1)*(height+1)` raster. The raster and overlay side is explicit in the same way: the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, then, for versioned bundles at `>= 0x3ec`, re-enters `world_load_four_sidecar_byte_planes_from_runtime_bundle` `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into `[world+0x1631 + index*4]`. It also restores the per-cell secondary-raster sideband through the byte-level helpers `0x00448c20`, `0x00448cb0`, `0x00448d90`, `0x00448e60`, `0x00448e90`, and `0x0044de30`, with the later version split now explicit: at `>= 0x400` it restores five separate per-cell compatibility bits into the live secondary-raster word and byte lanes, while older bundles clear those same bits back to the older fixed fallback pattern. One mid-restore preview branch is tighter now too: for versions `>= 0x3ee` it restores one width/height-tagged dword surface, optionally resamples it through `shell_world_presentation_stage_overlay_rect_from_normalized_bounds` `0x00534930`, republishes it through `0x00534730/0x00534af0`, frees the temporary buffer, and then re-enters `0x004882e0` on the neighboring manager family. The recipe and manager bands are tighter in the same way: at version `>= 0x3f5` it restores the same twelve raw `0x4e1` recipe books back into `[world+0x0fe7]` book-by-book, line-by-line, and field-by-field as `cap dword + 0x3d-byte book header + five repeated 0x30-byte line records`. At version `>= 0x3f2` it then restores the same six-dword editor economic-tuning band by reading the first dword into `[world+0x0be2]`, mirroring that value immediately into `[world+0x0bde]`, and reading the five successive dwords into `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, before the later manager bands at `[world+0x4f30]`, the tagged geographic-label collection `0x006ada80`, the trailing scenario-rule band `[world+0x4a7f..+0x4b43]`, and the packed sidecar bitfield at `[world+0x2141]` run under the later version gates `0x3f4/0x3fa/0x3fc`. The region side is explicit now too: after seeding default regions through `world_region_collection_seed_default_regions` `0x00421b60`, the loader reads one counted run of fixed `0x29`-byte region rows, resolves or allocates each target through `0x00421660/0x00518140`, republishes pending amount `[region+0x272]`, paired pointers `[region+0x25a/+0x25e]`, reruns `0x004204c0`, reloads the per-region profile subcollection at `[region+0x37f]`, and then restores one second counted run of fixed `0x1e+4` rows whose names must survive the fixed reject stems and resolve back into the live candidate pool before the row is accepted into that region-owned subcollection. The named-availability and event-side collection bands are tight on the restore path too: the loader first clears `[world+0x66b2]`, reads one counted run of fixed `0x22`-byte candidate-name-plus-dword records, rejects the built-in alias stems at `0x005c8f94/0x005c8e4c`, resolves every surviving name back into the live candidate pool through `indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04` `0x00412b70`, and only then inserts the accepted record through collection vtable slot `+0x04`; it then does the same direct clear-and-repopulate pass for `[world+0x66b6]` from one counted run of fixed `0x41`-byte locomotive-name-plus-dword records, with the older empty-collection fallback into `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` still preserved after the direct restore. It then brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` and delegates the per-event packed-state restore to `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The post-close reactivation tail is explicit now too: after `0x00530a00` closes the bundle, the helper re-enters `0x00538e00`, refreshes candidate and locomotive availability through `0x00412c10/0x00461e00`, rebuilds the full secondary-raster derived surface through `0x0044e940`, then reruns `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`, the scenario-side recipe bridge `0x00435630`, shell tool refresh `0x0040b830`, `world_region_collection_run_class0_secondary_overlay_stamp_pass_for_all_live_regions` `0x00421ce0`, `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, and a final `4x4` local bitplane mark loop through `0x004497a0` over the grounded quarter-resolution bitmap planes at `[world+0x2139/+0x213d/+0x2141]`. This is therefore the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + local disassembly + caller xrefs + strings + world-root-allocation correlation + companion-float-grid restore correlation + sidecar-plane correlation + secondary-raster compatibility-bit restore correlation + region-row restore correlation + geographic-label restore correlation + named-availability-restore correlation + restore-side-name-validation correlation + event-collection-restore correlation + post-close-reactivation-tail correlation + trailing-fixed-band correlation + economic-tuning-band correlation + setup-payload-normalization correlation" +0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it first pushes the nested mouse-cursor selection hold through `0x0053f2f0`, snapshots one startup-side status band through `0x004423a0`, allocates a bundle through `0x00530c80`, seeds many typed records through repeated `0x00531030` and `0x00531340` calls, walks world collections under `0x0062c120` and `0x006ada80`, and emits runtime-state payloads through helpers such as `0x00534e50`, `0x00534ec0`, `0x00534f00`, and `0x00534f40`; at the tail it mirrors the paired status follow-on through `0x004423d0`, pops the same mouse-cursor hold through `0x0053f310`, posts the fixed shell status line through `0x00538c70`, and only then closes the bundle through `0x00530a00`. The status-band choreography is tighter now too: `0x004423a0/0x004423d0` bracket the same four shell byte lanes `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` through the `0x0062be90` stack while also servicing active TrackLay.win and StationPlace.win tool windows. The serializer-side fixed header is explicit now too: it writes bundle version `0x400` first, then, for version `>= 0x3f1`, the late world-status block `[world+0x66be]` under chunk ids `0x2ee0/0x2ee1`, followed by the main world-grid dimensions and stride scalars from `[world+0x2155/+0x2159]`. The raster side is tighter in the same way, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before the later fixed-band tail continues. One save-side bridge into the editor economic-tuning band is explicit now too: before the region and named-availability runs, the serializer writes the same six-dword block the map-editor economic cost panel exposes at `[world+0x0be2..+0x0bf6]` as one direct dword from `[world+0x0be2]` plus five successive dwords from `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`. The mid-save state bands are tighter now too: after the core raster tables it serializes the twelve `0x4e1`-byte recipe books from `[world+0x0fe7]` book-by-book as one exact `cap dword + 0x3d-byte header + five repeated line tuples` structure. Each repeated `0x30`-byte line is emitted field-by-field as mode dword at `+0x00`, annual amount float at `+0x04`, supplied-token window at `+0x08`, and demanded-token window at `+0x1c`, with no intervening serializer-owned reinterpretation. The named-availability, event, and trailing fixed bands are tighter in the same way: the serializer writes a counted run of fixed `0x22`-byte candidate-name-plus-dword records from `[world+0x66b2]`, then a counted run of fixed `0x41`-byte locomotive-name-plus-dword records from `[world+0x66b6]`, writes a counted region row run from `[0x0062bae0]` as `0x29`-byte headers plus companion profile-subcollection counts and `0x22`-byte rows, brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` before delegating the per-event packed-state save to `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`, writes the two direct dwords at `[world+0x4c78/+0x4c7c]`, and at version `>= 0x400` writes `49` dwords from `[world+0x4a7f..+0x4b3f]` plus one trailing dword from `[world+0x4b43]`, which grounds a direct `.smp` save of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred from checked `gmp/gms/gmx` files. Current grounded caller is `0x00445de0` on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-context + local disassembly + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation + cursor-hold choreography correlation + status-stack correlation + mid-save-band correlation + pre-recipe-scalar-band correlation + named-availability-save correlation + region-row-save correlation + event-collection-save correlation + trailing-fixed-band correlation + economic-tuning-band correlation + byte-lane-correction" +0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by `shell_map_file_entry_coordinator` `0x00445ac0`. The helper dismisses the current shell detail controller, optionally tears down the active tool owner through `0x004ddbd0(-1, 0)`, releases the prior world runtime through `world_runtime_release_global_services` `0x00434300`, drives shell mode and status transitions, rebuilds the startup-side runtime roots through `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, allocates a new bundle through `0x00530c80`, and constructs a fresh world root at `0x0062c120` through `0x0044cf70` using `(width+1, height+1)` from the serialized grid scalars. The first restore bands are tighter now too: after bundle version `0x400` it restores the late world-status block `[world+0x66be]` from chunk ids `0x2ee0/0x2ee1` for versions `>= 0x3f1`, immediately re-normalizes that block through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, and otherwise explicitly clears the older compatibility tail at `[world+0x6987]`; then it reads one dword per world-grid cell and forwards those values into `world_write_companion_float_grid_cell_and_optionally_refresh_rect` `0x0044dca0` across the full `(width+1)*(height+1)` raster. The raster and overlay side is explicit in the same way: the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, then, for versioned bundles at `>= 0x3ec`, re-enters `world_load_four_sidecar_byte_planes_from_runtime_bundle` `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into `[world+0x1631 + index*4]`. It also restores the per-cell secondary-raster sideband through the byte-level helpers `0x00448c20`, `0x00448cb0`, `0x00448d90`, `0x00448e60`, `0x00448e90`, and `0x0044de30`, with the later version split now explicit: at `>= 0x400` it restores five separate per-cell compatibility bits into the live secondary-raster word and byte lanes, while older bundles clear those same bits back to the older fixed fallback pattern. One mid-restore preview branch is tighter now too: for versions `>= 0x3ee` it restores one width/height-tagged dword surface, optionally resamples it through `shell_world_presentation_stage_overlay_rect_from_normalized_bounds` `0x00534930`, republishes it through `0x00534730/0x00534af0`, frees the temporary buffer, and then re-enters `0x004882e0` on the neighboring manager family. The recipe and manager bands are tighter in the same way: at version `>= 0x3f5` it restores the same twelve `0x4e1` recipe books back into `[world+0x0fe7]` book-by-book as one exact `cap dword + 0x3d-byte header + five repeated line tuples` structure, with each repeated `0x30`-byte line read field-by-field back into mode dword `+0x00`, annual amount float `+0x04`, supplied-token window `+0x08`, and demanded-token window `+0x1c`. At version `>= 0x3f2` it then restores the same six-dword editor economic-tuning band by reading the first dword into `[world+0x0be2]`, mirroring that value immediately into `[world+0x0bde]`, and reading the five successive dwords into `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, before the later manager bands at `[world+0x4f30]`, the tagged geographic-label collection `0x006ada80`, the trailing scenario-rule band `[world+0x4a7f..+0x4b43]`, and the packed sidecar bitfield at `[world+0x2141]` run under the later version gates `0x3f4/0x3fa/0x3fc`. The region side is explicit now too: after seeding default regions through `world_region_collection_seed_default_regions` `0x00421b60`, the loader reads one counted run of fixed `0x29`-byte region rows, resolves or allocates each target through `0x00421660/0x00518140`, republishes pending amount `[region+0x272]`, paired pointers `[region+0x25a/+0x25e]`, reruns `0x004204c0`, reloads the per-region profile subcollection at `[region+0x37f]`, and then restores one second counted run of fixed `0x1e+4` rows whose names must survive the fixed reject stems and resolve back into the live candidate pool before the row is accepted into that region-owned subcollection. The named-availability and event-side collection bands are tight on the restore path too: the loader first clears `[world+0x66b2]`, reads one counted run of fixed `0x22`-byte candidate-name-plus-dword records, rejects the built-in alias stems at `0x005c8f94/0x005c8e4c`, resolves every surviving name back into the live candidate pool through `indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04` `0x00412b70`, and only then inserts the accepted record through collection vtable slot `+0x04`, with no later fallback preseed if that validated pass stays empty. It then clears `[world+0x66b6]`, restores one counted run of fixed `0x41`-byte locomotive-name-plus-dword records by raw direct insertion through collection vtable slot `+0x04` without the candidate-side reject-or-resolve filter, and only after that checks whether the restored locomotive collection stayed empty so the older live-pool fallback `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` can repopulate it. It then brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` and delegates the per-event packed-state restore to `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The post-close reactivation tail is explicit now too: after `0x00530a00` closes the bundle, the helper re-enters `0x00538e00`, refreshes candidate and locomotive availability through `0x00412c10/0x00461e00`, rebuilds the full secondary-raster derived surface through `0x0044e940`, then reruns `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`, the scenario-side recipe bridge `0x00435630`, shell tool refresh `0x0040b830`, `world_region_collection_run_class0_secondary_overlay_stamp_pass_for_all_live_regions` `0x00421ce0`, `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, and a final `4x4` local bitplane mark loop through `0x004497a0` over the grounded quarter-resolution bitmap planes at `[world+0x2139/+0x213d/+0x2141]`. This is therefore the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + local disassembly + caller xrefs + strings + world-root-allocation correlation + companion-float-grid restore correlation + sidecar-plane correlation + secondary-raster compatibility-bit restore correlation + region-row restore correlation + geographic-label restore correlation + named-availability-restore correlation + restore-side-name-validation correlation + event-collection-restore correlation + post-close-reactivation-tail correlation + trailing-fixed-band correlation + economic-tuning-band correlation + setup-payload-normalization correlation" 0x0044f840,176,world_build_transport_pricing_preview_surface_from_secondary_raster,map,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,3,"Small transport/pricing-side preview builder beneath `world_compute_transport_and_pricing_grid` `0x0044fb70`. The helper allocates one default presentation target through `0x00534930`, queries its dimensions through `0x00534c50`, seeds five fallback palette entries through repeated `0x0051de10` calls, and then walks the target pixels. Each pixel is mapped back into the live secondary raster `[this+0x165d]` through `0x00533970/0x00533980`; low-3-bit classes other than `1/4` get one fixed fallback color, while class-`1/4` pixels scan a local `+/-4` neighborhood for zero-tag cells, score those through the radial falloff helper `0x0051db80`, and then choose either one of the seeded palette entries or the alternate fallback color `0x5f040566`. After filling the whole surface it re-enters `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` on the full `0..0x270f` rectangle rooted at that target. Current grounded caller is the null-build path at `0x0044fb31` inside `world_compute_transport_and_pricing_grid`, so this is the safest current read for the transport/pricing preview-surface builder rather than another generic overlay helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + preview-surface correlation" 0x0044faf0,128,world_ensure_transport_pricing_preview_surface_and_publish_if_missing,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Thin world-side ensure/publish wrapper above `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`. The helper first forwards the caller rectangle and output pointer into `0x00538060`, then samples shell state through `0x0040b830` and the paired shell notifier `0x004834e0`. When the returned preview handle is null it rebuilds the preview surface by re-entering `0x0044f840`; in either case it then refreshes neighboring world presentation through `0x00449f80`, re-enters the region-border overlay refresh `0x004881b0`, posts the same shell notifier again, and finally issues one mode pulse through `0x00484d70` before returning the ensured handle. Current grounded caller is the world-side path at `0x0043901a`, so this is the safest current read for the transport/pricing preview ensure-and-publish wrapper rather than another generic surface allocator.","objdump + caller inspection + local disassembly + world-presentation correlation" 0x0044fb70,1117,world_compute_transport_and_pricing_grid,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop.",objdump + caller context + RT3.lng strings @@ -908,7 +914,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004ca670,280,map_editor_scenario_metadata_panel_refresh_briefing_mode,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the briefing-mode controls inside one shell-side map-editor scenario metadata panel. The helper uses the global selector `0x621f50` to choose whether the visible long-text editor is the ordinary scenario briefing or the multiplayer briefing, publishes the corresponding heading from localized ids `1491` `Briefing (dialog appears when scenario starts):` and `3586` `Multi-Player Briefing (dialog appears when scenario starts):` onto control `0x5b73`, flips the paired selector controls around `0x5b71` and `0x5b72`, and republishes the stored single-player and multiplayer briefing texts from `[0x006cec78+0x4f30]` and `[+0x5ae9]` into the paired edit controls `0x5b6d` and `0x5b6f`. Current grounded caller is the broader scenario metadata refresh at `0x004ca790`.","objdump + RT3.lng strings + UI control inspection + state-field correlation" 0x004ca790,384,map_editor_scenario_metadata_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the shell-side map-editor scenario metadata controls under the shared control band `0x5b69..0x5b74`. The helper first re-enters `map_editor_scenario_metadata_panel_refresh_briefing_mode` at `0x004ca670`, then republishes the scenario description from `[0x006cec78+0x672e]` to control `0x5b69`, the start-year trio from `[+0x66ca]`, `[+0x66d2]`, and `[+0x66ce]` into `0x5b6a`, `0x5b6c`, and `0x5b6b`, the direct campaign-designated byte `[+0x66de]` into control `0x5b6e`, and the inverse of the paired metadata byte `[+0x66f3]` into control `0x5b74`. The resource-side anchor is now explicit too: `editorDetail.win` contains one control record rooted at `0x5b6e` that carries localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.` before the next control record begins at `0x5b74`, which grounds `[+0x66de]` as the actual campaign-scenario flag rather than a generic metadata boolean. The neighboring message dispatcher at `0x004cb4a0` clamps the three year fields to `1829..2100` and maintains `minimum <= default <= maximum`, which aligns the rest of this panel with the localized editor strings `Description:` `Minimum Start Year:` `Default Start Year:` `Maximum Start Year:` and the paired briefing labels in `RT3.lng` ids `1483..1492` and `3586`.","objdump + RT3.lng strings + UI control inspection + state-field correlation + editorDetail.win resource record" 0x004ca910,474,map_editor_building_density_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI control inspection,4,"Refreshes the shell-side `Building Density` page in the map-editor control panel. The helper reads two scenario-state bytes at `[0x006cec78+0x4c78]` and `[+0x4c7c]` and reflects them into two separate three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, with both fields seeded to the middle state `1` by constructor-time defaults and persisted through the ordinary map-state bundle path. The localized field captions now make the page materially tighter: `[state+0x4c78]` is the `Starting Building Density Level:` selector from ids `1642` and `1643`, where the default middle state `1` corresponds to the documented `100%` baseline and the lower world-building branches later treat the stored ordinal as a real three-state numeric mode; `[state+0x4c7c]` is the paired `Building Density Growth:` selector from id `1644`, which combines with city or region-specific density changes as described by `1641` and is likewise consumed later as a three-state growth-mode byte rather than a pure UI label. Related localized report text such as `1037`, `1048`, and `1070` points back to this same pair as the map-wide starting-density and later growth controls.","objdump + RT3.lng strings + caller inspection + UI control inspection + save-load correlation" -0x004ca980,315,map_editor_economic_cost_slider_dispatch,map,thiscall,inferred,objdump + RT3.lng strings + .data descriptor table inspection,3,"Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d`, converts the incoming integer slider delta or position into normalized floats, writes six tuned values into the adjacent scenario-state block at `[0x006cec78+0x0be2]`, `[+0x0be6]`, `[+0x0bea]`, `[+0x0bee]`, `[+0x0bf2]`, and `[+0x0bf6]`, mirrors the first value into `[state+0x0bde]`, and then re-enters the live panel owner through `0x004cadf0` when `0x006cff84` is present. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned.","objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection" +0x004ca980,315,map_editor_economic_cost_slider_dispatch,map,thiscall,inferred,objdump + RT3.lng strings + .data descriptor table inspection,3,"Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d` and grounds as the real writer for the persisted six-dword tuning band serialized by `.smp`: lane `0` is written directly into `[0x006cec78+0x0be2]` by scaling the incoming slider position through its dedicated divisor at `0x005c85d8`, while the trailing five lanes `[+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]` share the centered `(value-0xce)/0x005c87f8` path. It then mirrors the freshly written leading lane into `[state+0x0bde]` and, when the live panel owner `0x006cff84` is present, immediately re-enters `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` to rebuild the visible slider strip. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned.","objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection + lane-scaling correlation" 0x004caaf0,751,map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows,map,cdecl,inferred,objdump + local disassembly + constructor correlation + state-field correlation,4,"Refreshes the shell-side preview and numeric readout strip beneath the map-editor economic tuning page. The helper is attached to control `0x5be1` by `map_editor_economic_cost_slider_panel_construct` `0x004cadf0`, reads the live six-float tuning band from `[0x006cec78+0x0be2/+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and then does two distinct presentation passes. First it builds one curve preview into the `0x418` drawing path on `0x6cff8c`, using `[state+0x0be2]` as the leading scalar and the five trailing floats as one stepped multiplier table across successive ten-step buckets. Second it republishes the same six values back into the neighboring text controls `0x5bce`, `0x5bd0`, `0x5bd2`, `0x5bd4`, `0x5bd6`, and `0x5bd8`: the leading lane is formatted through one integer `%d`-style path, while the five trailing float lanes are formatted through one shared decimal formatter before all six strings are pushed through the generic type-`0x6f` dynamic-text control path. This is therefore the preview/formatter sibling of the economic slider dispatcher, not another mutator.","objdump + local disassembly + constructor correlation + state-field correlation + control-band correlation" 0x004cadf0,751,map_editor_economic_cost_slider_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + .data descriptor table inspection,4,"Constructs one shell-side map-editor economic cost tuning panel. The helper registers `map_editor_economic_cost_slider_dispatch` at `0x004ca980` on the six slider controls `0x5bcd`, `0x5bcf`, `0x5bd1`, `0x5bd3`, `0x5bd5`, and `0x5bd7`, attaches the neighboring preview or formatter callback `0x004caaf0` on control `0x5be1`, and then republishes the current scenario-state tuning values from `[0x006cec78+0x0be2..0x0bf6]` back into those controls through the shared slider formatting helpers. Current surrounding evidence now grounds this as the live editor-side economic tuning subsystem that was previously only visible through the orphaned help-text family: the adjacent descriptor block at `0x00611c70..0x00612220` pairs the wider lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost`, plus help texts `2433..2437`. Current grounded caller is the larger editor-panel dispatcher at `0x004ce244`.","objdump + caller inspection + slider registration + state-field correlation + RT3.lng strings + .data descriptor table inspection" 0x004cb1a0,22,map_editor_scenario_special_conditions_panel_clear_visible_row_band,map,thiscall,inferred,objdump + constructor correlation + local disassembly,3,"Tiny list-range clear helper beneath the map-editor special-conditions page. The helper resolves the page-owned list host at `[this+0x86]` and clears the visible row band `0xabe0..0xafc7` through `0x0053fe00`. Current grounded caller is the constructor `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0`, which binds this as the range callback on list control `0xa7fa`, so this is the visible-row reset sibling of the later per-row formatter rather than a generic list helper.","objdump + constructor correlation + local disassembly + control-range correlation" @@ -918,6 +924,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004cb6f0,496,map_editor_available_chairman_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block.","objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation" 0x004cb8e0,271,map_editor_scenario_special_conditions_panel_handle_message,map,thiscall,inferred,objdump + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole `49`-dword special-condition array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and updates the neighboring scalar at `[0x006cec78+0x4b43]` through control id `0xa7ff` before re-entering `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. Two row ids are also special-cased through immediate helper calls after commit, which marks this as the live state owner for the wider scenario rule-toggle matrix rather than only a passive list callback block.","objdump + static-table inspection + UI dispatch inspection + state-field correlation + fixed-runtime-band correlation" 0x004cb9f0,134,map_editor_building_density_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Building Density` page. The helper handles the two three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, committing ordinal values `0`, `1`, or `2` into the scenario-state bytes `[0x006cec78+0x4c78]` and `[+0x4c7c]` respectively before re-entering the same page refresh path at `0x004ca910`. The localized captions now pin the semantics more directly: `[state+0x4c78]` is the map-wide `Starting Building Density Level:` selector whose default middle state is the documented `100%` baseline, while `[state+0x4c7c]` is the paired `Building Density Growth:` selector. Current downstream xrefs also show both stored bytes steering later world-generation and growth math as concrete three-state mode selectors rather than only UI summaries.","objdump + RT3.lng strings + caller inspection + UI dispatch inspection + state-field correlation" +0x004cba34,15,scenario_state_store_starting_building_density_mode_from_eax,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny direct setter for scenario-state dword `[0x006cec78+0x4c78]`, the same map-wide `Starting Building Density Level:` mode later surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and committed by `map_editor_building_density_panel_handle_message` `0x004cb9f0`. It simply stores the caller-supplied `EAX` value and returns. Local adjacency now shows this setter living in the same tiny callback or preset strip as the fixed-value helpers immediately below it, so this is the safest current generic write-side sibling for that saved density field.","objdump + local disassembly + state-field correlation + setter-strip correlation" +0x004cba43,19,scenario_state_force_starting_building_density_mode_2,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c78]`. The helper writes literal mode `2` and returns. The same field is the map-wide `Starting Building Density Level:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910`, so this is the current strongest read for the hard-wired high-density preset sibling in that setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation" +0x004cba56,19,scenario_state_force_building_density_growth_mode_0,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c7c]`. The helper writes literal mode `0` and returns. The same field is the map-wide `Building Density Growth:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and committed by `map_editor_building_density_panel_handle_message` `0x004cb9f0`, so this is the current strongest read for the hard-wired low-growth preset sibling in the same direct setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation" +0x004cba69,15,scenario_state_store_building_density_growth_mode_from_eax,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny direct setter for scenario-state dword `[0x006cec78+0x4c7c]`, the same `Building Density Growth:` mode later surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and persisted through the ordinary map-state save path. It simply stores the caller-supplied `EAX` value and returns. Local adjacency now shows this setter living in the same tiny callback or preset strip as the fixed-value helpers immediately above and below it, so this is the safest current generic write-side sibling for that saved growth field.","objdump + local disassembly + state-field correlation + setter-strip correlation" +0x004cba78,19,scenario_state_force_building_density_growth_mode_2,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c7c]`. The helper writes literal mode `2` and returns. The same field is the map-wide `Building Density Growth:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910`, so this is the current strongest read for the hard-wired high-growth preset sibling in that setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation" 0x004cc980,943,map_editor_city_region_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the list-row formatter `0x004cc340` and selection callback `0x004cc930`, populates the visible city-or-region list from `0x0062bae0`, publishes detail fields through controls `0x50dc..0x50e2`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper.","objdump + RT3.lng strings + UI callback inspection + region-collection correlation" 0x004cc250,112,map_editor_chairman_slot_panel_refresh_slot_list,map,thiscall,inferred,objdump + UI control inspection,4,"Rebuilds the visible slot list in the chairman-slot editor panel. It clears the list control under group `0x5a6e`, then walks the 16 local slot records rooted at `[0x006cec78+0x69d8]` and appends one row for each slot whose active-seat bytes `[slot+0x02]` or `[slot+0x03]` are set. After repopulating the list it re-enters `map_editor_chairman_slot_panel_refresh_slot_counters` at `0x004ca1c0`. Current grounded callers are the panel constructor at `0x004cc2d0` and several message-handler update paths in `0x004cecc0`.","objdump + UI control inspection" 0x004cc2d0,99,map_editor_chairman_slot_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Players` editor panel under control group `0x5a6e`. The helper attaches the selected-slot formatter at `0x004c9da0`, the profile-cycle button at `0x004c9fa0`, and the list-selection callback at `0x004cc230`, then populates the current slot list through `map_editor_chairman_slot_panel_refresh_slot_list` and publishes one top-level panel control. The localized page text `995` `Players` plus help text `1015` `Control of how many players, human and/or A.I., allowed in the scenario.` now make this the clearest current shell owner for the local chairman-slot record family rooted at `0x006cec78+0x69d8`.","objdump + RT3.lng strings + UI callback inspection" @@ -931,8 +942,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004cf0d0,861,map_editor_locomotive_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Locomotives` availability page. The helper routes selection and bulk-toggle traffic through controls `0x5b06..0x5b0c`, rewrites the three scenario-state policy bytes at `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]`, and walks the locomotive collection at `0x006ada84` to commit per-row availability changes through the same record family used by the constructor. Bulk branches apply enable or disable policy across the visible locomotive set before the handler re-enters `map_editor_locomotive_availability_panel_construct` at `0x004cd680`, which makes this the live availability-policy owner rather than a local detail callback.","objdump + RT3.lng strings + UI dispatch inspection + locomotive-policy correlation" 0x004cdbd0,1357,map_editor_industry_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Industry (Overall)` availability page in the map-editor control panel. The helper binds the detail-row callback `0x004cc130` and the neighboring callback `0x004c9d80` on root control `0x9c42`, then walks the global candidate pool at `0x0062b268`, skipping the category-1 family and sorting the remaining candidates by label before building the visible industry list. The detail side formats the selected industry through `EditorDetail.win`, appends up to eight compatible city-or-region names from the region collection at `0x0062bae0`, and publishes the localized summary from id `1051` `There are %1 Cities and/or Regions using %2 right now`, while the page title uses id `1052` `Industries Available\n\nIndustries: %1 of %2 available`. Current grounded evidence therefore treats this as the main industry-availability page rather than an unnamed detail browser.","objdump + RT3.lng strings + UI callback inspection + candidate-pool correlation" 0x004cf430,714,map_editor_industry_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Industry (Overall)` availability page. The handler routes navigation and toggle traffic through the control band `0x9c43..0xa40f`, updates candidate-availability state through `0x00434f20` for the currently selected industry rows, and then re-enters `map_editor_industry_availability_panel_construct` at `0x004cdbd0` so the visible count and compatible-city summary refresh against the candidate pool at `0x0062b268`. Current grounded control usage and localized strings now make this the live industry-availability handler rather than another shared editor callback block.","objdump + RT3.lng strings + UI dispatch inspection + candidate-state correlation" -0x004cf910,1770,map_editor_port_warehouse_cargo_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Port/Warehouse Cargos` page in the map-editor control panel. The helper uses the selected recipe-book index latches at `0x006cffa0` and `0x006cffa4`, falls back across the per-book state blocks rooted at `[0x006cec78+0x0fe7+index*0x4e1]`, and populates the visible cargo-page controls under `0x59d8`, `0x5a0a`, and `0x5b74`. Current page-state work now bounds the structure more concretely too: the selected recipe-book index wraps modulo `12`, each recipe-book block stores the shared maximum annual production float at `book+0x3ed`, and the constructor then walks five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`. Each line now grounds as one row-owned mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token at `+0x08`, and one demanded-cargo token at `+0x1c`; the constructor resolves the two token strings against the global cargo collection and then reflects the resulting selector indices back into the page controls. The row-control mapping is now bounded too: the selector and label pair at `+0x14/+0x1e` is the supplied-cargo side because it is the pair enabled in modes `2/3`, while the pair at `+0x28/+0x0a` is the demanded-cargo side because it is the pair enabled in modes `1/3`. The same gating also tightens the single numeric field at `+0x46/+0x32`: it is labeled `Annual Demand:` only for mode `1`, but `Annual Supply:` for modes `2/3`. The localized page-title and help-text cluster now bounds the page much more tightly: `1001` `Port/Warehouse Cargos`, `1021` `Control over what ports and warehouses demand and supply.`, `1499` `Port/Warehouse Cargo Recipe Book:`, `1671` `Rename this cargo recipe book`, `1672` and `1673` for previous or next recipe-book cycling, `1674` and `1675` for the shared maximum annual production field, `1676` `Demanded:`, `1677` `Supplied:`, and `1678` for the per-cargo annual amount field. The same constructor also surfaces the four per-cargo mode labels `501` ``, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply`, publishes the annual demand or supply captions from `510` and `511`, formats rename and usage summaries through localized ids `507`, `508`, and `509`, and exposes the sandbox toggle text from id `3901` `Sandbox Allowed`. Current mode gating now makes the fourth mode tighter too: `Production Demand->Supply` is the only line state that clearly keeps both supplied-cargo and demanded-cargo branches active, while the shared numeric field stays on the supply side in that mode. That matches the wording around `1674`, `1675`, and `504` that ties it to one shared production-capacity pool and raw-material conversion into supplied output. It also emits the bounded high-production and high-load warnings from ids `505` and `506`, both of which explicitly reference ports or warehouses, which makes this the strongest current owner for the recipe-book or port-cargo editor lane rather than another generic detail page.","objdump + RT3.lng strings + UI callback inspection + recipe-book state correlation + mode-table correlation + control-gating correlation" -0x004d0040,1643,map_editor_port_warehouse_cargo_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Port/Warehouse Cargos` editor page. The helper routes selection and navigation traffic through the same recipe-book control bands rooted at `0x59d8`, `0x5a0a`, and `0x5b74`, opens the rename prompt from localized id `507`, and commits per-book cargo policy, sandbox-allowed state, and recipe-book text changes back into the scenario-state blocks at `[0x006cec78+0x0fe7+index*0x4e1]`. The edit-side dispatch is now tighter than before: the recipe-book selector wraps modulo `12`; the dedicated top-level numeric field under `0x59de` writes the shared maximum annual production float at `book+0x3ed`; and the per-line edit groups commit into five fixed cargo-line records beginning at `book+0x3f1` with stride `0x30`. Those line groups now ground as one mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token string at `+0x08`, and one demanded-cargo token string at `+0x1c`. The concrete control writes are now bounded too: the mode-`2/3` selector pair writes the supplied token through the `+0x14` control into `+0x08`, while the mode-`1/3` selector pair writes the demanded token through the `+0x28` control into `+0x1c`. The same handler keeps the single amount field on the demand side only for mode `1`; in modes `2/3` it writes that same `+0x04` field as annual supply, which matches the constructor captions `510` `Annual Demand:` versus `511` `Annual Supply:`. Current localized row text now makes the bounded edit surface much clearer: the page cycles among recipe books through `1672` and `1673`, renames them through `1671`, updates the shared maximum annual production field under `1674` and `1675`, and edits five fixed per-book line entries whose mode labels are `501` ``, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply` with annual amount captions `510` `Annual Demand:` and `511` `Annual Supply:` plus row labels `1676` `Demanded:` and `1677` `Supplied:`. The wording on `1675` also tightens the fourth mode specifically: `Production Demand->Supply` is the branch where the shared production-cap field is relevant and raw materials on hand are converted through production lines into supplied output, rather than only free-standing demand or free-standing supply. One bounded branch walks the city-or-region collection at `0x0062bae0` while rebuilding the usage summaries from localized ids `508` and `509`, and the warning branches re-use ids `505` and `506` when production-rate or supply-demand settings become too high for ports or warehouses. Before returning it re-enters `map_editor_port_warehouse_cargo_panel_construct` at `0x004cf910`, which makes this the live handler for the port or warehouse recipe-book page rather than a shared page-table callback.","objdump + RT3.lng strings + UI dispatch inspection + recipe-book state correlation + mode-table correlation + control-write correlation" +0x004cf910,1770,map_editor_port_warehouse_cargo_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Port/Warehouse Cargos` page in the map-editor control panel. The helper uses the selected recipe-book index latches at `0x006cffa0` and `0x006cffa4`, immediately re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, falls back across the per-book state blocks rooted at `[0x006cec78+0x0fe7+index*0x4e1]`, and populates the visible cargo-page controls under `0x59d8`, `0x5a0a`, and `0x5b74`. Current page-state work now bounds the structure more concretely too: the selected recipe-book index wraps modulo `12`, each recipe-book block stores the shared maximum annual production float at `book+0x3ed`, and the constructor then walks five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`. Each line now grounds as one row-owned mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token at `+0x08`, and one demanded-cargo token at `+0x1c`; the constructor resolves those persisted token strings against the visible live cargo catalog through direct `0x005a57cf` exact-name compares and only reflects matched ordinals back into the selector controls. That closes the editor-side marker boundary materially: there is still no special decode path here, and nonmatching token strings simply leave the selector index at its zero default while the raw scenario-state strings remain unchanged. The constructor-side usage summary is tighter in the same way: before showing the current book it scans the live city-or-region collection at `0x0062bae0`, keeps only rows whose usage gates `[entry+0x242]` and `[entry+0x2f6]` are live and whose current recipe ordinal `[entry+0x2f2]` matches the selected book, concatenates up to eight visible names from `[entry+0x356]` with separator `0x005c9f38`, counts any remainder, and then formats the bounded usage-summary pair from localized ids `508` and `509`. The row-control mapping is now bounded too: the selector and label pair at `+0x14/+0x1e` is the supplied-cargo side because it is the pair enabled in modes `2/3`, while the pair at `+0x28/+0x0a` is the demanded-cargo side because it is the pair enabled in modes `1/3`. The same gating also tightens the single numeric field at `+0x46/+0x32`: it is labeled `Annual Demand:` only for mode `1`, but `Annual Supply:` for modes `2/3`. The localized page-title and help-text cluster now bounds the page much more tightly: `1001` `Port/Warehouse Cargos`, `1021` `Control over what ports and warehouses demand and supply.`, `1499` `Port/Warehouse Cargo Recipe Book:`, `1671` `Rename this cargo recipe book`, `1672` and `1673` for previous or next recipe-book cycling, `1674` and `1675` for the shared maximum annual production field, `1676` `Demanded:`, `1677` `Supplied:`, and `1678` for the per-cargo annual amount field. The same constructor also surfaces the four per-cargo mode labels `501` ``, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply`, publishes the annual demand or supply captions from `510` and `511`, formats rename and usage summaries through localized ids `507`, `508`, and `509`, and exposes the sandbox toggle text from id `3901` `Sandbox Allowed`. Current mode gating now makes the fourth mode tighter too: `Production Demand->Supply` is the only line state that clearly keeps both supplied-cargo and demanded-cargo branches active, while the shared numeric field stays on the supply side in that mode. That matches the wording around `1674`, `1675`, and `504` that ties it to one shared production-capacity pool and raw-material conversion into supplied output. It also emits the bounded high-production and high-load warnings from ids `505` and `506`, both of which explicitly reference ports or warehouses, which makes this the strongest current owner for the recipe-book or port-cargo editor lane rather than another generic detail page.","objdump + RT3.lng strings + UI callback inspection + recipe-book state correlation + mode-table correlation + control-gating correlation + exact-name-catalog-correlation + usage-summary-scan-correlation" +0x004d0040,1643,map_editor_port_warehouse_cargo_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Port/Warehouse Cargos` editor page. The helper routes selection and navigation traffic through the same recipe-book control bands rooted at `0x59d8`, `0x5a0a`, and `0x5b74`, opens the rename prompt from localized id `507`, and commits per-book cargo policy, sandbox-allowed state, and recipe-book text changes back into the scenario-state blocks at `[0x006cec78+0x0fe7+index*0x4e1]`. The edit-side dispatch is now tighter than before: the recipe-book selector wraps modulo `12`; top-level control `0x59d8` parses the shared maximum annual production text field, clamps the entered value to at most `8`, warns through modal `0x1f9` when needed, and writes the resulting float to `book+0x3ed`; top-level control `0x59d9` opens the bounded rename modal over the current book root with one `0x3c`-byte text span; controls `0x59da/0x59db` cycle the selected recipe-book index backward or forward modulo `12`; and top-level control `0x59de` commits the selected recipe-book ordinal directly into `0x006cffa4`. The per-line edit groups then commit into five fixed cargo-line records beginning at `book+0x3f1` with stride `0x30`. Those line groups now ground exactly as one mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token string at `+0x08`, and one demanded-cargo token string at `+0x1c`, with the concrete control ids now resolved too: `0x5a0a..0x5a0e` write the five line-mode dwords at `book+0x3f1+line*0x30`; `0x5a1e..0x5a22` resolve one live cargo entry through `0x00518140` and copy its name field into the supplied-token lane at `book+0x3f9+line*0x30`; `0x5a32..0x5a36` do the same for the demanded-token lane at `book+0x40d+line*0x30`; and `0x5a50..0x5a54` parse the per-line annual amount text, clamp it to at most `6`, warn through modal `0x1fa` when needed, and write the resulting float to `book+0x3f5+line*0x30`. Current local control flow now closes the persistence boundary too: this handler stores the selected cargo names back into those token fields verbatim and does not normalize unmatched marker-like payloads before they reach the constructor or importer. The same handler keeps the single amount field on the demand side only for mode `1`; in modes `2/3` it writes that same `+0x04` field as annual supply, which matches the constructor captions `510` `Annual Demand:` versus `511` `Annual Supply:`. Current localized row text now makes the bounded edit surface much clearer: the page cycles among recipe books through `1672` and `1673`, renames them through `1671`, updates the shared maximum annual production field under `1674` and `1675`, and edits five fixed per-book line entries whose mode labels are `501` ``, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply` with annual amount captions `510` `Annual Demand:` and `511` `Annual Supply:` plus row labels `1676` `Demanded:` and `1677` `Supplied:`. The wording on `1675` also tightens the fourth mode specifically: `Production Demand->Supply` is the branch where the shared production-cap field is relevant and raw materials on hand are converted through production lines into supplied output, rather than only free-standing demand or free-standing supply. One bounded branch walks the city-or-region collection at `0x0062bae0` while rebuilding the usage summaries from localized ids `508` and `509`, and the warning branches re-use ids `505` and `506` when production-rate or supply-demand settings become too high for ports or warehouses. Before returning it re-enters `map_editor_port_warehouse_cargo_panel_construct` at `0x004cf910`, which makes this the live handler for the port or warehouse recipe-book page rather than a shared page-table callback.","objdump + RT3.lng strings + UI dispatch inspection + recipe-book state correlation + mode-table correlation + control-write correlation + exact-name-token-persistence-correlation + rename-modal-correlation + switch-table correlation + per-line-control-id correlation" 0x004cf700,370,map_editor_panel_dispatch_active_section_message,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level message dispatcher for the active map-editor control-panel section. The helper reuses the same page selector byte at `[this+0x78]` and routes incoming shell messages to the current page-local handlers, including the grounded city-or-region handler `0x004ce380`, territory handler `0x004ce820`, scenario metadata handler `0x004cb4a0`, available-chairman handler `0x004cb6f0`, special-conditions handler `0x004cb8e0`, the bounded dual tri-state handler `0x004cb9f0`, the grounded port-or-warehouse cargo handler `0x004d0040`, and the resolved report-page handlers rooted at `0x004d38c0`, `0x004d3d90`, and the neighboring editor report family. Current grounded caller and page-table evidence now make this the broad editor-side active-page dispatcher rather than another page-local callback block.","objdump + caller inspection + UI dispatch inspection + page-handler correlation" 0x004d0420,1618,map_editor_city_count_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `City Count Stats` editor report. The helper aggregates land-cell and city counts from the active world and region collections, derives per-10K density ratios, and formats the visible summary through localized ids `1059..1070`, including `Total Land Cells`, `Total Cities`, `Average City Building Density`, `Average Region Building Density`, and the projected starting-industry and non-industry building counts. The projected-building side is tighter now too: it walks the live region collection `0x0062bae0`, sums world_region_query_projected_structure_count_scalar_by_category `0x004234e0` for categories `2`, `3`, and `0`, and then combines those projected category scalars with the live-region count byte `[region+0x242]` and density float `[region+0x25a]` to build the final industry and non-industry summary terms. Current grounded caller is the neighboring report-page constructor at `0x004d30a0`.","objdump + RT3.lng strings + caller inspection + world and region count correlation + projected-structure-scalar correlation" 0x004d0a90,3416,map_editor_general_validation_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `General Validation` editor report. The helper walks the current scenario and world state looking for high-level validation failures, including missing industry in a city or region, mismatches between available player slots and the current player-pool setup, missing briefing text, and missing scenario description, then emits the matching warning lines through localized ids such as `1071`, `1073`, `1074`, and `1075`. Current grounded caller is the page constructor at `0x004d3080`, which makes this the actual general-validation report rather than the tree-stats page previously grouped under that label.","objdump + RT3.lng strings + caller inspection + validation-string correlation" @@ -3403,12 +3414,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00595bc0,272,multiplayer_transport_enqueue_capacity_descriptor_record,shell,cdecl,inferred,objdump + local disassembly,3,"Owner callback for the capacity-descriptor route callback table rooted at `[transport+0x1164]`, building and enqueueing one opcode-`2` descriptor-block record tied to the borrowed sidecar pointer at `[transport+0x1778]`. The route-callback-table constructor `0x5905e0` installs this helper with owner cookie `transport`; later append-notify `0x590370` and decode-service `0x5908c0/0x5911e0` invoke it with `ecx = table object`, the route descriptor or special decode frame on the stack, and the transport cookie on the stack. Inside that callback it always reads the sidecar pointer first; modes `3` and `5` use it immediately, while mode `0` branches through a live descriptor-property build path and then still consumes the same sidecar metadata triplet `[sidecar+0x0c/+0x10/+0x18]` just before publishing the record. Mode `0` is therefore the populated live-capacity branch rather than a sidecar-free fallback: it resolves the current descriptor's primary IPv4 through `0x58d1f0`, formats one local stem through `0x58d170(0x005e1fd8, 0x005e2230)`, queries the four keyed integer properties `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` through `0x58d6d0(0x005e2280/0x005e2274/0x005e2268/0x005ce1a0)`, and then forwards those five live payload lanes plus the borrowed callback-wrapper triplet into `multiplayer_transport_enqueue_descriptor_block_record` `0x592ae0` with `EDX=1`. Modes `3` and `5` are the live receive-state callbacks sourced by `multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine` `0x5911e0` and its inner decode state machine `0x5908c0`: they enqueue the same outer callback-wrapper triplet but deliberately zero all seven descriptor-payload lanes, using `EDX=1` for mode `3` and `EDX=0` for mode `5`, before unlinking the borrowed sidecar through `0x5933a0`. Modes `1`, `2`, and `6` are now explicitly bounded as no-op fallthroughs in this owner callback: compact-descriptor upsert notifies mode `1` through `0x590d00`, generic removal notifies mode `2` through `0x590430`, and the receive-header gate notifies mode `6` through `0x5908c0`, but this leaf stages no descriptor block for those modes. The negative result is stronger now too: direct local field-xref scans hit neighboring lifecycle fields `[transport+0x176c]`, `[transport+0x1770]`, `[transport+0x1774]`, `[transport+0x177c]`, `[transport+0x1780]`, and `[transport+0x1784]`, while the owned transient-work lifecycle at `0x593330/0x593370/0x593380/0x5934e0/0x5933a0`, the constructor or teardown owners `0x58dc50/0x596090/0x5961b0`, the reset or service strip `0x596060/0x596210/0x596530`, and the neighboring active-opcode reset path `0x5929a0` still never seed `[transport+0x1778]`. Broader local text scans also fail to show any `lea`-based replay-band writer or block-copy owner spanning the full `0x176c..0x1784` band, and a full-binary literal-offset sweep still finds only this read at `0x595bce`. The callback-binding family now sharpens that boundary too: `0x5934e0` stages the shared work-record metadata triplet, `0x593650` binds it into the callback-table worker path, and `0x593570` later consumes and republishes it, while `[transport+0x1778]` still appears only as the borrowed sidecar read in this callback owner. So the producer remains upstream of the mapped binary and is best treated as an external callback or worker handoff rather than one missing ordinary direct, derived-address, literal-offset, constructor-side, or higher callback-owner lifecycle store. Current evidence therefore bounds this as a real capacity or occupancy descriptor publisher over one cached borrowed work record, not a vague route-progress helper or a custom replay-scalar blob.","objdump + local disassembly + strings + capacity-cache correlation + route-callback-table ownership correlation + work-record correlation + descriptor-block correlation + mode split correlation + opcode2-payload correlation + generic-owner-mode correlation + negative-xref correlation + callback-triplet correlation + neighboring-field-lifecycle correlation + live-receive-owner correlation + negative-derived-address-scan + constructor-teardown-band scan + full-binary literal-offset scan + request-collection-lifecycle correlation + constructor-zero-init correlation + explicit-owner-mode-noop correlation + higher-owner-lifecycle correlation + callback-binding-boundary correlation + sidecar-required-live-branch correlation" 0x00595ce0,22,multiplayer_transport_clear_capacity_descriptor_route_callback_table_live_runtime_only,shell,cdecl,inferred,objdump + local disassembly,3,"Clears only the live runtime for the auxiliary capacity-descriptor route callback table at `[this+0x1164]` through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740` when callback-table plumbing latch `[this+0xba0]` is present. Unlike the broader field-subscription reset `0x595b80`, this helper does not touch `[this+0xba4]`, `[this+0x1724]`, the queued descriptor families, or the active opcode collection. Current grounded callers use it before disconnect and broader route-state cleanup.","objdump + local disassembly + caller inspection + route-callback-table correlation + negative-owner-scope correlation" 0x00595d00,83,multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small compatibility gate over one staged route-callback payload versus the current bound route object. It compares the caller descriptor's primary IPv4 dword through `0x58d1f0` against bound-route field `[binding+0x54]`. When payload byte-flag getter `0x58d220` carries bit `0x2`, it also requires the descriptor's secondary IPv4 dword from `0x58d240` to match `[binding+0x58]` and the descriptor's host-order port word from `0x58d250` to match `[binding->route+0x30]`; otherwise it falls back to the single-port getter `0x58d200` against that same route word. The helper returns `1` only when the full required tuple matches and `0` otherwise. Current grounded caller is `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, where this tuple check short-circuits the broader capacity path. This row is intentionally scoped to the route-binding descriptor family, not the selector-view `X...X|%d` marker tuple.","objdump + local disassembly + caller inspection + descriptor-getter correlation + route-binding-layout correlation + tuple-match correlation" -0x00595d60,84,multiplayer_transport_check_capacity_and_optionally_invoke_bound_route_callback,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Capacity-side gate beneath the `gsi_am_rating` route transition family. When a bound route already exists at `[this+0x1ecc]`, the helper first reuses `multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple` `0x595d00`; a successful tuple match returns immediately through `multiplayer_transport_invoke_bound_route_callback_if_present` `0x592710`. Otherwise it samples the caller descriptor's `maxplayers` and `numplayers` fields through `0x58d6d0` using the fixed keys at `0x005ce194` and `0x005ce1a0`, and only when the current player count is still below the max-player cap does it again fall into `0x592710`. Failure on both branches returns `0`. Current grounded caller is `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`, where this helper forms the immediate route-transition gate before the staged route-callback payload path.","objdump + local disassembly + caller inspection + descriptor-capacity correlation + route-binding-callback correlation" +0x00595d60,84,multiplayer_transport_check_capacity_and_optionally_invoke_bound_route_callback,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Capacity-side gate beneath the `gsi_am_rating` route transition family. When a bound route already exists at `[this+0x1ecc]`, the helper first reuses `multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple` `0x595d00`; a successful tuple match returns immediately through `multiplayer_transport_invoke_bound_route_callback_if_present` `0x592710`, which is the already-bound fast path rather than a fresh live-route transition. Otherwise it samples the caller descriptor's `maxplayers` and `numplayers` fields through `0x58d6d0` using the fixed keys at `0x005ce194` and `0x005ce1a0`, and only when the current player count is still below the max-player cap does it again fall into that same `0x592710` bound-route callback lane. Failure on both branches returns `0`. Current grounded caller is `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`, where this helper forms the immediate already-bound-or-capacity gate before the staged route-callback payload path.","objdump + local disassembly + caller inspection + descriptor-capacity correlation + route-binding-callback correlation + bound-fastpath correlation" 0x00595dc0,79,multiplayer_transport_try_transition_after_capacity_gate,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Transition gate beneath the `gsi_am_rating` callback family. It first rejects immediately when either staged-route busy latch `[this+0x1e8c]` or selector slot object `[this+0x38c]` is non-null. Otherwise it reuses `multiplayer_transport_check_capacity_and_optionally_invoke_bound_route_callback` `0x595d60`; only when that capacity gate returns positive does it continue. The success path then refreshes route-side selector state through `0x5973b0`, resets selector slot `2` through `multiplayer_transport_reset_selector_slot` `0x5954b0` with fixed text `0x005c87a8`, forwards the caller descriptor into `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, and only when that staging call reports success falls into `multiplayer_transport_set_route_mode` `0x595650` mode `0`. Any busy-latch, capacity, or staging failure returns without changing route mode. Current grounded callers are the ready-descriptor branch in `0x595e10` mode `1` and the mode-`0` fast path in `0x595f70`.","objdump + local disassembly + caller inspection + route-mode correlation + staged-callback correlation" 0x00595e10,321,multiplayer_transport_dispatch_am_rating_route_event_mode,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Dispatches route-event modes for the `gsi_am_rating` callback branch rooted at the primary-endpoint table `[this+0x18bc]` and queued descriptor family `[this+0x1e7c]`. Mode `0` first checks descriptor flag-byte `0x15` bit `0x1`: clear-bit descriptors are upserted directly into the primary-endpoint table through `multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port` `0x00591330`, while set-bit descriptors are reinserted into the queued family through `multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag` `0x005a09a0` with pending tag `1/0`. Mode `1` first requires descriptor state-byte ready bit `0x2`; clear-ready descriptors go straight back into that same queue family, while ready descriptors next test flag-byte `0x15` bit `0x1`, suppressing the direct transition path for endpoint-only records and otherwise falling into `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`. Mode `2` removes descriptors still carrying queued pending-state bits `0x04/0x08` through `0x005a0cd0`. Mode `3` checks endpoint-table emptiness through `0x590470` and forces route mode `2` only when no primary endpoint remains. Mode `4` stamps `[this+0x1ed4] = 1` and then switches route mode based on callback-table sentinel `[this+0x18b8]` plus deferred descriptor pointer `[this+0x1ed8]`, producing mode `1` when no deferred descriptor is staged and mode `3` when one is present. Mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the field-cache subslot `[this+0x1724+0x24]` through `multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter` `0x005a0940`, not into `[this+0x1778]`. The strongest current read remains that flag byte `0x15` bit `0x1` marks primary-endpoint-seed or endpoint-only descriptors: they can be staged and enriched through the queue family, but they do not take the richer direct transition path used by clear-bit descriptors.","objdump + local disassembly + caller inspection + endpoint-table correlation + queued-descriptor correlation + transition-suppression correlation + companion-dword-slot correlation" 0x00595f70,237,multiplayer_transport_dispatch_am_rating_route_callback,shell,cdecl,inferred,objdump + local disassembly + strings + endpoint-table correlation,3,"Callback handler for the `gsi_am_rating` route branch rooted at the primary-endpoint table `[this+0x18bc]`. Mode `0` forwards directly into `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`. Mode `2` is now grounded as the real owner above the staged route-callback path, not just a vague table walk: it requires current route mode `1`, no live selector object at `[this+0x398]`, and no busy slot object at `[this+0x38c]`; then it walks the primary-endpoint table through `0x590470/0x590480`, prunes stale entries against `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, and refreshes every surviving entry's `gsi_am_rating` property through `0x58d130` using fixed key `0x005e228c`. After that sweep it branches on table emptiness. When the table is empty it forces route mode `2` through `multiplayer_transport_set_route_mode` `0x595650`. Otherwise it stages the same fixed `gsi_am_rating` key into the endpoint table through `0x590310`, selects the current head entry through `0x590480` with index `0`, forwards that head descriptor into `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, and on submit failure falls back to route mode `0`. Success leaves the staged callback path to drive the later route-mode ladder through `0x595860`. This now closes the owner split above `0x5958e0` without inventing a separate fake function boundary at internal label `0x596000`.","objdump + local disassembly + strings + endpoint-table correlation + route-mode correlation + staged-callback correlation" 0x00596060,48,multiplayer_transport_reset_am_rating_route_runtime_and_queued_descriptor_family,shell,cdecl,inferred,objdump + local disassembly,3,"Resets the `gsi_am_rating` route branch when callback-table plumbing latch `[this+0xba0]` is present: it zeroes am-rating state latch `[this+0x1ec4]`, clears the live runtime for the primary-endpoint callback table `[this+0x18bc]` through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, and clears the companion queued descriptor family `[this+0x1e7c]` through `0x5a0950`. The helper does not touch the field-subscription table `[this+0xba4]` or the capacity-descriptor table `[this+0x1164]`. Current grounded callers are the route-mode owner `0x595650` and the reopen helper `0x596530`.","objdump + local disassembly + caller inspection + am-rating-owner correlation + negative-owner-scope correlation" -0x00596090,272,multiplayer_transport_construct_route_callback_tables_and_descriptor_caches,shell,cdecl,inferred,objdump + local disassembly,3,"Constructor-side owner for the transport callback-table branch. It constructs the field-subscription table `[this+0xba4]` through `multiplayer_transport_route_callback_table_construct` `0x5905e0` with owner callback `0x595a40`, owner cookie `this`, route-label bands `[this+0xb58]` and `[this+0xb78]`, descriptor/schema owner `[this+0xb98]`, and base runtime state `[this+0x60]`; seeds the companion field-cache family `[this+0x1724]` through `0x5a08f0` with helper `0x595b60` and fixed descriptor stem `0x00629d50`; constructs the capacity-descriptor route callback table `[this+0x1164]` through the same `0x5905e0` path but with owner callback `0x595bc0`; then builds one fixed `0x20`-byte `gsi_am_rating` route label on the stack from local transport name `[this+0x60]` plus suffix template `0x005dccfc`, constructs the primary-endpoint table `[this+0x18bc]` through `0x5905e0` with owner callback `0x595e10` and that stack-built label, and finally seeds the queued descriptor family `[this+0x1e7c]` through `0x5a08f0` with helper `0x595f70` plus fixed stem `0x00629d54`. On success it clears staged route-callback payload slot `[this+0xb50]`, sets callback-table plumbing latch `[this+0xba0] = 1`, and leaves the surrounding route-label and descriptor-cache band ready for the later open or reopen owners `0x5962e0` and `0x596530`. This stronger lifecycle decode now also makes the negative result around `[this+0x1778]` explicit: constructor-side setup seeds the surrounding route tables, labels, caches, and staged payload slot without ever seeding that sidecar slot.","objdump + local disassembly + constructor-argument correlation + route-label correlation + latch-state correlation + higher-owner-lifecycle correlation + fixed-stem correlation" +0x00596090,272,multiplayer_transport_construct_route_callback_tables_and_descriptor_caches,shell,cdecl,inferred,objdump + local disassembly,3,"Constructor-side owner for the transport callback-table branch. It constructs the field-subscription table `[this+0xba4]` through `multiplayer_transport_route_callback_table_construct` `0x5905e0` with owner callback `0x595a40`, owner cookie `this`, route-label bands `[this+0xb58]` and `[this+0xb78]`, descriptor/schema owner `[this+0xb98]`, and base runtime state `[this+0x60]`; seeds the companion field-cache family `[this+0x1724]` through `0x5a08f0` with helper `0x595b60` and fixed descriptor stem `0x00629d50`; constructs the capacity-descriptor route callback table `[this+0x1164]` through the same `0x5905e0` path but with owner callback `0x595bc0`; then builds one fixed `0x20`-byte `gsi_am_rating` route label on the stack from local transport name `[this+0x60]` plus suffix template `0x005dccfc`, constructs the primary-endpoint table `[this+0x18bc]` through `0x5905e0` with owner callback `0x595e10` and that stack-built label, and finally seeds the queued descriptor family `[this+0x1e7c]` through `0x5a08f0` with helper `0x595f70` plus fixed stem `0x00629d54`. On success it clears staged route-callback payload slot `[this+0xb50]`, sets callback-table plumbing latch `[this+0xba0] = 1`, and leaves the surrounding route-label and descriptor-cache band ready for the later open or reopen owners `0x5962e0` and `0x596530`. Current local disassembly now also makes one negative owner boundary explicit: this constructor seeds `[this+0xba4]`, `[this+0x1164]`, `[this+0x18bc]`, `[this+0x1e7c]`, `[this+0x1724]`, and `[this+0xb50]` but never seeds the borrowed sidecar slot `[this+0x1778]`, so that sidecar is not part of ordinary callback-table bring-up inside the mapped binary.","objdump + local disassembly + constructor-argument correlation + route-label correlation + latch-state correlation + higher-owner-lifecycle correlation + fixed-stem correlation + negative-sidecar-boundary correlation" 0x005961b0,92,multiplayer_transport_teardown_route_callback_tables_and_descriptor_caches,shell,cdecl,inferred,objdump + local disassembly,4,"Full teardown for the transport-owned route callback-table branch. It first clears the live field-subscription runtime, field-cache family, and active opcode-`3` records through `0x595b80`; then clears the live capacity-descriptor callback runtime through `0x595ce0`; and finally, when callback-table plumbing latch `[this+0xba0]` is set, destroys the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through `0x5907a0`, releases the companion caches `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0970`, and resets am-rating state latch `[this+0x1ec4]` to `0`. Current grounded caller is `multiplayer_transport_disconnect` `0x58d830`.","objdump + local disassembly + caller inspection + route-callback-table correlation + active-opcode correlation" 0x00596210,71,multiplayer_transport_service_route_callback_tables_and_descriptor_queues,shell,cdecl,inferred,objdump + local disassembly,3,"Recurring service sweep for the transport-owned route callback tables and descriptor queues. When callback-table plumbing latch `[this+0xba0]` is enabled it services the field-subscription table `[this+0xba4]`, the capacity-descriptor table `[this+0x1164]`, and the `gsi_am_rating` primary-endpoint table `[this+0x18bc]` through `0x591290`, then services the companion descriptor queues `[this+0x1724]` and `[this+0x1e7c]` through `multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition` `0x5a0c80`. Current evidence now bounds those queue families more tightly too: the service pass promotes pending state tags `0x4/0x8` into ready bits `0x1/0x2` before the higher transport-owned route branches consume them. Current grounded caller is `multiplayer_transport_service_frame` `0x58d8d0`, which makes this the callback-table side of the recurring multiplayer transport cadence. The same recurring sweep also strengthens the negative replay-band result: it services all local owner tables surrounding `[this+0x1778]` without ever writing that sidecar slot.","objdump + local disassembly + queue-state correlation + higher-owner-lifecycle correlation + caller inspection" 0x005962c0,32,multiplayer_transport_clear_staged_route_callback_payload,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the cloned staged route-callback payload handle at `[this+0xb50]`. When that slot is non-null the helper forwards the embedded owned object slot through `0x58d0d0`, then zeroes `[this+0xb50]`. Current grounded callers are the stale-request branch in `multiplayer_transport_handle_selector_text_route_request` `0x593bb0` and the selector-slot-`2` reset path around `0x595561`.","objdump + local disassembly + caller inspection + payload-slot correlation" @@ -3474,7 +3485,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00597380,34,multiplayer_transport_service_status_and_live_routes,shell,cdecl,inferred,objdump + local disassembly,3,"Recurring route-object sweep for the session-event transport. It first services the auxiliary status route at `[this+0xaf0]` through the broader route-object service helper `0x58d040` when present, then applies that same helper to the current live route at `[this+0x1ecc]`. The current grounded caller is the recurring multiplayer transport frame service, so this is now the explicit two-route owner sweep rather than a vague route-side tick wrapper.","objdump + local disassembly + caller inspection + route-object-service correlation" 0x005973b0,30,multiplayer_transport_release_live_route,shell,cdecl,inferred,ghidra-headless,4,Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state.,ghidra + rizin + llvm-objdump 0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the auxiliary status-route object at `[this+0xaf0]`. It first releases any existing status route through `multiplayer_transport_release_status_route` `0x597350`, then seeds the full six-entry callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0` together with owner scalar `[this+0xb34]`, owner context string `[this+0x60]`, and route-side callback storage `[this+0xaf4]`. When the caller route id is `-1` it opens the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40`; otherwise it uses the caller route id through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` after zero-extending the supplied route word. On success it copies stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears status-route mode mask `[this+0xb38]`, and returns `1`; failure returns `0` without those patches. Current grounded callers are the one-shot wrapper `0x5965a0`, the selector-status refresh owner `0x595650`, and the names-query response path `0x58e100` that later services this route through `0x597370`.","objdump + local disassembly + strings + caller correlation + callback-vector correlation + status-route correlation + route-id-width correlation" -0x00597480,261,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the current live route object at `[this+0x1ecc]`. It first releases any existing live route through `multiplayer_transport_release_live_route` `0x5973b0`, then builds one `0x20`-byte local identifier from owner text `[this+0x60]` plus suffix template `0x005dccfc` through `0x5a18a0` and `0x5a1eb0`. The helper then seeds the full live-route callback vector rooted at `0x596fd0`, `0x5970e0`, `0x597180`, `0x5971b0`, `0x597270`, and `0x5972c0`, forwards owner scalar `[this+0xb34]`, and chooses between the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40` when binding dword `[binding+0x2c]` is `-1`, or the binding-specific id in word `[binding+0x30]` through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` otherwise. On the binding-specific path it also clears any pending rebuild cookie at `[binding+0x34]` and marks the newly constructed route live by storing `1` into `[route+0xbc]`. On success it mirrors stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, clears live-route mode mask `[this+0xb38]`, mirrors success into deferred route-status flag `[this+0x1ed8]`, and returns `1`; failure returns `0`. In the grounded connect path it still does not patch `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]` after construction the way the status-route helper patches `[route+0xa0]`.","objdump + local disassembly + strings + caller correlation + live-route-callback-vector correlation" +0x00597480,281,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the current live route object at `[this+0x1ecc]`. It first releases any existing live route through `multiplayer_transport_release_live_route` `0x5973b0`, then builds one `0x20`-byte local identifier from owner text `[this+0x60]` plus suffix template `0x005dccfc` through `0x5a18a0` and `0x5a1eb0`. The helper then seeds the full live-route callback vector rooted at `0x596fd0`, `0x5970e0`, `0x597180`, `0x5971b0`, `0x597270`, and `0x5972c0`, forwards owner scalar `[this+0xb34]`, and chooses between the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40` when binding dword `[binding+0x2c]` is `-1`, or the binding-specific id in word `[binding+0x30]` through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` otherwise. On the binding-specific path it also clears any pending rebuild cookie at `[binding+0x34]` and marks the newly constructed route live by storing `1` into `[route+0xbc]`. On success it mirrors stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears live-route mode mask `[this+0xb38]`, and mirrors success into deferred route-status flag `[this+0x1ed8]`, which the later mode-`4` branch in `0x595e10` uses to choose route mode `1` versus `3`. Failure returns `0`. The remaining negative boundary is narrower now: current local evidence still does not show companion writes to `[route+0xa4]` or `[route+0xd4]` in the grounded live-route connect path.","objdump + local disassembly + strings + caller correlation + live-route-callback-vector correlation + deferred-route-flag correlation + extended-payload-callback correlation" 0x00598230,67,multiplayer_transport_enqueue_names_query_record,shell,cdecl,inferred,ghidra-headless,3,Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump 0x0058f0a0,99,multiplayer_transport_append_user_and_optional_nick_commands,shell,cdecl,inferred,rizin,3,Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path.,rizin + llvm-objdump + strings 0x0058f920,72,hashed_entry_table_upsert,support,cdecl,inferred,rizin,4,Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0.,rizin + llvm-objdump diff --git a/docs/control-loop-atlas/editor-breadth.md b/docs/control-loop-atlas/editor-breadth.md index 633dbac..5bebf47 100644 --- a/docs/control-loop-atlas/editor-breadth.md +++ b/docs/control-loop-atlas/editor-breadth.md @@ -89,7 +89,26 @@ The broader map-editor page owner is now bounded through tighter too: the row pair shown in `Supply Only` and `Production Demand->Supply` is the `+0x08` supplied-cargo selector, the row pair shown in `Demand Only` and `Production Demand->Supply` is the `+0x1c` demanded-cargo selector, and the single amount field at `+0x04` is labeled `Annual - Demand:` only in mode `1` but `Annual Supply:` in modes `2/3`. The stronger new runtime-side + Demand:` only in mode `1` but `Annual Supply:` in modes `2/3`. The editor-side token boundary is + narrower now too: `0x004cf910` re-enters the same runtime importer `0x00435630` on entry, then + exact-matches the persisted `+0x08/+0x1c` token strings against visible live cargo names through + `0x005a57cf` while seeding the selector controls. There is still no special marker decode on this + side; unmatched token strings simply leave the selector index at its zero default while the raw + scenario-state strings stay in the recipe-book slab, and `0x004d0040` writes those selected cargo + names back into `+0x08/+0x1c` verbatim rather than normalizing them first. The write-side control + map is tighter now too: `0x59d8` updates the shared production-cap float at `book+0x3ed`, + `0x59d9` opens the rename modal, `0x59da/0x59db` cycle the selected book modulo `12`, and + `0x59de` commits the selected book ordinal. The five line-level write bands are exact in the + same way: `0x5a0a..0x5a0e` write the line-mode dwords at `book+0x3f1+line*0x30`, + `0x5a1e..0x5a22` copy one live cargo name into the supplied-token lane at + `book+0x3f9+line*0x30`, `0x5a32..0x5a36` copy one live cargo name into the demanded-token lane + at `book+0x40d+line*0x30`, and `0x5a50..0x5a54` write the per-line amount float to + `book+0x3f5+line*0x30` after the handler clamps the entered value to `<= 6`. The constructor-side + usage summary is bounded too: it scans the live city-or-region collection at `0x0062bae0`, keeps + only rows whose usage gates `[entry+0x242]` and `[entry+0x2f6]` are live and whose current + recipe ordinal `[entry+0x2f2]` matches the selected book, concatenates up to eight visible names + from `[entry+0x356]` with the separator at `0x005c9f38`, counts the rest, and then formats the + bounded usage summaries from localized ids `508` and `509`. The stronger new runtime-side result is now a full chain rather than only the importer: `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` first imports those same five lines into one repeated array of identical `0xbc`-byte runtime descriptors with no row-index @@ -120,9 +139,17 @@ The broader map-editor page owner is now bounded through `[candidate+0x2a]` divided by the descriptor amount, while nonzero mode bypasses that scaling path and publishes the row amount directly. At that point the candidate import strip is structurally closed in current local evidence: the local import and rebuild seam is no longer - where the loader reconstructs runtime descriptor or membership tables, but only what the - unresolved supply-marker token family means before those already-grounded candidates are projected - back into live cargo ids. The immediate sibling + where the loader reconstructs runtime descriptor or membership tables. The remaining semantic gap + is narrower instead: current local evidence shows no hidden decode stage for the supply-marker + token family at all. The editor slab preserves unmatched token strings verbatim, the constructor + only reflects selector ordinals for tokens that already exact-match visible live cargo names, and + the importer later writes the exact-matcher result ids straight into the live descriptor lanes, + defaulting failed matches to cargo id `0`. The reset side narrows that further too: + `0x00436d10` only zero-fills the recipe books and reseeds their `# %1` name lane, so those + marker-like token strings are not coming from the built-in reset path. So the open question is + now only what upstream source, if any, authored those marker-like token strings before exact + matching. The + immediate sibling `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, which for subtype byte `[candidate+0x32] == 2` scans the imported descriptor strip and derives two compact post-import flags from mode `0` presence and whether every mode-`0` descriptor keeps at least @@ -141,8 +168,9 @@ The broader map-editor page owner is now bounded through side is explicit now too: `0x00436d10` is the shared reset-and-rebuild owner beneath startup and world-entry paths. It zeroes the late scenario-state bands, seeds the fixed year defaults and chairman-slot rows, rebuilds the two named availability collections at `[state+0x66b2]` and - `[state+0x66b6]`, re-seeds the twelve recipe books at `[state+0x0fe7]` from the fixed template - at `0x005c9f78`, refreshes selected-year state through `0x00409e80`, `0x00433bd0`, + `[state+0x66b6]`, zero-fills the twelve recipe books at `[state+0x0fe7]`, then only reseeds + their per-book name lane from the fixed `# %1` format string at `0x005c9f78` through + `0x0051b700 -> 0x00518de0`, refreshes selected-year state through `0x00409e80`, `0x00433bd0`, `0x00435603`, and the year-gap scalar helper `0x00434130`, and only then re-enters `0x00435630`, `0x0041e970`, `0x00412bd0`, and `0x00436af0`. The startup side is tighter now too: `0x00438890` does not jump straight into one selector-specific file-load branch. It first @@ -250,16 +278,18 @@ The broader map-editor page owner is now bounded through demand rows preserve string-bearing windows at `line+0x1c`, and the current probe shows those conservatively as prefixed ASCII previews such as `..Grain`, `..Corn`, `..Livestock`, and `..Milk`; local `objdump` now grounds `0x0041e9f0` itself as - `cargo_collection_find_entry_by_exact_name`, a direct exact-string walk over the live cargo - collection at `0x0062ba8c`. The importer at `0x00435630` feeds both token lanes through that same - matcher after one conservative in-place cleanup pass: empty strings are replaced with the first - live cargo name, and mode `3` loops until the supplied and demanded token strings no longer - compare equal. By contrast, the imported `supply-marker-entry` rows still feed nonprintable - windows such as `.@...` from `line+0x08` through that same exact matcher, and the resolver path - currently shows no special-case decoding for those marker forms. So the strongest static read is - now: the stem-like demand rows preserve cargo-name text but are skipped because their mode is - zero, while the nonzero imported marker rows are the live descriptor inputs yet likely fail exact - cargo-name resolution unless another upstream transform exists. + `cargo_collection_find_entry_id_by_exact_name`, a direct exact-string walk over the live cargo + collection at `0x0062ba8c` that returns one live cargo entry id or `0`. The importer at + `0x00435630` feeds both token lanes through that same matcher after one conservative in-place + cleanup pass: empty strings are replaced with the first live cargo name, and mode `3` loops + until the supplied and demanded token strings no longer compare equal. By contrast, the imported + `supply-marker-entry` rows still feed nonprintable windows such as `.@...` from `line+0x08` + through that same exact matcher, and the resolver path currently shows no special-case decoding + for those marker forms. So the strongest static read is now: the stem-like demand rows preserve + cargo-name text but are skipped because their mode is zero, while the nonzero imported marker + rows are the live descriptor inputs yet likely fail exact cargo-name resolution unless another + upstream transform exists; when they do fail, the importer writes the returned `0` ids directly + into the runtime descriptor cargo lanes instead of taking any special marker-side fallback path. The wrapper layer above that query no longer looks like a hiding place for special treatment either. Local `objdump` now shows `0x00412960` simply summing the two supply-side floats returned by `0x00412650`, while `0x004129a0` returns the single zero-mode cap-scaled subrow lane directly; diff --git a/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md b/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md index 8e620b8..701b782 100644 --- a/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md +++ b/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md @@ -364,7 +364,9 @@ setup still touches the surrounding callback-table and replay-band fields without ever seeding a nonzero value into `[transport+0x1778]`, so the local static seam is closed here: no ordinary constructor, reset, service, or callback-table owner in `RT3.exe` currently writes that sidecar, - and the producer looks upstream of this local cluster. + and the latest full-binary disassembly scan still finds only the `0x595bc0` read while the + neighboring lifecycle fields `[transport+0x177c/+0x1780/+0x1784/+0x178c/+0x17f8]` do show normal + constructor/reset/use sites. The producer therefore still looks upstream of this local cluster. Beside it, `0x58e200` is the broader callback-table attach or refresh owner: it seeds one immediate-drain context id, conditionally copies the local name into `[transport+0x04]`, clears `[transport]`, `[transport+0x48]`, and `[transport+0x1edc]`, stores follow-on callback @@ -736,6 +738,16 @@ validated-cookie event forwarder over callback slot `[transport+0x17f0]`, and `0x597330` is the validated extended-payload forwarder over `[transport+0x17f4]`; both reuse the same owner context at `[transport+0x17f8]`. The adjacent staged-route + capacity gate is tighter now too: `0x595d60` is not another live-route opener. It is the + immediate bound-route fast path and capacity gate under `gsi_am_rating`. When the staged + descriptor already matches the current live route through `0x595d00`, it returns straight + through `0x592710`; otherwise it only reuses that same bound-route callback lane when + `numplayers < maxplayers`. `0x595dc0` then uses that result exactly as the already-bound-or- + capacity gate before it clears selector slot `2`, stages route-callback payload through + `0x5958e0`, and only then re-enters route mode `0`. The live-route connect owner is narrower in + the same way: `0x597480` mirrors success into deferred route-status flag `[transport+0x1ed8]`, + and the later mode-`4` branch in `0x595e10` is the place that actually consumes that flag to + choose route mode `1` versus `3`. The adjacent staged-route callback side is tighter too: `0x595860` is now bounded as the submit-result handler beneath `0x5958e0`, and the old `[transport+0xac0]` ambiguity there is now gone. That branch is using the already-grounded third selector-generation counter at `[0xac0]` @@ -985,10 +997,11 @@ `0x005a08f0` is the constructor-side queue bootstrap that opens the queue-owned UDP socket and clears the active and pending list roots. The grounded live-route connect path at - `multiplayer_transport_try_connect_live_route` does not currently perform any matching - post-construction patch for `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]`, and the higher - route-mode state machine now looks consistent with that, but the owner is tighter than the old - flat mode list. `multiplayer_transport_set_route_mode` first applies one pre-dispatch gate: + `multiplayer_transport_try_connect_live_route` now matches the status-route side on the main + callback seam: after a successful connect it also patches `[route+0xa0]` through + `0x58bc90 -> 0x597330`. The remaining negative boundary is narrower now: current local evidence + still does not show matching post-construction writes to `[route+0xa4]` or `[route+0xd4]`, and + the higher route-mode state machine now looks consistent with that. `multiplayer_transport_set_route_mode` first applies one pre-dispatch gate: when a bound route still exists at `[this+0x1ec8]`, requested mode `2`, and selector slot `2` is not active, it submits one bound-route status request through `0x5959e0`. That request itself is now narrower too: it derives one request token from the current binding through `0x5934c0`, @@ -1035,8 +1048,10 @@ and chooses either the default route id `0x1964` through `0x58cc40` or the binding-specific id in `[binding+0x30]` through `0x58c9b0`; on the binding-specific path it also clears pending rebuild cookie `[binding+0x34]` and marks the constructed route live via `[route+0xbc] = 1`, - while the success tail mirrors stored route label `[this+0x9a8]` into `[this+0xb3c]` and clears - live-route mode mask `[this+0xb38]`. The stable + while the success tail mirrors stored route label `[this+0x9a8]` into `[this+0xb3c]`, patches + `[route+0xa0]` through `0x58bc90 -> 0x597330`, and clears live-route mode mask `[this+0xb38]`. + The remaining negative boundary is narrower now: current local evidence still does not show + companion writes to `[route+0xa4]` or `[route+0xd4]` in the grounded live-route connect path. The stable transitions therefore still switch by releasing route objects or route bindings and rebuilding route state, not by mutating callback slots in place. The parser behavior is now tighter as well: semicolon lines only dispatch when `[route+0xd4]` is non-null, and the subtype-`6` raw fallback only dispatches when `[route+0xa4]` diff --git a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md index 47155e0..2ad19bb 100644 --- a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md +++ b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md @@ -144,17 +144,23 @@ The same brush strip is tighter now too: records into the existing fixed-record/news lanes at `0x006cea4c` and `0x004337c0` rather than through a separate hidden journal family. before that later world and shell reactivation tail, `world_entry_transition_and_runtime_bringup` - runs one distinct post-bundle status and runtime refresh phase that posts progress ids `0x196` - and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes the - live event collection at `0x0062be18` through - `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the - scenario-side port-or-warehouse cargo recipe runtime tables through `0x00435630`, and then runs - the named-candidate availability preseed through `0x00437743`. That preseed lane is tighter now - too: it walks the live candidate pool at `0x0062b268` in reverse, forces one override bit `0` - whenever the candidate availability word `[candidate+0xba/+0xbb]` is already nonzero, derives the - remaining zero-word subtype cases from the local `2 xor [candidate+0x32]` parity check, and only - skips those subtype-derived rows when the copied stage counter from `0x00620e94` is nonzero - before re-entering `0x00434f20` on the candidate stem at `[candidate+0x04]`. The event-side + runs two separate recipe-runtime rebuild moments rather than one monolithic import step. The + earlier call at `0x00443ebc` fires immediately after the named candidate-availability collection + at `[world+0x66b2]` has been restored from fixed `0x22`-byte rows and before the neighboring + candidate filter/count rebuilds `0x00412c10/0x00412bd0` plus the year-derived follow-ons + `0x00434130/0x00436af0`. The later call at `0x00444ac1` sits inside the explicit `0x197` + checkpoint after `world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides` + `0x004354a0` and the territory-side sweep `0x00487de0`, and only then falls through into the + named-candidate availability preseed `0x00437737` plus the later candidate-filter refresh + `0x00412c10`. The post-bundle status and runtime refresh phase around those checkpoints still + posts progress ids `0x196` and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` + follow-ons, and refreshes the live event collection at `0x0062be18` through + `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. That preseed + lane is tighter now too: it walks the live candidate pool at `0x0062b268` in reverse, forces one + override bit `0` whenever the candidate availability word `[candidate+0xba/+0xbb]` is already + nonzero, derives the remaining zero-word subtype cases from the local `2 xor [candidate+0x32]` + parity check, and only skips those subtype-derived rows when the copied stage counter from + `0x00620e94` is nonzero before re-entering `0x00434f20` on the candidate stem at `[candidate+0x04]`. The event-side `.smp` bridge is tighter now too: the save-side companion `0x00433060` opens chunk `0x4e99`, writes version dword `0x3e9`, first walks the live event collection through @@ -201,7 +207,7 @@ The same brush strip is tighter now too: writes the standalone runtime condition-row chain plus the four grouped runtime-effect row chains into the packed stream. The recipe rebuild lane itself is tighter now too: `0x00435630` resolves both token lanes through the exact live cargo-name matcher - `cargo_collection_find_entry_by_exact_name` `0x0041e9f0`, fills empty token strings from the + `cargo_collection_find_entry_id_by_exact_name` `0x0041e9f0`, fills empty token strings from the first live cargo entry before that match, and in mode `3` keeps reseeding the primary lane from that same first live cargo name until the primary and subordinate strings no longer compare equal through `0x005a57cf`. The importer-side bridge is tighter now too: each of the twelve recipe @@ -210,15 +216,44 @@ The same brush strip is tighter now too: the paired runtime count lane beside the imported `0xbc` descriptor strip. The five runtime slots are zeroed and seeded with fixed year-window defaults before any nonzero-mode line is imported, and each nonzero line amount is normalized to at least `1.0` before the mode `1/3` - direct primary half and mode `2/3` one-row subordinate half are populated. Mode `2` copies the - normalized line amount into `[desc+0x48]`, while mode `3` overwrites that same subordinate amount - with literal `1.0` after the token-divergence loop succeeds. + direct primary half and mode `2/3` one-row subordinate half are populated. The matcher return + value is explicit now too: `0x0041e9f0` returns one live cargo entry id or `0`, and the importer + writes that value straight into `[desc+0x1c]` and `[desc+0x44]` without any post-match failure + guard. The editor-side `Port/Warehouse Cargos` page is tighter in the same way: its constructor + `0x004cf910` exact-matches the persisted `+0x08/+0x1c` token strings against visible live cargo + names only to seed selector indices, leaves unmatched strings at the zero-selector default, and + separately derives the bounded usage summaries `508/509` by scanning the live city-or-region + collection for rows whose current recipe ordinal `[entry+0x2f2]` matches the selected book. The + paired handler `0x004d0040` then writes the selected cargo names back into those token slots + verbatim. That handler is tighter now too: `0x59d8` is the top-level shared production-cap field + and writes `book+0x3ed` after clamping the parsed value to `<= 8`; `0x59d9` only opens the + rename modal over the current `0x3c`-byte book-name span; `0x59da/0x59db` cycle the selected + recipe book backward or forward modulo `12`; and `0x59de` commits the selected book ordinal into + `0x006cffa4`. The five per-line write bands are now exact too: `0x5a0a..0x5a0e` write the mode + dwords at `book+0x3f1+line*0x30`, `0x5a1e..0x5a22` copy one live cargo name into the supplied + token lane at `book+0x3f9+line*0x30`, `0x5a32..0x5a36` copy one live cargo name into the + demanded token lane at `book+0x40d+line*0x30`, and `0x5a50..0x5a54` write the per-line amount + float to `book+0x3f5+line*0x30` after clamping the parsed value to `<= 6`. + So the stronger current boundary is now explicit on both sides: there is still no special marker + decode before import, and unmatched token strings simply survive in scenario state until + `0x0041e9f0` returns cargo id `0`. + Mode `2` copies the normalized line amount into `[desc+0x48]`, while mode `3` overwrites + that same subordinate amount with literal `1.0` after the token-divergence loop succeeds. After the full twelve-book sweep the helper explicitly re-enters `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` when the live candidate collection exists. That keeps the strongest current static split narrow and concrete: mode-zero demand rows can still preserve readable cargo-name text in the saved recipe - books, but only the nonzero imported rows reach the live `0xbc` descriptor array, and the - unresolved supply-marker forms still have no special decode path before the exact matcher runs. + books, but only the nonzero imported rows reach the live `0xbc` descriptor array. The remaining + supply-marker gap is now narrower too: current local evidence shows no special decode path at + all before exact-name resolution. The editor-side page only reflects selector ordinals when the + persisted token strings already match visible live cargo names, and the importer itself writes + the exact-match result ids straight into `[desc+0x1c]` and `[desc+0x44]`, defaulting failed + matches to cargo id `0`. The reset side narrows that authorship question further too: + `0x00436d10` only zero-fills the recipe books and reseeds their `# %1` name lane, so those + marker-like token strings are not coming from the built-in reset template. So the open question + is now only what upstream source, if any, authored those marker-like token strings before exact + matching, not whether one hidden runtime decode stage still sits between the saved recipe books + and the live descriptor arrays. The first grounded consumer beneath that import bridge is tighter now too: `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` lazily stamps the current scenario year into `[candidate+0x788]`, rebuilds four banks across both mode banks `0/1`, and @@ -331,8 +366,11 @@ The same brush strip is tighter now too: symmetrically. The surrounding `.smp` lane is tighter too: at version `>= 0x3f1` the save path also writes the late world-status block at `[world+0x66be]` through chunk ids `0x2ee0/0x2ee1`, and the restore path reads that same pair back while older bundles clear the compatibility tail - at `[world+0x6987]`; both sides also copy the raw twelve `0x4e1` recipe books at - `[world+0x0fe7]` directly into or out of the bundle before the wider world-cell loops. One + at `[world+0x6987]`; both sides also preserve the same twelve `0x4e1` recipe books at + `[world+0x0fe7]` as one exact `cap dword + 0x3d-byte header + five repeated line tuples` + structure, where each repeated `0x30`-byte line is serialized field-by-field as mode dword + `+0x00`, annual amount float `+0x04`, supplied-token window `+0x08`, and demanded-token window + `+0x1c` before the wider world-cell loops continue. One serializer-side negative boundary is explicit now too: after the save path emits the six-dword economic tuning band at `[world+0x0be2..+0x0bf6]`, it spends its next large loops on per-cell world-grid, overlay-mask, sidecar-plane, and secondary-raster bit serialization and only then @@ -356,7 +394,7 @@ The same brush strip is tighter now too: `0x005069c6`, which now makes this whole slot cluster look like broader runtime consumers of scenario special conditions rather than one startup-only mode enum. That startup-side consumer split is tighter now too: inside the localized `Computing Transportation and Pricing...` bring-up - lane, `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743` only runs + lane, `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437737` only runs before global stage counter `0x00620e94` reaches `0x26ad`, reverse-walks the live candidate pool, and seeds the scenario-side named availability table through `0x00434f20` with one override bit derived directly from current live candidate state. Any nonzero availability pair @@ -365,13 +403,22 @@ The same brush strip is tighter now too: branch and only skips those subtype-driven cases when the copied stage counter is already nonzero. The same startup strip then flows into `world_seed_default_chairman_profile_slots` `0x004377a0`, which compacts the 16 staged chairman slot records at `[world+0x69d8]`, writes the first-pass - selector bytes into `[profile+0x87+i]`, and only after that materializes the named-profile rows - through `0x00476140`. So the save-derived special-condition band no longer sits beside anonymous - startup glue: the bring-up path now has one concrete candidate-availability mirror at - `0x00437743`, one concrete chairman-slot selector seeding pass at `0x004377a0`, and then the - economy burst `0x00437b20`, whose own loop count is now tighter than before because a nonzero - `[world+0x4af7]` forces the chunk count to literal `0x150` instead of leaving the shell-side - `[0x006cec74+0x178]` count in control. One file-side anchor is now tighter too: the checked + selector bytes into `[profile+0x87+i]`, allocates one fresh persona-record id for each nonzero + selector, and only after that materializes the named-profile rows through `0x00476140`. The + neighboring materializer `world_build_chairman_profile_slot_records` `0x00437220` is tighter now + too: it first rebuilds one local `0x29`-byte occupied-persona mask from the two `0x48`-byte + staging records rooted at `[world+0x69db]`, optionally waits on the multiplayer preview owner at + `0x006cd8d8`, then resolves selector `0` through the first unused persona ordinal in + `[world+0x6987]` while selectors `<0x64` map to `selector-1` and selectors `0x64+` map to the + later-opponent range. That same pass copies the staged tuning dword from `[slot+0x04]` into + `[profile+0x154/+0x158]`, can clear or set `[profile+0x293]` on the multiplayer-preview side + path, and finally seeds `[world+0x25]` plus `[world+0x21]` from the resolved first profile row. + So the save-derived special-condition band no longer sits beside anonymous startup glue: the + bring-up path now has one concrete candidate-availability mirror at `0x00437737`, one concrete + chairman-slot selector seeding pass at `0x004377a0`, one concrete chairman-profile materializer + at `0x00437220`, and then the economy burst `0x00437b20`, whose own loop count is now tighter + than before because a nonzero `[world+0x4af7]` forces the chunk count to literal `0x150` instead + of leaving the shell-side `[0x006cec74+0x178]` count in control. One file-side anchor is now tighter too: the checked classic and 1.05 `gmp/gms/gmx` corpus does expose the same aligned `0x0d64..0x0e2c` `50`-dword band as the grounded `.smp` runtime save or restore copy into `[world+0x4a7f..+0x4b43]`, but most checked file families only populate a sparse subset of that @@ -444,7 +491,17 @@ The same brush strip is tighter now too: `[world+0x4c74]` `Auto-Show Grade During Track Lay`, `0x0f5d` maps to `[world+0x4c78]` `Starting Building Density Level`, `0x0f61` maps to `[world+0x4c7c]` `Building Density Growth`, `0x0f65` maps to grounded dword `[world+0x4c80]` `leftover simulation time accumulator`, and - `0x0f6d` maps to byte `[world+0x4c88]` `selected-year lane snapshot`. The next later grounded + `0x0f6d` maps to byte `[world+0x4c88]` `selected-year lane snapshot`. The write-side owner strip + for the two building-density fields is explicit now too: the editor page + `0x004ca910/0x004cb9f0` still owns the ordinary three-state UI path, but the tiny helper family + `0x004cba34/0x004cba43/0x004cba56/0x004cba69/0x004cba78` also gives direct and fixed-preset + writes into `[world+0x4c78]` and `[world+0x4c7c]`, with hard-wired low/high helpers for the same + saved density modes. The selected-year snapshot lane is narrower now too: both + `world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text` `0x004367c0` and the nonzero + outcome branch inside `world_apply_compact_runtime_effect_record_to_resolved_targets` + `0x00431b20` copy current absolute calendar counter `[world+0x15]` into `[world+0x4c88]`, and + the periodic year-step branch at `0x0040a280` later compares the absolute delta between those two + lanes against one fixed threshold before it reasserts world flag `[world+0x4d]`. The next later grounded field after that is no longer best read as a dword either: `0x0f71` is the first byte of the cheat-toggled scenario-lock trio rooted at `[world+0x4c8c..+0x4c8e]`, not the start of one independently grounded 4-byte scalar. Current runtime-side evidence only gives one narrower @@ -477,9 +534,19 @@ The same brush strip is tighter now too: A second byte-oriented neighborhood immediately after that now has the same kind of split rather than a clean restored-field mirror. The earlier grounded anchors in that band all stay zero in the checked 1.05 saves: exact file offset `0x0f87` maps to selected-year bucket companion scalar - `[world+0x4ca2]`, while `0x0f93` and `0x0f97` map to the two startup-dispatch reset-owned bands + `[world+0x4ca2]`, while `0x0f93` and `0x0f97` map to the two startup-owned dwords `[world+0x4cae]` and `[world+0x4cb2]`, and the local corpus leaves all three exact dword starts - zeroed. The same is true for the later exact byte-owned policy lanes: file offsets `0x0f78`, + zeroed. Those two later dwords are tighter now in lifecycle even though their user-facing meaning + is still open: the startup-runtime pre-dispatch helper + `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0` clears both before + `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, the broader + scenario-state reset owner `0x00436d10` clears them again with the rest of the late save-visible + cluster, and the post-fast-forward selected-year tail around `0x00437120` clears them one more + time alongside the shell presenter cache band `[0x006d4024+0x11425a..+0x114276]`. Local static + evidence still does not show any non-clear readers or nonzero writers for `[world+0x4cae]` or + `[world+0x4cb2]`, so the safest current read is still structural: they are startup and reload + lifecycle dwords, not yet another grounded policy or simulation lane. The same is true for the + later exact byte-owned policy lanes: file offsets `0x0f78`, `0x0f7c`, `0x0f7d`, and `0x0f7e` map cleanly to grounded byte fields `[world+0x4c93]` and `[world+0x4c97..+0x4c99]`: the linked-site removal follow-on gate plus the three editor locomotives-page policy bytes `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All @@ -512,9 +579,12 @@ The same brush strip is tighter now too: `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2]` to `0x3c75c28f`, and seeds `[world+0x0bf6]` to `0x3ba3d70a` before the later selected-year and candidate refresh path runs. The recipe-side reset is explicit in the same way: after zeroing exactly `0xea3` dwords rooted at - `[world+0x0fe7]`, the same owner repopulates all twelve `0x4e1`-byte books from the fixed - template table at `0x005c9f78`, using generated ordinal strings `1..12` as the per-book name - lane before later runtime recipe projection re-enters `0x00435630`. That + `[world+0x0fe7]`, the same owner does not preload one full recipe-book payload table. Instead it + seeds only the per-book name lane from the fixed format string `# %1` at `0x005c9f78`, using + generated ordinal strings `1..12` through `0x0051b700 -> 0x00518de0`, before later runtime + recipe projection re-enters `0x00435630`. That means the reset path itself does not author any + default line modes, amounts, or cargo-token strings in the later `book+0x3ed/+0x3f1` payload. + That same reset owner is now the strongest current live bridge over the whole later pre-recipe plateau: after clearing `[world+0x4cc2..+0x4d02]` it rebuilds the named candidate and locomotive @@ -526,8 +596,20 @@ The same brush strip is tighter now too: by era-policy and named-availability gates. So the aligned scalar plateau `0x0fa7..0x0fe7` now has a stronger boundary than “some bytes before the recipe books”: it is the later save-side neighbor immediately in front of a reset-and-rebuild band whose - downstream consumers are already grounded. The local layout seam is therefore closed even though - we still do not have live semantic names for most of the plateau dwords themselves. The + downstream consumers are already grounded. Local operand-side evidence is negative in a useful + way too: after the bulk clear at `0x00436d10`, the current binary does not expose direct + literal-offset reads or writes for the first dwords in `[world+0x4cc2..]`, so the opening slice + of that plateau is currently better treated as one save-visible late-state family with a grounded + reset owner than as a hidden cluster of missed per-field seams. The local layout seam is + therefore closed at the current evidence level even though we still do not have live semantic + names for most of the plateau dwords themselves. The adjacent startup-side special-case gate is + bounded now too: `0x00436c70` is not another generic late-state scalar helper. It is one + hard-coded tutorial-signature predicate that only returns true when selector `0x10` is paired + with the `384x448` map-size check, a live city count of `0x41`, first city name + `Italy - North`, the current shell-side file/scenario root satisfying `0x4331e0 == 0x16`, and + row `7` subtype byte `0x6`; the neighboring string table points at `Tutorial_2.gmp`. So this + branch belongs with the startup/load special-case gates beside the reset owner, not with the + unresolved per-dword semantics of the `0x4cc2..` plateau itself. The serializer-side evidence now sharpens that same boundary too: current local disassembly of `0x00446240` writes the leading six-dword tuning band, then falls into the world-grid and secondary-raster loops, and only after those loops jumps straight to `[world+0x0fe7]` for the @@ -572,9 +654,11 @@ The same brush strip is tighter now too: label. The editor and runtime bridge is tighter now too: the shell-side economic tuning owner `0x004ca980/0x004cadf0` writes the visible slider values directly into `[world+0x0be2/+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]` and mirrors the first lane into - `[world+0x0bde]`; the `.smp` save/load pair persists that same six-dword band; the post-load - generation pipeline `0x004384d0` reseeds `[world+0x0bde]` from `[world+0x0be2]` before its early - setup passes; and `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0` + `[world+0x0bde]`; the write path is asymmetric too, because lane `0` uses its dedicated divisor + at `0x005c85d8` while the trailing five lanes share the centered `(value-0xce)/0x005c87f8` + path. The `.smp` save/load pair persists that same six-dword band; the post-load generation + pipeline `0x004384d0` reseeds `[world+0x0bde]` from `[world+0x0be2]` before its early setup + passes; and `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0` consumes `[world+0x0bde]` as one global multiplier on both its live-region and fallback projected-structure branches. The editor-side read path is explicit on the same seam: `map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows` `0x004caaf0` reads the @@ -604,12 +688,13 @@ The same brush strip is tighter now too: and the checked map/save pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> p.gms`, and `Spanish Mainline.gmp -> g.gms` preserve that rooted block byte-for-byte in the sampled local corpus. The current probe therefore treats it as preserved scenario payload rather - than save-only runtime drift and only reports per-book signatures: a coarse head kind over the - pre-line region, the raw `book+0x3ed` annual-production dword, and one raw summary for each of - the five fixed `0x30`-byte cargo lines beginning at `book+0x3f1`: coarse line kind, raw mode - dword, raw annual-amount dword, and the raw supplied/demanded cargo-token dwords at `+0x08` and - `+0x1c`. That is enough to separate zero, `0xcd`-filled, and mixed books or lines without - overstating line semantics beyond the grounded editor/runtime ownership already documented below. + than save-only runtime drift and reports the same structural shape the `.smp` owners use: one + `book+0x3ed` annual-production dword, one `0x3d`-byte book header, and five repeated + `0x30`-byte cargo-line tuples rooted at `book+0x3f1`, each with mode dword `+0x00`, + annual-amount dword `+0x04`, supplied-token dword window `+0x08`, and demanded-token dword + window `+0x1c`. That is enough to separate zero, `0xcd`-filled, and mixed books or lines + without overstating line semantics beyond the grounded editor/runtime ownership already + documented below. Local corpus clustering now makes the remaining split more specific. The base 1.05 save family (`Autosave.gms`, `nom.gms`) shares a narrow tail-heavy subset with stable relative offsets @@ -794,7 +879,7 @@ The same brush strip is tighter now too: classic staged-profile band already exposed. The strongest structural read is therefore that the entire `0x6a70..0x73c0` catalog region is shared verbatim between `Alternate USA.gmp` and the derived `Autosave.gms`, not rebuilt independently during save. Combined with the earlier - grounded record-layout work under `0x00437743`, `0x00434ea0`, and `0x00434f20`, the current + grounded record-layout work under `0x00437737`, `0x00434ea0`, and `0x00434f20`, the current safest semantic read is that this shared catalog is the bundled source form of the scenario-side named candidate-availability table later mirrored into `[state+0x66b2]`, with each entry's trailing dword now reading as the same availability override bit later copied into @@ -819,8 +904,9 @@ The same brush strip is tighter now too: seeds the fixed year defaults and chairman-slot rows, reseeds the same six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `0x004ca980/0x004caaf0/0x004cadf0`, rebuilds the two named-availability collections at - `[state+0x66b2]` and `[state+0x66b6]`, re-seeds the twelve recipe books from the fixed template - at `0x005c9f78`, refreshes selected-year state through `0x00409e80`, + `[state+0x66b2]` and `[state+0x66b6]`, zero-fills the twelve recipe books at `[state+0x0fe7]`, + then only re-seeds their per-book name lane from the fixed `# %1` format string at `0x005c9f78`, + refreshes selected-year state through `0x00409e80`, `0x00433bd0`, `0x00435603`, and the year-gap scalar helper `0x00434130`, and only then re-enters `0x00435630`, `0x0041e970`, `0x00412bd0`, and `0x00436af0`. The loader-side coverage around world entry is tighter now too. `0x00443a50` does not just “restore the late profile @@ -832,8 +918,12 @@ The same brush strip is tighter now too: restores `[profile+0x77]` into the selected-year lanes, reruns `0x00409e80`, `0x00433bd0`, `0x00435603`, `0x00444dc5`, `0x0041e970`, `0x00412bd0`, `0x00434130`, and `0x00436af0`, and only then rehydrates `[world+0x66b2]`, `[world+0x66b6]`, - and the later locomotive override refresh `0x00461e00`. The loader-side coverage is tighter now - too: + and the later locomotive override refresh `0x00461e00`. That named-availability restore split is + tighter now too: the candidate side keeps only rows whose copied names survive the built-in stem + rejects and still resolve into the live candidate pool, with no later fallback preseed if that + validated pass stays empty, while the locomotive side bulk-reinserts its fixed `0x41`-byte rows + raw and only then falls back to `0x004350b0` if the collection is still empty. The loader-side + coverage is tighter now too: the same table parser now attaches both to the common-save bridge payload and directly to the fixed source range in `.gmp` files and the non-common `rt3-105-scenario-save` / `rt3-105-alt-save` branches. That @@ -847,8 +937,22 @@ The same brush strip is tighter now too: available. The header lanes just ahead of the table vary coherently with those scenario branches too: `Alternate USA` carries `header_word_0 = 0x10000000`, `Southern Pacific` carries `0x00000000`, and `Spanish Mainline` carries `0xcdcdcdcd`, while the structural - fields from `header_word_2` onward remain stable (`0x332e`, `0x1`, `0x22`, `0x44`, `0x43`) - and the 9-byte footer still decodes as `0x32dc`, `0x3714`, `0x00` in all three checked maps. + fields from `header_word_2` onward remain stable in a fuller fixed-record strip: + `0x332e`, `0x1`, `0x22`, `0x2`, `0x2`, then the observed capacity/count pair (`0x44`, `0x43` + in the checked save-side probe), followed by `0x0`, `0x1`; the 9-byte footer still decodes as + `0x32dc`, `0x3714`, `0x00` in all three checked maps. The runtime-side support family is now + explicit enough to narrow that strip further without overclaiming ownership: the shared indexed + collection constructor `0x00518570` and growth helper `0x00517f90` really do seed the same + collection-shape header family at `[this+0x04/+0x08/+0x0c/+0x10/+0x14/+0x18]` before the live + payload slab, tombstone bitset, and auxiliary link bands are materialized at + `[this+0x30/+0x34/+0x3c..+0x44]`. So the file-side prefix now reads more like one source-side + fixed-record table header than a random magic run: the stable `0x1/0x22/0x2/0x2/0x44/0x43` + lanes align much better with one fixed-record flag plus one record-stride/growth/bound/count + family than with direct availability payload. The gap is narrower now too: the later named- + availability runtime save path does use the shared serializer `0x00517d90` on the non-`.smp` + package branch, but the `.smp` path still writes direct counted fixed-row runs instead. So the + file table still is not proven to be a byte-for-byte dump of one single runtime + indexed-collection body with tombstone and auxiliary-band tails across every save family. A wider corpus scan over the visible `.gmp`/`.gms` files makes those two anonymous header lanes less mysterious too: the parser currently sees only three stable `(header_word_0, header_word_1)` pairs across 79 files with this table shape, namely @@ -856,12 +960,21 @@ The same brush strip is tighter now too: `(0xcdcdcdcd, 0xcdcdcdcd)`. The zero-availability count varies widely underneath the first and third pairs (`0..56` under the zero pair, `14..67` under the `0xcdcdcdcd` pair), so those two lanes no longer look like counts or direct availability payload; the safest current read is - that they are coarse scenario-family or source-template markers above the stable - `0x332e/0x22/0x44/0x43` table header, with `0xcdcdcdcd` still plausibly acting as one reused - filler or sentinel lane rather than a meaningful numeric threshold. Current exported + that they are coarse scenario-family or source-template markers above the stable fixed-record + header strip `0x332e/0x1/0x22/0x2/0x2/(capacity)/(count)/0x0/0x1`, with `0xcdcdcdcd` still + plausibly acting as one reused filler or sentinel lane rather than a meaningful numeric + threshold. Current exported disassembly notes still do not ground one direct loader-side or editor-side consumer of `header_word_0` or `header_word_1` themselves, so that family-marker read remains an - inference from corpus structure rather than a named field assignment. + inference from corpus structure rather than a named field assignment. The save-side runtime + serializers now sharpen that boundary differently, though: the direct `.smp` path still emits + the named candidate and locomotive availability families as direct counted fixed-row runs, while + the non-`.smp` package-save prelude does call the shared indexed-collection serializer + `indexed_collection_serialize_header_and_live_entry_payload_band` `0x00517d90` on those same two + runtime collections before continuing into the later tagged-save families. So the anonymous + file-side `header_word_0/1` pair is no longer excluded by the package-save branch alone, but it + is still not directly explained by the `.smp` save family or by one grounded loader-side field + owner for those two words themselves. The new loader-side compare command makes the save-copy claim sharper too: for the checked pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> p.gms`, and `Spanish Mainline.gmp -> g.gms`, the parsed candidate-availability table contents now match @@ -886,8 +999,10 @@ The same brush strip is tighter now too: generic database opener; it is the early package-save prelude that seeds stage/progress globals `0x00620e94/0x0062bec8/0x0062becc/0x0062bed0`, opens one `0x30d40` bundle, and then serializes the first direct save band in fixed order: chunks `0x32c8/0x32c9`, the late world-status block - `[world+0x66be]`, the direct counted named-availability collections `[world+0x66b2]` and - `[world+0x66b6]`, chunk `0x32dc`, the staged `0x108` profile block under `0x3714/0x3715`, then + `[world+0x66be]`, the shared indexed-collection serializer `0x00517d90` over candidate named- + availability collection `[world+0x66b2]`, chunk `0x32dc`, the staged `0x108` profile block + under `0x3714/0x3715`, the same shared serializer over locomotive named-availability collection + `[world+0x66b6]` under `0x32dd`, then `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520` for the early world-grid/core-raster band under chunk families `0x2ee2..0x2f44`, then `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70` for the direct @@ -1005,15 +1120,19 @@ The same brush strip is tighter now too: `0x22`-byte candidate-name-plus-dword records, and inserts only the rows whose copied names survive both fixed built-in stem rejects `0x005c8f94/0x005c8e4c` and then resolve back into the live candidate pool `0x0062b268` through `0x00412b70`; the rejected rows are discarded instead of - blindly restoring stale candidate names. The same loader then clears and repopulates - `[world+0x66b6]` from one counted run of fixed `0x41`-byte locomotive-name-plus-dword records. - After those direct named-availability restores it preserves the older empty-collection fallback - for locomotives by re-entering + blindly restoring stale candidate names, and there is no later candidate-side fallback preseed + if that validated pass stays empty. The same loader then clears and repopulates `[world+0x66b6]` + from one counted run of fixed `0x41`-byte locomotive-name-plus-dword records without the + candidate-side reject-or-resolve filter. After that raw locomotive restore it preserves the older + empty-collection fallback by re-entering `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` `0x004350b0` only when `[world+0x66b6]` stayed empty. The startup and restore-side preseed callers are tighter now too: the common startup lane at `0x00438d6b` and the `.smp` restore fallback at `0x004478ea` both resolve one linked era name through `0x00461c80` and then upsert it with literal availability bit `1`, matching the later live-pool sweep inside `0x00461eab`. + The restore-side condition is explicit now too: `0x004478ea` only runs after the direct counted + `0x41`-byte restore left `[world+0x66b6]` empty, so this is a true empty-collection fallback + rather than a second unconditional load pass. The same `.smp` loader then brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` and delegates the per-event packed-state restore to `scenario_event_collection_refresh_runtime_records_from_packed_state` @@ -1088,7 +1207,7 @@ The same brush strip is tighter now too: neighboring named-candidate bridge is now aligned with that same save/load pattern too: the scenario-side named candidate-availability table at `[world+0x66b2]` is another counted fixed record run, the `.smp` restore path only keeps rows whose names still resolve into the live - candidate pool, and the later post-load preseed `0x00437743` plus + candidate pool, and the later post-load preseed `0x00437737` plus `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` mirror that filtered table back into `[candidate+0x7ac]` across the live candidate pool. The diff --git a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md index 489e7fc..639c87e 100644 --- a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md +++ b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md @@ -26,7 +26,7 @@ helper inside the larger post-load generation pipeline `world_run_post_load_generation_pipeline` at `0x004384d0` under the `Seeding Economy...` phase rather than under the ordinary player-facing speed buttons. That setup pipeline is now clearer at the progress-banner level too: on the fuller - setup path it first runs one preliminary named-candidate availability prepass through `0x00437743` + setup path it first runs one preliminary named-candidate availability prepass through `0x00437737` before any visible progress banner is posted. One startup-side selector edge is tighter now too: `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` reaches an early selector-`2` branch at `0x00438a66..0x00438c00` that refreshes one support-family type-`7` @@ -40,9 +40,10 @@ `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_collection_refresh_neighbor_and_profile_bands` `0x00420f30`. One save-load-side - status-stack strip is now tighter too: `0x004422d0/0x00442330` push and pop the same four shell - dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` - through the local stack `0x0062be90` with depth `0x0062bedc`, and the paired wrappers + status-stack strip is now tighter too: `0x004422d0/0x00442330` push and pop the low bytes of the + same four shell lanes `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte + `[0x006cec78+0x4c74]` through the local stack `0x0062be90` with depth `0x0062bedc`, and the + paired wrappers `0x004423a0/0x004423d0` bracket that same band while also servicing the live TrackLay.win and StationPlace.win tool objects through `0x0050e070`, `0x00507a50`, `0x0050a530`, and `0x0050e1e0`. The live `.smp` serializer uses the higher pair, while `world_entry_transition_and_runtime_bringup` @@ -1186,13 +1187,13 @@ it then posts id `321` `Seeding Economy...` for `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the code post id `319` `Setting up Players and Companies...`. That `319` lane is no longer just a shell-state placeholder: its - earlier hidden prepass is tighter now too: `0x00437743` is the scenario-side named + earlier hidden prepass is tighter now too: `0x00437737` is the scenario-side named candidate-availability seeding pass over the live candidate pool `0x0062b268`, feeding the override collection at `[state+0x66b2]` through `0x00434f20` before any visible banner is posted. That grounded write path is narrower than the static file evidence, though: the startup reset helper `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0` explicitly clears `[state+0x66b2]` before the dispatch path begins, and the current exported write-side callers - we can name after that reset are still just the live-pool preseed `0x00437743`, the sibling + we can name after that reset are still just the live-pool preseed `0x00437737`, the sibling startup lane `0x00436ad7`, and the editor-side `Industry (Overall)` toggle handler `0x004cf430` through `0x00434f20`. So while the fixed `0x6a70..0x73c0` candidate-availability block is now well grounded as bundled map/save source data, a direct bulk-import path from that @@ -1479,8 +1480,10 @@ The editor-side help text cluster around ids `2433..2437` is no longer floating either: current grounded map-editor code now has a live economic tuning family beside the chairman-slot panel. `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` binds six slider controls through - `map_editor_economic_cost_slider_dispatch` `0x004ca980` into the scenario-state float block - `[0x006cec78+0x0be2..0x0bf6]`, while the surrounding descriptor table at `0x00611c70..0x00612220` + `map_editor_economic_cost_slider_dispatch` `0x004ca980`, which now grounds as the real writer for + the scenario-state float block `[0x006cec78+0x0be2..0x0bf6]`: lane `0` uses one dedicated scale + divisor, the trailing five lanes share the centered `(value-0xce)` path, and the helper mirrors + lane `0` into `[state+0x0bde]`. The surrounding descriptor table at `0x00611c70..0x00612220` pairs that wider editor lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost` plus the comparison or help texts `2433..2437`. The broader shell-state master flag at `[0x006cec74+0x68]` still sits above the remaining post-load @@ -2007,9 +2010,10 @@ Current evidence grounds the shell-controller-backed input and frame path as the `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240` does the same thing through `0x446271` and `0x446d09` around its bundle-write and fixed status-publish span. The exact save/load-side status stack under those spans is tighter now too: `0x004422d0/0x00442330` push - and pop shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte - `[0x006cec78+0x4c74]` through `0x0062be90`, while `0x004423a0/0x004423d0` layer the same band - under active TrackLay.win and StationPlace.win service. The per-frame tail is + and pop the low bytes of shell lanes `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte + `[0x006cec78+0x4c74]` through `0x0062be90`, with the restore side sign-extending the first three + shell bytes and zero-extending the fourth before rewriting the wider dwords; `0x004423a0/0x004423d0` + layer the same band under active TrackLay.win and StationPlace.win service. The per-frame tail is tighter now too: `0x0054f5b0` queues one 12-dword shell-input event record into the rotating ring at `[input+0x128]`; `0x0054f6a0` and `0x0054f6b0` are the two neighboring fixed-value seeders for shared phase scalar `0x00d93850` used by shell-side branches `0x00538b72`,