diff --git a/artifacts/exports/rt3-1.06/function-map.csv b/artifacts/exports/rt3-1.06/function-map.csv
index 5f15f46..60e496e 100644
--- a/artifacts/exports/rt3-1.06/function-map.csv
+++ b/artifacts/exports/rt3-1.06/function-map.csv
@@ -331,9 +331,20 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00592d70,77,multiplayer_transport_enqueue_callback_slot12_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
 0x00592dc0,72,multiplayer_transport_enqueue_callback_slot13_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
 0x00592e10,72,multiplayer_transport_enqueue_callback_slot14_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
-0x00593120,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
+0x00592ee0,62,multiplayer_transport_enqueue_callback_slot17_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `17` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the current-selector profile-key callback root at `0x59f8b0`, which submits one profile-key bundle and then forwards the same selector context through this owner-callback lane.","objdump + caller xrefs"
+0x00592f20,69,multiplayer_transport_enqueue_callback_slot18_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `18` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
+0x00592f70,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f850`, which resets selector-side state and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
+0x00592fc0,50,multiplayer_transport_enqueue_callback_slot20_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `20` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17bc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
+0x00593000,69,multiplayer_transport_enqueue_callback_slot21_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `21` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
+0x00593050,77,multiplayer_transport_enqueue_callback_slot22_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` marker pair or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple.","objdump + caller xrefs"
+0x005930a0,50,multiplayer_transport_enqueue_callback_slot23_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `23` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x178c]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the callback root at `0x59f5c0`, which first arms deferred-close state at `[this+0x1edc]`.","objdump + caller xrefs"
+0x005930e0,62,multiplayer_transport_enqueue_callback_slot24_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `24` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17cc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is multiplayer_transport_commit_selector_view_refresh_probe_success, which forwards the selector-view entry pointer together with the current averaged probe sample through this owner-callback lane.","objdump + caller xrefs"
+0x00593120,72,multiplayer_transport_enqueue_callback_slot25_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `25` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
 0x00592e60,64,multiplayer_transport_enqueue_callback_slot15_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
 0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `16` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17ac] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
+0x0059f2e0,64,multiplayer_transport_is_selector_control_line,shell,cdecl,inferred,objdump,2,"Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes.","objdump + caller xrefs + strings"
+0x0059f320,131,multiplayer_transport_split_selector_payload_token_and_tail,shell,cdecl,inferred,objdump,2,"Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`.","objdump + caller xrefs + strings"
+0x0059f5e0,111,multiplayer_transport_sync_selector_view_nfo_r_flag,shell,cdecl,inferred,objdump,3,"Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot.","objdump + caller xrefs + strings"
 0x00593460,87,multiplayer_transport_mark_selector_slot_records_stale,shell,cdecl,inferred,ghidra-headless,3,Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.,ghidra + rizin + llvm-objdump
 0x00593790,351,multiplayer_transport_handle_names_query_response,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump + strings
 0x005938f0,145,multiplayer_transport_handle_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_bound_route_request. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can publish [req+0x24] through multiplayer_transport_publish_mode_key_status_line and then schedules multiplayer_transport_handle_names_query_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump
@@ -342,6 +353,24 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x005949a0,80,multiplayer_transport_ensure_selector_view_store,shell,thiscall,inferred,objdump,3,"Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`.","objdump + caller xrefs"
 0x005949f0,56,multiplayer_transport_release_selector_view_store,shell,thiscall,inferred,objdump,3,"Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`.","objdump + caller xrefs"
 0x00594a40,80,multiplayer_transport_find_selector_view_entry_by_name,shell,cdecl,inferred,objdump,3,"Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers.","objdump + caller xrefs"
+0x00594d50,28,multiplayer_transport_selector_view_entry_slot_has_presence_mask,shell,cdecl,inferred,objdump,3,"Small selector-view predicate over one slot-local flag dword. When the requested slot has a live pointer at `[entry+0x40+slot*4]`, it returns whether the paired slot flag word at `[entry+0x5c+slot*4]` carries either presence bit `0x20` or `0x40`. Current grounded caller is multiplayer_transport_filter_insert_refreshable_selector_view_entry, which uses slot `2` to bias entry ordering and dedupe inside the periodic refreshable-entry collector.","objdump + caller xrefs"
+0x00594d70,21,multiplayer_transport_selector_view_entry_has_gml_disconnect_gate,shell,cdecl,inferred,objdump,3,"Tiny selector-view predicate used only in the current grounded `GML` control path. It returns nonzero only when the selector-view entry participates in the third selector slot through `[entry+0x48]` and bit `0x20` is set in the entry flag word at `[entry+0x64]`. The current grounded caller is multiplayer_transport_handle_gml_or_png_selector_control, where it gates the `GML Disconnected` branch before the transport forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`.","objdump + caller xrefs + strings"
+0x0059f5c0,20,multiplayer_transport_callback_arm_deferred_close_and_enqueue_slot23,shell,cdecl,inferred,objdump,2,"Small callback-root helper installed through the transport-side callback descriptor table at `0x59f5c0`. It takes the owner transport pointer from the first stack argument, sets deferred-close latch `[this+0x1edc]` to one, and then forwards into multiplayer_transport_enqueue_callback_slot23.","objdump + caller xrefs"
+0x00594150,65,multiplayer_transport_schedule_selector_view_entry_refresh_probe,shell,cdecl,inferred,objdump,3,"Arms one deferred refresh probe for a selector-view entry when no probe is already pending at `[entry+0x74]`. It schedules callback `0x594110` after `0x1388` ms, latches the pending flag at `[entry+0x74]`, stores the current tick count at `[entry+0x68]`, and clears the entry-local transient field at `[entry+0xa8]`. The current grounded caller is the periodic selector-view service path at `0x594540`.","objdump + caller xrefs"
+0x005941a0,376,multiplayer_transport_filter_insert_refreshable_selector_view_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by the periodic selector-view service path. It filters one selector-view entry before insertion into a temporary refresh list: the entry must have local backing at `[entry+0xa0]`, live state at `[entry+0x58]`, no pending probe at `[entry+0x74]`, and no blocker at `[entry+0x4c]`; if slot pointers `[entry+0x40]`, `[entry+0x44]`, or `[entry+0x48]` are present, the corresponding slot flag words `[entry+0x5c]`, `[entry+0x60]`, and `[entry+0x64]` must not carry mask `0x0c`, which matches the `g`/`a` bits produced by multiplayer_transport_parse_selector_mode_letters. Eligible entries then pass slot-aware retry timing based on `[entry+0x68]`, `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the helper inserts the entry into the caller list while biasing third-slot entries through multiplayer_transport_selector_view_entry_slot_has_presence_mask and name comparisons.","objdump + caller xrefs + existing slot-flag map"
+0x00594320,115,multiplayer_transport_collect_refreshable_selector_view_entries,shell,cdecl,inferred,objdump,3,"Collects a bounded list of refreshable selector-view entries from the keyed selector-view store rooted at `[this+0xab4]`. It clears the caller count to at most `0x0c` entries, walks the store through callback `0x5941a0`, and returns the finished temporary entry pointer list. The current grounded caller is the periodic selector-view service path at `0x594540`, which then schedules deferred refresh probes for the collected entries.","objdump + caller xrefs"
+0x005940d0,61,multiplayer_transport_finish_selector_view_refresh_probe_if_matching,shell,cdecl,inferred,objdump,3,"Probe-completion callback used by the deferred selector-view refresh path. When the entry still has a pending probe at `[entry+0x74]`, live selector-view state at `[entry+0x58]`, and the callback request id matches `[entry+0x50]`, it clears the pending latch. Result `-1` increments the consecutive-failure counter at `[entry+0x7c]`; any other result forwards the returned payload pointer into multiplayer_transport_commit_selector_view_refresh_probe_success.","objdump + caller xrefs"
+0x00594110,48,multiplayer_transport_dispatch_selector_view_refresh_probe_result,shell,cdecl,inferred,objdump,3,"Deferred callback shim for selector-view refresh probes. It walks the keyed selector-view store at `[transport+0xab4]` and runs multiplayer_transport_finish_selector_view_refresh_probe_if_matching against each entry using the completed request descriptor on the stack. Current grounded caller is multiplayer_transport_schedule_selector_view_entry_refresh_probe.","objdump + caller xrefs"
+0x00593f00,171,multiplayer_transport_commit_selector_view_refresh_probe_success,shell,cdecl,inferred,objdump,3,"Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned sample value into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current average into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes the averaged sample through multiplayer_transport_enqueue_callback_slot24_record.","objdump + caller xrefs"
+0x00594b60,104,multiplayer_transport_arm_selector_view_probe_tracking,shell,cdecl,inferred,objdump,3,"Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed marker request id at `[entry+0x50]`, stores the parsed companion value at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`.","objdump + caller xrefs"
+0x005943a0,231,multiplayer_transport_stage_selector_view_progress_snapshot,shell,cdecl,inferred,objdump,3,"Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, formats one `PNG %s %d` line around the selector-view sample string rooted at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`.","objdump + caller xrefs + strings"
+0x00594490,83,multiplayer_transport_pick_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by multiplayer_transport_select_stale_selector_view_progress_entry. It only considers selector-view entries whose slow progress gate `[entry+0xa4]` is set, blocker `[entry+0x4c]` is clear, total-success count `[entry+0x98]` is nonzero, and in-flight progress latch `[entry+0x9c]` is clear; among those, it requires at least `0x1388` ms since the last progress tick `[entry+0x70]` and keeps the stalest candidate in the caller scratch slot.","objdump + caller xrefs"
+0x005944f0,69,multiplayer_transport_select_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Walks the keyed selector-view store at `[transport+0xab4]` through callback `0x594490` and returns the stalest eligible selector-view entry for the slow progress-snapshot lane, or null when none qualify. Current grounded caller is multiplayer_transport_service_selector_view_refresh_cycle.","objdump + caller xrefs"
+0x00594540,214,multiplayer_transport_service_selector_view_refresh_cycle,shell,thiscall,inferred,objdump,3,"Recurring selector-view maintenance pass beneath the multiplayer transport frame owner. When the selector-view layer is enabled and not blocked by the `g`/`a` route gates at `[this+0xb44]` and `[this+0x180c]`, it first rate-limits and runs the fast probe lane by collecting refreshable entries through multiplayer_transport_collect_refreshable_selector_view_entries and scheduling deferred probes through multiplayer_transport_schedule_selector_view_entry_refresh_probe. It then runs a slower sidecar lane every `0x7d0` ms by selecting one stale progress entry through multiplayer_transport_select_stale_selector_view_progress_entry and staging a progress snapshot through multiplayer_transport_stage_selector_view_progress_snapshot before falling into the shared timer service at `0x5a05d0`.","objdump + caller xrefs"
+0x0059f3c0,498,multiplayer_transport_handle_gml_or_png_selector_control,shell,cdecl,inferred,objdump,3,"Small control-token handler reached from the slot-`25` selector-view callback lane after multiplayer_transport_split_selector_payload_token_and_tail. When the token is `GML` and the tail is `Disconnected`, it requires the current selector-view entry to pass multiplayer_transport_selector_view_entry_has_gml_disconnect_gate, then forces one status-pump pass, emits callback slot `16` with the tail text, and re-enters route mode `5`. Its sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry overlaps the active selector-slot ownership, refreshes selector-view runtime state through `0x5948f0` and republishes callback slot `25`.","objdump + caller xrefs + strings"
+0x0059f650,193,multiplayer_transport_callback_dispatch_selector_name_payload_lane,shell,cdecl,inferred,objdump,3,"Main selector-name branch in the second transport-side callback descriptor lane. It first classifies the incoming payload through multiplayer_transport_is_selector_control_line. `@@@NFO` control lines resolve one selector-view entry through multiplayer_transport_find_selector_view_entry_by_name and forward into multiplayer_transport_sync_selector_view_nfo_r_flag; non-control mode-`3/4` payloads split through multiplayer_transport_split_selector_payload_token_and_tail and publish callback slot `14`; and the remaining non-control payloads publish callback slot `13`.","objdump + caller xrefs + strings"
+0x0059f720,289,multiplayer_transport_callback_dispatch_current_selector_payload_lane,shell,cdecl,inferred,objdump,3,"Sibling callback root that first resolves the current selector through `0x5951a0` and then dispatches one payload against that active selector context. It reuses multiplayer_transport_is_selector_control_line, the `@@@GML` and `@@@NFO` control tokens, and the shared token-tail splitter at `0x59f320`: `@@@NFO` lines flow into multiplayer_transport_sync_selector_view_nfo_r_flag, `@@@GML` lines plus mode-`3/4` payloads feed callback slot `10`, and the remaining non-control payloads feed callback slot `9`.","objdump + caller xrefs + strings"
+0x0059f850,87,multiplayer_transport_callback_reset_selector_and_enqueue_slot19,shell,cdecl,inferred,objdump,2,"Callback-root helper from the second transport-side descriptor lane. It resolves the current selector slot through `0x5951a0`, resets that selector text path through `0x5954b0`, forwards the supplied selector-name pair through multiplayer_transport_enqueue_callback_slot19, and when the resolved selector is `2` plus route mode is still active it re-enters multiplayer_transport_set_route_mode with mode `1`.","objdump + caller xrefs"
 0x00594bd0,97,multiplayer_transport_set_selector_slot_flags,shell,cdecl,inferred,ghidra-headless,3,Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags.,ghidra + rizin + llvm-objdump
 0x00594c40,103,multiplayer_transport_parse_selector_mode_letters,shell,cdecl,inferred,ghidra-headless,3,Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c].,ghidra + rizin + llvm-objdump + strings
 0x00594cb0,65,multiplayer_transport_merge_selector_mode_mask,shell,cdecl,inferred,ghidra-headless,3,Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump + strings
@@ -360,6 +389,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x005959e0,81,multiplayer_transport_submit_route_status_request,shell,cdecl,inferred,ghidra-headless,3,Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately.,ghidra + rizin + llvm-objdump
 0x00596270,70,multiplayer_transport_clone_staged_callback_payload,shell,cdecl,inferred,ghidra-headless,3,Clones one staged route-callback payload block by allocating a same-sized object through 0x58d5b0 copying the first nine dwords and then registering a cleanup callback through 0x58fa00 with shim 0x596260. Current grounded caller is multiplayer_transport_try_stage_route_callback_payload.,ghidra + rizin + llvm-objdump
 0x00597720,96,multiplayer_transport_format_gsp_payload,shell,cdecl,inferred,ghidra-headless,3,Formats one transport text payload with the `#GSP!%s!%c%s%c` template at 0x005e2358. Depending on whether the global formatter state at 0x00dba4c4 is present it builds either a 0x58-byte or 0x4d-byte intermediate fragment through 0x597590 or 0x5976c0 and then emits the final string through 0x5a19c4. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload.,ghidra + rizin + llvm-objdump + strings
+0x005977b0,127,multiplayer_transport_parse_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward the parsed request id and companion value into multiplayer_transport_arm_selector_view_probe_tracking.","objdump + caller xrefs + format string"
+0x00597840,30,multiplayer_transport_format_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Formats one selector-view probe marker in the local `X%sX|%d` family. It encodes the caller request id through `0x597590`, then wraps the result with sentinel `X` bytes and a trailing `|%d` suffix into the destination buffer. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines.","objdump + caller xrefs + format string"
 0x00593980,382,multiplayer_transport_submit_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_gsp_payload allocates a type `1` transient request record through 0x5934e0 stores route and callback metadata on that record publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].,ghidra + rizin + llvm-objdump + strings
 0x00593b00,161,multiplayer_transport_handle_selector_update_response,shell,cdecl,inferred,ghidra-headless,3,Follow-up callback used by multiplayer_transport_handle_selector_text_route_request. When the callback succeeds it initializes or repopulates selector slot [req+0x1c] through multiplayer_transport_init_selector_slot and multiplayer_transport_upsert_selector_name_entry. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through multiplayer_transport_probe_or_enqueue_route_record and unlinking the request through 0x5933a0.,ghidra + rizin + llvm-objdump
 0x00593bb0,144,multiplayer_transport_handle_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump
@@ -380,9 +411,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x005962e0,583,multiplayer_transport_register_field_subscription_bundle,shell,cdecl,inferred,ghidra-headless,3,Builds one field-subscription bundle from the field-id list optional suffix text and selector-name table. Rebuilds the callback table at [this+0xba4] seeds the local field cache at [this+0x1724] installs the subscription block through 0x590ed0 sets [this+0x1774] on success and enqueues an immediate mode-3 field snapshot through multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump
 0x00596530,101,multiplayer_transport_try_seed_am_rating_route_table,shell,cdecl,inferred,ghidra-headless,2,Used by the larger route-mode setter around 0x595650. It first calls multiplayer_transport_reset_am_rating_route_state then rebuilds one mode `4` route entry in the callback table at [this+0x18bc] from the stored descriptor at [this+0x1ed0]. Success clears [this+0x1ed4] sets [this+0x1ec4] to one and failure reverts through multiplayer_transport_reset_am_rating_route_state before setting [this+0x1ed4].,ghidra + rizin + llvm-objdump + strings
 0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,ghidra-headless,3,Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump
+0x00596970,404,multiplayer_transport_handle_profile_key_query_result,shell,cdecl,inferred,objdump,3,"Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed marker pair or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert.","objdump + strings + caller context"
 0x00596da0,497,multiplayer_transport_submit_profile_key_query_bundle,shell,cdecl,inferred,rizin,2,Wrapper above the transport key-command builders that stages a small named-key query bundle around the strings `username` and `b_flags`. It allocates temporary key-name arrays and callback-entry tables submits the first request through multiplayer_transport_submit_getkey_command_and_wait folds returned key results into transport-owned callback state through 0x0058f8f0 and 0x0058fa00 and then follows with the larger channel-key submission path through multiplayer_transport_submit_setchankey_pair_list_command_and_wait when the staged key set is nonempty.,rizin + llvm-objdump + strings
 0x00596fa0,19,multiplayer_transport_submit_profile_key_query_bundle_with_context,shell,cdecl,inferred,rizin,2,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0.,rizin + llvm-objdump
 0x00596fc0,14,multiplayer_transport_submit_profile_key_query_bundle_default,shell,cdecl,inferred,rizin,3,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60.,rizin + llvm-objdump
+0x0059f8b0,260,multiplayer_transport_callback_upsert_current_selector_and_request_profile_keys,shell,cdecl,inferred,objdump,3,"Callback-root helper adjacent to the second transport-side descriptor lane. It resolves the current selector through multiplayer_transport_find_selector_name, upserts that selector name into the selector-view store through multiplayer_transport_upsert_selector_name_entry, optionally reuses a cached `username` marker from `0x58eb10` to arm selector-view probe tracking through multiplayer_transport_parse_selector_view_probe_marker and multiplayer_transport_arm_selector_view_probe_tracking, then submits one profile-key query bundle through multiplayer_transport_submit_profile_key_query_bundle_with_context and publishes callback slot `17`. When selector `2` is active, the same helper can also force the route-mode transitions `2 -> 3 -> 4` through multiplayer_transport_set_route_mode after checking the status-route latch at `[this+0xb54]`, route activity, and the generation gate `[this+0xac0] >= [this+0xb48]`.","objdump + caller xrefs + strings"
 0x00596fd0,441,multiplayer_transport_dispatch_status_route_event,shell,cdecl,inferred,rizin,3,Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8].,rizin + llvm-objdump + strings
 0x005972c0,97,multiplayer_transport_handle_validated_route_cookie_event,shell,cdecl,inferred,objdump,3,"Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`.","objdump"
 0x00597330,28,multiplayer_transport_forward_validated_extended_route_payload,shell,cdecl,inferred,objdump,3,"Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback.","objdump"
diff --git a/docs/control-loop-atlas.md b/docs/control-loop-atlas.md
index 1dd60a2..6b55897 100644
--- a/docs/control-loop-atlas.md
+++ b/docs/control-loop-atlas.md
@@ -59,8 +59,8 @@ anchor it, and where control is handed to neighboring subsystems.
 - Roots: `multiplayer_window_init_globals` at `0x004efe80`, `multiplayer_window_service_loop` at `0x004f03f0`, the Multiplayer.win session-event callback table built by `multiplayer_register_session_event_callbacks` at `0x0046a900`, the active session-event transport object at `0x006cd970`, the Multiplayer preview dataset object at `0x006cd8d8`, and the lower pending-template and text-stream helpers around `0x00597880..0x0059caf0`.
 - Trigger/Cadence: shell-owned Multiplayer.win frame service plus event-driven session callbacks and repeated transport pump steps.
 - Key Dispatchers: session-event wrappers for actions `1`, `2`, `4`, `7`, `8`; `multiplayer_register_session_event_callbacks`; `multiplayer_dispatch_requested_action`; `multiplayer_reset_preview_dataset_and_request_action`; `multiplayer_preview_dataset_service_frame`; `multiplayer_load_selected_map_preview_surface`; `multiplayer_flush_session_event_transport`; `multiplayer_transport_service_frame`; `multiplayer_transport_service_worker_once`; `multiplayer_transport_service_route_callback_tables`; `multiplayer_transport_service_status_and_live_routes`; `multiplayer_transport_text_stream_service_io`; `multiplayer_transport_dispatch_pending_template_node`; `multiplayer_transport_service_pending_template_dispatch_store`.
-- State Anchors: live session globals at `0x006d40d0`, active session-event transport object at `0x006cd970`, status latch at `0x006cd974`, session-event mode latch at `0x006cd978`, retry counter at `0x006cd984`, preview dataset object at `0x006cd8d8`, preview-valid flag at `0x006ce9bc`, staged preview strings at `0x006ce670` and `[0x006cd8d8+0x8f48]`, Multiplayer.win backing block at `0x006d1270`, selector-view store root at `[transport+0xab4]`, selector-view generation counters at `[transport+0xab8]..[transport+0xac0]`, selector-view backing arrays around `[transport+0xad0]..[transport+0xae4]`, pending-template list at `[transport+0x550]`, dispatch store at `[worker+0x54c]`, and text-stream buffers rooted under `[worker+0x1c]`.
-- Subsystem Handoffs: the Multiplayer.win initializer seeds the backing block at `0x006d1270`, later reset paths construct the separate preview dataset at `0x006cd8d8`, and the shell-owned active-mode frame services that dataset every frame through `multiplayer_preview_dataset_service_frame`. That preview side publishes roster and status controls through the Multiplayer window control paths, loads `.gmt` preview surfaces through `multiplayer_load_selected_map_preview_surface`, and is even reused by the map/save coordinator’s mode-`11` `.gmt` path when the dataset already exists. In parallel, `multiplayer_register_session_event_callbacks` allocates and registers the separate session-event transport object at `0x006cd970`. The shell-side bridge into that deeper transport cadence is now tighter: `multiplayer_window_service_loop` and neighboring reset or initializer branches call `multiplayer_flush_session_event_transport`, which forces one status flush and then drops into `multiplayer_transport_flush_and_maybe_shutdown`. That wrapper in turn runs `multiplayer_transport_service_frame`, the recurring pump that services one worker step through `multiplayer_transport_service_worker_once`, sweeps the transport-owned callback tables and field caches through `multiplayer_transport_service_route_callback_tables`, services both the auxiliary status route and the current live route through `multiplayer_transport_service_status_and_live_routes`, and then descends one layer farther into the shared GameSpy route helper `multiplayer_gamespy_route_service_frame` at `0x58d040`. The transport also owns a separate selector-view sidecar beneath that route cadence. `multiplayer_transport_ensure_selector_view_store` allocates the keyed selector-view store at `[transport+0xab4]`, `multiplayer_transport_find_selector_view_entry_by_name` resolves entries from that store, `multiplayer_transport_upsert_selector_name_entry` marks per-slot activity and flags inside each entry, and `multiplayer_transport_mark_selector_slot_views_dirty` plus `multiplayer_transport_reset_selector_view_entry_runtime_state` manage the dirty or refresh fields at `+0xa0`, `+0xa4`, and `+0xa8`. That means the multiplayer transport no longer looks like only text-stream plus route plumbing; it also owns a distinct cached selector-view layer that feeds later selector and status presentation helpers without being part of the lower GameSpy route object itself. One callback-table branch is now grounded crossing that boundary: the descriptor lane rooted at `0x59f650` has a branch at `0x59f560` that checks selector-view entry state, updates the selector-view runtime state through `0x5948f0`, and then forwards the same selector-name pair through `multiplayer_transport_enqueue_callback_slot19_record` `0x00593120`. The low-level route helper still looks like a two-part cycle: `multiplayer_gamespy_route_service_retry_and_keepalive_timers` handles challenge or retry pressure and periodic outbound control traffic around the `master.gamespy.com`, `PING`, `natneg`, `localport`, `localip%d`, and `statechanged` strings, while `multiplayer_gamespy_route_drain_inbound_packets` drains inbound datagrams and dispatches semicolon lines, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The transport-owned callback story is now narrower too. The shared route constructor `multiplayer_gamespy_route_construct_and_seed_callback_vector` seeds `[route+0x88]` through `[route+0x9c]` from the caller-supplied transport callback table, records the owner transport at `[route+0x104]`, and explicitly zeroes `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. For the transport-owned status route, `multiplayer_transport_try_connect_status_route` then patches `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` to point at `multiplayer_transport_forward_validated_extended_route_payload` `0x00597330`, which simply forwards the validated payload wrapper into the owner callback at `[transport+0x17f4]` with context `[transport+0x17f8]`. The grounded live-route connect path at `multiplayer_transport_try_connect_live_route` does not currently perform any matching post-construction patch for `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]`, and the higher route-mode state machine now looks consistent with that: current grounded mode transitions switch by releasing route objects through `multiplayer_gamespy_route_release_and_free` and rebuilding them through `multiplayer_transport_try_connect_live_route`, not by mutating callback slots in place. The parser behavior is now tighter as well: semicolon lines only dispatch when `[route+0xd4]` is non-null, and the subtype-`6` raw fallback only dispatches when `[route+0xa4]` is non-null. For the currently grounded transport-owned status and live routes, those two branches therefore remain optional and can cleanly no-op instead of implying a hidden mandatory callback path. Inside the packet parser, subtype `4` is no longer an unknown callback hop: after cookie validation it dispatches through `[route+0x9c]`, which the transport-owned status and live routes seed to `multiplayer_transport_handle_validated_route_cookie_event` `0x005972c0`. That helper either marks route progress and re-enters `multiplayer_transport_set_route_mode`, or forwards the event id plus payload into the owner callback at `[transport+0x17f0]` with context `[transport+0x17f8]`. Subtype `6` still validates the same cookie, dedupes one 32-bit cookie or packet id, and then dispatches the trailing payload through the natneg-or-raw callback layer rooted at `[route+0xa0]` and `[route+0xa4]`. This separates the shell-frame preview refresh at `0x006cd8d8` from the actual transport cadence at `0x006cd970`, and also separates that transport cadence from the lower GameSpy route-service and packet-parser layer beneath it.
+- State Anchors: live session globals at `0x006d40d0`, active session-event transport object at `0x006cd970`, status latch at `0x006cd974`, session-event mode latch at `0x006cd978`, retry counter at `0x006cd984`, preview dataset object at `0x006cd8d8`, preview-valid flag at `0x006ce9bc`, staged preview strings at `0x006ce670` and `[0x006cd8d8+0x8f48]`, Multiplayer.win backing block at `0x006d1270`, selector-view store root at `[transport+0xab4]`, selector-view generation counters at `[transport+0xab8]..[transport+0xac0]`, selector-view backing arrays around `[transport+0xad0]..[transport+0xae4]`, selector-view entry probe-request id at `[entry+0x50]`, live-state gate at `[entry+0x58]`, third-slot flag word at `[entry+0x64]`, probe-schedule tick at `[entry+0x68]`, last-success tick at `[entry+0x6c]`, pending-probe latch at `[entry+0x74]`, success generation at `[entry+0x78]`, consecutive-failure counter at `[entry+0x7c]`, rolling average at `[entry+0x80]`, recent sample window at `[entry+0x84..]`, bounded sample-count at `[entry+0x94]`, total-success count at `[entry+0x98]`, pending-template list at `[transport+0x550]`, dispatch store at `[worker+0x54c]`, and text-stream buffers rooted under `[worker+0x1c]`.
+- Subsystem Handoffs: the Multiplayer.win initializer seeds the backing block at `0x006d1270`, later reset paths construct the separate preview dataset at `0x006cd8d8`, and the shell-owned active-mode frame services that dataset every frame through `multiplayer_preview_dataset_service_frame`. That preview side publishes roster and status controls through the Multiplayer window control paths, loads `.gmt` preview surfaces through `multiplayer_load_selected_map_preview_surface`, and is even reused by the map/save coordinator’s mode-`11` `.gmt` path when the dataset already exists. In parallel, `multiplayer_register_session_event_callbacks` allocates and registers the separate session-event transport object at `0x006cd970`. The shell-side bridge into that deeper transport cadence is now tighter: `multiplayer_window_service_loop` and neighboring reset or initializer branches call `multiplayer_flush_session_event_transport`, which forces one status flush and then drops into `multiplayer_transport_flush_and_maybe_shutdown`. That wrapper in turn runs `multiplayer_transport_service_frame`, the recurring pump that services one worker step through `multiplayer_transport_service_worker_once`, sweeps the transport-owned callback tables and field caches through `multiplayer_transport_service_route_callback_tables`, services both the auxiliary status route and the current live route through `multiplayer_transport_service_status_and_live_routes`, and then descends one layer farther into the shared GameSpy route helper `multiplayer_gamespy_route_service_frame` at `0x58d040`. The transport also owns a separate selector-view sidecar beneath that route cadence. `multiplayer_transport_ensure_selector_view_store` allocates the keyed selector-view store at `[transport+0xab4]`, `multiplayer_transport_find_selector_view_entry_by_name` resolves entries from that store, `multiplayer_transport_upsert_selector_name_entry` marks per-slot activity and flags inside each entry, and `multiplayer_transport_mark_selector_slot_views_dirty` plus `multiplayer_transport_reset_selector_view_entry_runtime_state` manage the dirty or refresh fields at `+0xa0`, `+0xa4`, and `+0xa8`. That selector-view maintenance path is now split more cleanly too. The recurring owner is `multiplayer_transport_service_selector_view_refresh_cycle`, which first runs the fast deferred-probe lane: `multiplayer_transport_collect_refreshable_selector_view_entries` walks the store through `multiplayer_transport_filter_insert_refreshable_selector_view_entry`, which now shows that `[entry+0x64]` is not a generic flag bucket but the third selector-slot flag word, parallel to `[entry+0x5c]` and `[entry+0x60]`. In that collector, the `g` and `a` mode-letter bits produced by `multiplayer_transport_parse_selector_mode_letters` become mask `0x0c` in the slot-local flag words, and any third-slot entry carrying those bits at `[entry+0x64]` is excluded from the refreshable set. Eligible entries then pass slot-aware retry timing on `[entry+0x68]`, `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the service loop schedules refresh probes through `multiplayer_transport_schedule_selector_view_entry_refresh_probe`. That fast lane is narrower now too: the entry-side match key `[entry+0x50]` is no longer just an opaque request field. The profile-key callback lanes feed `multiplayer_transport_parse_selector_view_probe_marker`, which decodes one local `X%sX|%d` marker into a request id plus companion value, and `multiplayer_transport_arm_selector_view_probe_tracking` stores those into `[entry+0x50]` and `[entry+0x54]` before arming the live probe gate at `[entry+0x58]`. The current-selector callback root at `0x59f8b0` is now bounded as well: it resolves and upserts the active selector name, optionally reuses a cached `username` marker to arm probe tracking immediately, then submits the same profile-key bundle with selector context and forwards that selector through callback slot `17`, with the status-route side able to force route-mode transitions `2 -> 3 -> 4` afterward. One layer lower, `multiplayer_transport_handle_profile_key_query_result` at `0x596970` now bounds the per-key result path itself. It treats `username` as the probe-marker field, `b_flags` as the selector mode-letter field, and `(END)` as a real sentinel that publishes a zeroed slot-`22` payload instead of a marker pair. The same helper also hashes the selector-name, key-name, and resolved value text back into the caller table, so the profile-key bundle now looks like a real bounded handoff rather than an anonymous callback cloud. The deferred callback shim `multiplayer_transport_dispatch_selector_view_refresh_probe_result` then walks the keyed store through `multiplayer_transport_finish_selector_view_refresh_probe_if_matching`, which only completes entries whose pending latch `[entry+0x74]` is still armed and whose parsed marker request id `[entry+0x50]` matches the finished request. A failed result `-1` clears the pending latch and increments the consecutive-failure counter at `[entry+0x7c]`. A nonfailure result clears the pending latch, increments the success generation at `[entry+0x78]` and total-success count `[entry+0x98]`, clears `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, appends the returned sample into the short rolling history at `[entry+0x84..]`, grows the bounded sample-count `[entry+0x94]` up to four, computes the current average into `[entry+0x80]`, and then publishes that averaged sample through `multiplayer_transport_enqueue_callback_slot24_record`. So the publication boundary is explicit and the request-id ownership is explicit, even though the exact user-facing meaning of the sample and the companion value at `[entry+0x54]` is still open. The same service loop also owns a slower sidecar lane keyed off `[entry+0xa4]`: `multiplayer_transport_select_stale_selector_view_progress_entry` walks the store through `multiplayer_transport_pick_stale_selector_view_progress_entry`, picks one stale entry whose progress latch `[entry+0x9c]` is clear and whose last progress tick `[entry+0x70]` is old enough, and then hands it to `multiplayer_transport_stage_selector_view_progress_snapshot`. That helper now looks more bounded too: it rebuilds the marker text from `[entry+0x50]` through `multiplayer_transport_format_selector_view_probe_marker`, formats one `PNG %s %d` line around that marker and the entry-local selector-view sample at `[entry+0x80]`, appends bounded selector-slot `PNG` fragments for live overlapping slots, marks progress-snapshot state in flight at `[entry+0x9c]`, and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`. So the selector-view sidecar no longer looks like one undifferentiated refresh bucket: it has a faster deferred-probe lane plus a slower progress-snapshot lane, both still under the shell-owned multiplayer transport cadence. The two descriptor lanes installed by `multiplayer_transport_attach_callback_table_descriptor` are now tighter too. The first lane rooted at `0x59f5c0` can arm deferred-close state on the owner transport and then forward through callback slot `23`. The second lane is no longer just a loose selector-view bucket: `multiplayer_transport_callback_dispatch_selector_name_payload_lane` at `0x59f650` classifies selector payloads through `multiplayer_transport_is_selector_control_line`, routes `@@@NFO` control lines into `multiplayer_transport_sync_selector_view_nfo_r_flag`, and otherwise publishes either callback slot `13` or the split token-plus-tail callback slot `14` through `multiplayer_transport_split_selector_payload_token_and_tail`. That local `@@@NFO` helper is now bounded more tightly too: it only accepts lines ending in the literal `X\` tail, searches for the field marker `\$flags$\`, and then sets or clears bit `0x2` in the third selector-slot flag word at `[entry+0x64]` depending on whether that field contains the letter `r` before the next backslash. The sibling `multiplayer_transport_callback_dispatch_current_selector_payload_lane` at `0x59f720` first resolves the active selector through `0x5951a0`, then handles the current-selector variants of the same control vocabulary: `@@@NFO` continues into the same local `r`-flag sync helper, `@@@GML` plus mode-`3/4` payloads feed the shared control-token helper `multiplayer_transport_handle_gml_or_png_selector_control`, and the remaining non-control payloads publish callback slot `9`. That shared helper now narrows the `GML` and `PNG` split materially: when the token is `GML` and the tail is `Disconnected`, it requires the active selector-view entry to pass `multiplayer_transport_selector_view_entry_has_gml_disconnect_gate`, which currently means the entry participates in the third selector slot and has bit `0x20` set in `[entry+0x64]`, before it forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`. Its sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry overlaps the active selector-slot ownership, refreshes selector-view runtime state through `0x5948f0` and republishes callback slot `25`. Alongside those dispatchers, one grounded branch at `0x59f560` still updates selector-view runtime state through `0x5948f0` and forwards the same selector-name pair through callback slot `25`, while `0x59f850` resets selector text state through `0x5954b0`, forwards through callback slot `19`, and when selector `2` is active in a nonterminal route mode re-enters `multiplayer_transport_set_route_mode` with mode `1`. The low-level route helper still looks like a two-part cycle: `multiplayer_gamespy_route_service_retry_and_keepalive_timers` handles challenge or retry pressure and periodic outbound control traffic around the `master.gamespy.com`, `PING`, `natneg`, `localport`, `localip%d`, and `statechanged` strings, while `multiplayer_gamespy_route_drain_inbound_packets` drains inbound datagrams and dispatches semicolon lines, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The transport-owned callback story is now narrower too. The shared route constructor `multiplayer_gamespy_route_construct_and_seed_callback_vector` seeds `[route+0x88]` through `[route+0x9c]` from the caller-supplied transport callback table, records the owner transport at `[route+0x104]`, and explicitly zeroes `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. For the transport-owned status route, `multiplayer_transport_try_connect_status_route` then patches `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` to point at `multiplayer_transport_forward_validated_extended_route_payload` `0x00597330`, which simply forwards the validated payload wrapper into the owner callback at `[transport+0x17f4]` with context `[transport+0x17f8]`. The grounded live-route connect path at `multiplayer_transport_try_connect_live_route` does not currently perform any matching post-construction patch for `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]`, and the higher route-mode state machine now looks consistent with that: current grounded mode transitions switch by releasing route objects through `multiplayer_gamespy_route_release_and_free` and rebuilding them through `multiplayer_transport_try_connect_live_route`, not by mutating callback slots in place. The parser behavior is now tighter as well: semicolon lines only dispatch when `[route+0xd4]` is non-null, and the subtype-`6` raw fallback only dispatches when `[route+0xa4]` is non-null. For the currently grounded transport-owned status and live routes, those two branches therefore remain optional and can cleanly no-op instead of implying a hidden mandatory callback path. Inside the packet parser, subtype `4` is no longer an unknown callback hop: after cookie validation it dispatches through `[route+0x9c]`, which the transport-owned status and live routes seed to `multiplayer_transport_handle_validated_route_cookie_event` `0x005972c0`. That helper either marks route progress and re-enters `multiplayer_transport_set_route_mode`, or forwards the event id plus payload into the owner callback at `[transport+0x17f0]` with context `[transport+0x17f8]`. Subtype `6` still validates the same cookie, dedupes one 32-bit cookie or packet id, and then dispatches the trailing payload through the natneg-or-raw callback layer rooted at `[route+0xa0]` and `[route+0xa4]`. This separates the shell-frame preview refresh at `0x006cd8d8` from the actual transport cadence at `0x006cd970`, and also separates that transport cadence from the lower GameSpy route-service and packet-parser layer beneath it.
 - Evidence: `function-map.csv`, `pending-template-store-management.md`, `pending-template-store-functions.csv`, plus objdump caller traces showing `multiplayer_window_service_loop` reaching `multiplayer_flush_session_event_transport` and the transport pump chain `multiplayer_flush_session_event_transport -> multiplayer_transport_flush_and_maybe_shutdown -> multiplayer_transport_service_frame -> multiplayer_transport_service_worker_once -> multiplayer_transport_drain_request_text_queue`.
 - Open Questions: unresolved request-id semantics for `1`, `2`, `4`, and `7`; whether any non-mode-path helper outside the currently grounded release-and-rebuild flow ever patches `[route+0xa4]` and `[route+0xd4]` for the transport-owned status/live routes, or whether those packet families are simply unused in this stack; and how far the Multiplayer preview-dataset machinery is reused outside `Multiplayer.win` beyond the currently grounded `.gmt` save-mode hook.