Tighten event condition target scope mapping

2026-04-06 01:11:06 -07:00 · 2026-04-06 01:11:06 -07:00 · c1010458f8
commit c1010458f8
parent b86dbb1e64
9 changed files with 757 additions and 17 deletions
--- a/artifacts/exports/rt3-1.06/function-map.csv
+++ b/artifacts/exports/rt3-1.06/function-map.csv
@ -19,7 +19,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00408380,3215,company_build_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query.","objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation"
 0x00408f70,864,company_compute_owned_linked_transit_site_score_total,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Aggregates one company-side linked-transit site score total from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the float at cache offset `+0x12` across the surviving sites while also retaining one or two representative site pointers for neighboring callers. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run.","objdump + caller xrefs + callsite inspection + linked-transit score-total correlation"
 0x00409300,200,company_publish_train_upgrade_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Formats and publishes the linked-transit train-upgrade news item. After one scenario gate through `[0x006cec78+0x4a97]`, the helper chooses one preferred locomotive id through `0x004078a0`, resolves the caller-supplied train id through the live train collection `0x006cfcbc`, formats the old and new locomotive names through the locomotive collection `0x006ada84` and the name helper at `0x00461ca0`, and then emits RT3.lng id `2897` `%1 has just upgraded a %2 to a %3.` through the shell news helper at `0x004554e0`. It finally sets the byte latch at `[company+0x0d56]`. Current grounded callers are the train-roster balancer at `0x00409950` and one neighboring branch at `0x00409b52`, so this now reads as the shared company-side train-upgrade headline helper rather than an anonymous news formatter.","objdump + caller xrefs + callsite inspection + RT3.lng strings + train-upgrade news correlation"
-0x004093d0,837,company_rebuild_linked_transit_site_peer_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step delta from `0x004a6630`, and float `+0x09` stores the normalized delta-per-step ratio. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`.","objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation"
+0x004093d0,837,company_rebuild_linked_transit_site_peer_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step count from `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` `0x004a6630`, and float `+0x09` stores the normalized continuity share computed from that step count and the companion mismatch-count output of the same helper. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`.","objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation + route-step-count correlation + continuity-ratio correlation"
 0x00409720,80,company_service_linked_transit_site_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Timed service wrapper above the two company-side linked-transit cache lanes. The helper refreshes the fast peer cache through `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` when `[this+0x0d3e]` is zero or older than `0x7ff80` ticks, and otherwise refreshes the slower follow-on lane at `0x00407bd0` when `[this+0x0d3a]` is zero or older than `0x31380` ticks. Current grounded direct callers are `0x004097b8`, which re-enters it after one larger local mode change, and several neighboring company-side service paths. This now looks like the bounded timed owner for the company-side linked-transit cache family rather than another anonymous small wrapper.","objdump + caller xrefs + callsite inspection + timed-service correlation"
 0x00409770,88,train_try_append_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Attempts to append one linked-transit autoroute entry onto a live train route list. After validating the train-side state and one current route-kind gate through `0x004a8840`, the helper clears one local staging byte, re-enters `company_service_linked_transit_site_caches` `0x00409720` on the owning company, and then asks `company_build_linked_transit_autoroute_entry` `0x00408380` for a single staged `0x33`-byte route-list record using the current anchor site id at `[this+0x0a0]`. On success it either appends that record through `train_route_list_insert_staged_entry_at_index` `0x004b3160` and refreshes the new trailing selection through `train_route_list_select_entry_and_refresh_linked_site_state` `0x004b2f00`, or when the list is already at the local two-entry cap it rotates the target slot via `[this+0x08] mod [this+0x04]` and overwrites that `0x33`-byte entry in place. Current grounded caller is the company-side service sweep at `0x004019cc`, so this now reads as the single-entry train-side autoroute append helper rather than a two-entry seeding pass.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation + train-route-list correlation"
 0x00409830,274,company_try_add_linked_transit_train_and_publish_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Local add-train branch beneath the linked-transit company train-roster balancer. The helper first respects scenario gate `[0x006cec78+0x4aa3]`, clears and seeds one staged route-entry buffer through `0x004b2ba0`, services the owning company's linked-transit caches, asks `company_build_linked_transit_autoroute_entry` `0x00408380` for two route-list entries, inserts those entries through `train_route_list_insert_staged_entry_at_index` `0x004b3160`, chooses one preferred locomotive id through `0x004078a0`, and then hands the staged route plus locomotive choice into the train-construction helper at `0x004b2140`. On success it emits RT3.lng id `2896` `%1 has added a new train (%2) at %3` through `0x004554e0` and sets the byte latch at `[company+0x0d56]`. Current grounded callers are the local add branches inside `company_balance_linked_transit_train_roster` `0x00409950`, while multiplayer callers package opcode `0x75` instead.","objdump + caller xrefs + callsite inspection + RT3.lng strings + linked-transit train-add correlation"
@ -29,18 +29,39 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00427590,47,company_connection_bonus_lane_is_unlocked,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate above `company_compute_connection_bonus_value_ladder` at `0x00425320`. The helper rejects immediately when the scenario-state flag at `0x006cec78+0x4a8b` is set or when the company age-like counter at `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument connection-bonus value ladder through `0x00425320` and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the later mid-function gate around `0x004064a9`, so current best meaning is one unlock or eligibility gate for the stronger city-connection bonus lane rather than a generic support predicate.","objdump + caller xrefs + callsite inspection + connection-bonus correlation"
 0x0040a590,892,simulation_service_periodic_boundary_work,simulation,cdecl,inferred,objdump + analysis-context,3,"Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. The route-style lane is tighter here now too: one recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, which refreshes every fourth live placed structure for route-style candidate scoring and peer-link emission. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence.",objdump + analysis-context + caller xrefs
 0x0040ab50,339,simulation_advance_to_target_calendar_point,simulation,cdecl,inferred,objdump + analysis-context,3,Advances the active world state toward one caller-selected packed calendar target while guarded by the recursion counter at 0x0062b240. The helper compares the current local tuple fields [this+0x0d] [this+0x0f] [this+0x11] and [this+0x14] against a target resolved through 0x0051d550 and 0x0051d5f0 then either recurses in larger 0x168-sized chunks or advances through the smaller periodic step family rooted at 0x00409e80 and 0x0040a9c0. Each successful step notifies the live world root at 0x0062c120 through 0x00450030. Grounded callers include the frame-time accumulator at 0x00439140 the larger fast-forward helper at 0x00437b20 and one shell UI command path.,objdump + analysis-context + caller xrefs
+0x0040e360,235,placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Subtype-specific local-runtime follow-on beneath `0x0040eba0` and `0x0040ee10`. The helper resolves the current placed structure's candidate from `[this+0x3cc]` through `0x0062b2fc` and `0x0062b268`, requires subtype byte `[candidate+0x32] == 1` plus candidate class byte `[candidate+0x8c] == 3`, then requires a linked site id at `[this+0x2a8]`. When the linked peer exists and its route-entry anchor at `[peer+0x08]` is live in collection `0x006cfca8`, the helper samples one anchor-side float through `0x0048aab0`, subtracts the fixed offset at `0x005c8738`, combines that result with the current placed structure's coordinate pair through `0x00455810` and `0x00455800`, and publishes the resulting triplet through the shared position setter `0x00530720`. Current grounded caller is the broader local side helper `0x0040ee10`, plus the heavier subtype-driven refresh path at `0x0040eba0`, so this is now the safest current read for the linked-site anchor position-triplet refresh beneath the placed-structure local-runtime family rather than a generic route query.","objdump + caller inspection + local disassembly + linked-site-anchor correlation + local-runtime correlation"
+0x0040e450,131,placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small wrapper that rebuilds one placed structure's cloned local-runtime record from its current candidate stem and cached profile slot. The helper copies the current stem string from the candidate referenced by `[this+0x3cc]`, resolves the matching live candidate id through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, seeds the projected-rectangle profile-slot cache from `[this+0x252]` through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470`, and then re-enters `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` `0x00418a60` with the current placed-structure pointer. It stores the returned cloned record into `[this+0x24e]`, refreshes the local cached profile slot from `[record+0x732]` into `[this+0x252]`, and ties the clone back to the owning placed structure through `[record+0x73a] = this`. Current grounded caller is the collection-wide wrapper `0x004133b0`, so this now reads as the cloned local-runtime rebuild helper for one live placed structure rather than an unowned stem lookup.","objdump + caller inspection + local disassembly + local-runtime-clone correlation + projected-rect-profile correlation"
+0x0040eba0,620,placed_structure_set_world_coords_and_refresh_local_runtime_side_state,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavier placed-structure world-coordinate mutation helper above the local-runtime side refresh family. The function updates the current record's world position through `0x00455860`, recomputes cached grid coordinates `[this+0x388]` and `[this+0x38c]`, and rewrites the world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`. On the candidate subtype-`4` branch it also removes and then re-appends the current site to the nearby-transit proximity bucket family through `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0` and `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480`. After that it rebuilds the same local position or scalar triplet family later serviced by `0x0040ee10`, caches the accepted scalar pair in `[this+0x392]` and `[this+0x396]`, publishes the chosen triplet through the shared setter `0x00530720`, optionally refreshes the linked peer route-entry anchor through `0x00480710`, and finally tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers include the broader rebuild paths `0x0040ef10` and `0x0040f6d0`, later site-mutation branches `0x00419110`, `0x0046ef40`, `0x004707da`, and `0x00473bf0`, plus shell-side subject updates around `0x00507cf0` and `0x00508bb0`, so this is now the safest current owner for world-coordinate updates plus local-runtime side-state refresh rather than a generic movement helper.","objdump + caller inspection + local disassembly + world-coordinate mutation correlation + local-runtime correlation + proximity-bucket correlation"
+0x0040ee10,248,placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small placed-structure local-runtime side refresh over one live record. The helper samples the current structure coordinate pair through `0x00455800` and `0x00455810`, converts that pair through the basis at `0x006d4024`, `0x0051f090`, and `0x00534490` into one base scalar, and then conditionally adjusts that scalar when the linked candidate-side structure record keeps nonzero byte `[candidate+0xba]` via the rounded world-grid sampler `0x0044ae40` and the fixed subtractive offset at `0x005c8840`. When the auxiliary preview owner gate `shell_has_auxiliary_preview_owner` `0x00434050` is active, it rounds that scalar to an integer float. It then publishes the resulting position triplet through the shared setter `0x00530720` and tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers are the collection-wide local-runtime refresh wrapper `0x004133b0` and the connected-component recursion tail `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`, so this is now the strongest current owner for the per-site local-runtime position-triplet refresh rather than a generic coordinate helper.","objdump + caller inspection + local disassembly + local-runtime correlation + connected-component correlation"
 0x0040ef10,1984,placed_structure_finalize_creation_or_rebuild_local_runtime_state,map,thiscall,inferred,objdump + caller inspection + placement and mutation correlation,3,"Broad placed-structure post-create or post-edit rebuild above the narrower route-style lane. The helper validates several linked-site and world-state preconditions before keeping the current site live, increments the global live-site count at `0x0062be40`, seeds runtime mode and year fields at `[this+0x390]`, `[this+0x3d4]`, and `[this+0x3d5]`, refreshes the adjacent site-status or overlay family through `0x0040d2d0`, and rebuilds one larger local owner or service bundle through `0x00418be0`, `0x0040eba0`, and the scalar-staging family `0x00475ed0` / `0x00474fe0` / `0x00475010` / `0x00475030` into fields such as `[this+0x24e]`, `[this+0x252]`, `[this+0x25a]`, and `[this+0x25e]`. Later in the same body it re-enters `0x0040db30`, and when the local latch at `[this+0x29e]` is still zero it also re-enters `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `1`. Current grounded callers include the placement-side builders at `0x00403ef3` and `0x00404489`, later site-mutation paths at `0x0046f073` and `0x004707ff`, and one train-side site operation at `0x005098eb`, so this now looks like the broad post-create or post-edit runtime rebuild above route-style scoring and peer-link emission rather than a route-style-only helper.","objdump + caller inspection + placement and mutation correlation + route-style rebuild correlation"
 0x0040f6d0,891,placed_structure_construct_entry_from_candidate_and_world_args,map,thiscall,inferred,objdump + constructor inspection + caller correlation,3,"Lower constructor beneath the shared placed-structure allocator at `0x004134d0`. The helper writes the new placed-structure id into `[this+0x2a4]`, clears a large band of local runtime fields, copies the candidate stem or label payload from the caller-supplied construction scratch record, initializes local world geometry through `0x0040cd70`, `0x0045b9b0`, `0x00455750`, and `0x00455720`, quantizes the input coordinates into the cached grid terms at `[this+0x388]` and `[this+0x38c]`, seeds the current scenario year into `[this+0x3d5]`, and initializes the class-weight lanes near `[this+0x28a]` from the linked candidate vtable owner. It then zeroes the local route-style and service-score bands, conditionally builds the first local owner or service record through `0x00418be0` and `0x0040eba0`, resolves the initial linked site id at `[this+0x2a8]` through `0x00481390` when the backing candidate subtype byte `[candidate+0x32]` is `1`, seeds region linkage through `0x0044a800` and `0x0041f7e0`, optionally re-enters `0x0040db30` for subtype `4`, and finally seeds the trailing random-like dwords at `[this+0x3d9]` and `[this+0x3dd]` from `0x518d70`. Current grounded caller is `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, so this is now the concrete placed-structure constructor rather than an anonymous lower helper beneath the placement-side builders.","objdump + constructor inspection + caller correlation + placed-structure runtime-state correlation"
 0x0040fbe0,224,placed_structure_endpoint_pair_has_shared_route_entry_key,map,thiscall,inferred,objdump + caller inspection + world-grid chain comparison,3,"Boolean peer-test between one placed structure and one caller-supplied peer site id. The helper converts the current site and the peer site into their derived world-grid owner records through `0x00455800`, `0x00455810`, the world-grid tables rooted at `[0x0062c120+0x2129]`, and the placed-structure resolver `0x0040fa50`. It then compares the two route-entry chains rooted at `[cell+0x0ef]`, using the chain lengths at `[cell+0x0eb]`, and returns `1` on the first shared leading `u16` route-entry key; otherwise it returns `0`. Current grounded callers are the route-link emitter at `0x0040fef0`, where it blocks duplicate endpoint pairing before `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50`, and the neighboring cleanup sweep at `0x0040d2aa`, where it decides whether an existing site-owned route-link should be erased. This now looks like the shared duplicate-or-overlap test for the route-link family rather than a generic proximity check.","objdump + caller inspection + world-grid chain comparison + route-link duplicate-check correlation"
 0x0040fef0,752,placed_structure_try_emit_best_route_style_peer_link_for_candidate_class,map,thiscall,inferred,objdump + caller inspection + placed-structure sweep inspection,3,"Scans the live placed-structure collection for one best peer site and emits a missing route-link for one caller-selected candidate class when a qualifying endpoint pair survives. The helper first derives one distance cap from the current placed-structure population size at `0x0062b26c`, scales that cap by the caller-supplied float, and then walks the live placed-structure ids in a wrapped pseudo-random order. Candidate peers must have a positive class-specific weight in the placed-structure lane `[peer+class*4+0x27e]`, differ from the source site, pass the linked-instance class gate `0x0040c990 == 1`, and lie inside the chosen distance window after the coordinate and span checks built from `0x00455800`, `0x00455810`, `0x00455f60`, and nearby math helpers. The strongest surviving peer is kept through a weighted comparison, and if one remains the helper re-enters `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0`; only when that duplicate check fails does it call `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` with the source site id from `[this+0x2a4]`, the chosen peer id, and the same candidate-class argument. Current grounded callers are the larger per-site world pass around `0x00410665` and the route-style grid contribution branch at `0x0042cafe`, so this now looks like the current peer-selection emitter for site-owned route-style links rather than a low-level allocator wrapper.","objdump + caller inspection + placed-structure sweep inspection + route-link emission correlation"
-0x004101e0,6843,placed_structure_rebuild_route_style_candidate_scores_and_peer_links,map,thiscall,inferred,objdump + caller inspection + route-style emission correlation,3,"Large per-site rebuild pass above the route-style link emitter. The helper first requires the current placed structure to pass the linked-instance class gate `0x0040c990 == 1` and several scenario-state gates rooted at `0x006cec78` and `0x006cec7c`, then derives one set of per-class route-style score scalars from the current site's local state, scenario opinion multipliers through `0x00436590`, year-dependent dampers, and the placed-structure class-weight lanes near `[this+0x28a]`. For the first three route-style classes it conditionally re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the caller-supplied mode flag and one computed float score. The function then continues into a larger descriptor-driven scoring phase over the current candidate's runtime descriptor array at `[candidate+0x37]`, building temporary score bands and normalizing them against the same local totals before later write-back. Current grounded callers are the local per-site branch at `0x0040f640`, which reaches it with stack flag `1`, and the broader placed-structure sweep at `0x004135e3`, which reaches it with stack flag `0`; this is therefore the strongest current owner for route-style candidate scoring and peer-link emission on one live placed structure rather than a narrow one-off helper.","objdump + caller inspection + route-style emission correlation + descriptor-loop inspection"
+0x004101e0,6843,placed_structure_rebuild_route_style_candidate_scores_and_peer_links,map,thiscall,inferred,objdump + caller inspection + route-style emission correlation,3,"Large per-site rebuild pass above the route-style link emitter. The helper first requires the current placed structure to pass the linked-instance class gate `0x0040c990 == 1` and several scenario-state gates rooted at `0x006cec78` and `0x006cec7c`, then derives one set of per-class route-style score scalars from the current site's local state, scenario opinion multipliers through `0x00436590`, year-dependent dampers, and the placed-structure class-weight lanes near `[this+0x28a]`. The early compatibility side is tighter now too: it probes the current placed-structure stem against `Nuclear Power Plant`, `Electric Plant`, and `Recycling Plant`, stages three local boolean latches from those matches, and then clears the `Recycling Plant` latch again when the shared build-version query `0x00482e00` reports below `0x68` (`1.04`), so that stem-specific branch is now bounded as a post-`1.04` compatibility lane rather than one timeless route-style rule. For the first three route-style classes it conditionally re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the caller-supplied mode flag and one computed float score. The function then continues into a larger descriptor-driven scoring phase over the current candidate's runtime descriptor array at `[candidate+0x37]`, building temporary score bands and normalizing them against the same local totals before later write-back. That later phase has another bounded version gate: on one descriptor-accumulation subbranch the helper consults `0x00482e00` again at `0x41109f`, and build `1.05+` (`>= 0x69`) skips one older fallback attenuation path that earlier builds still apply through the local multiplier tables. Current grounded callers are the local per-site branch at `0x0040f640`, which reaches it with stack flag `1`, and the broader placed-structure sweep at `0x004135e3`, which reaches it with stack flag `0`; this is therefore the strongest current owner for route-style candidate scoring and peer-link emission on one live placed structure rather than a narrow one-off helper.","objdump + caller inspection + route-style emission correlation + descriptor-loop inspection + version-gate correlation + stem-probe correlation"
 0x004134d0,112,placed_structure_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + caller xrefs + constructor inspection,3,"Shared direct placement helper above the broader placed-structure runtime rebuild. The helper first obtains one temporary `0x3e1`-sized construction scratch object through `0x53b070` and `0x0040c950`, then allocates one live placed-structure entry from the current collection through `0x518900`, resolves the new record through `0x518140`, and finally re-enters the lower constructor at `0x0040f6d0` with the new entry id plus the caller-supplied coordinate and candidate payload tuple. Current grounded callers include the candidate-placement branches at `0x00403ed5`, `0x0040446b`, and `world_region_try_place_candidate_structure` `0x00422ee0`, plus later mutation or editor-side branches at `0x0046efbf`, `0x0047074b`, `0x00472bef`, `0x00472d03`, and `0x00508fd1`. This now looks like the shared placed-structure allocator and constructor entrypoint beneath the placement-side builders rather than a route-style-specific helper.","objdump + caller xrefs + constructor inspection + placement correlation"
 0x0041d550,574,locomotive_era_and_engine_type_pass_company_policy_gate,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Policy gate beneath the preferred-locomotive chooser and its non-electric fallback. The helper operates on one locomotive-era or availability record whose linked locomotive id sits at `[this+0x126]`. On the fuller policy path, reached when record field `[this+0x41]` is `2` or `3`, it first respects several scenario-state locks rooted at `[0x006cec74+0x180]`, `[0x006cec78+0x4c8c]`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x247]`, then resolves the linked locomotive record from `0x006ada84` and dispatches its engine-type dword `[locomotive+0x10]` across three scenario opinion slots through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`: `0x1c6`, `0x1c7`, and `0x1c8`, which current evidence now best aligns with the steam, diesel, and electric lanes. It also special-cases the locomotive stem at `[locomotive+0x34]` against the local string `WhaleL`; current data-file correlation now ties that stem to the `Orca NX462` locomotive family and its `WhaleL_NE` asset set, and when that compare hits the helper explicitly zeros the accumulated issue-opinion result before the later availability checks, so that family loses the positive-opinion shortcut rather than taking a bonus branch. It then consults one neighboring locomotive-derived issue or policy id through `0x00442a85`, and applies a late scenario availability triplet from `[0x006cec78+0x4c97..0x4c99]` against three per-record bytes `[this+0x30..0x32]` plus record field `[this+0x7b]`. That triplet now has a stronger player-facing read: the same three scenario bytes are the live editor-policy fields owned by `map_editor_locomotive_availability_panel_construct` `0x004cd680` and `map_editor_locomotive_availability_panel_handle_message` `0x004cf0d0`, and their localized labels `2863..2865` are `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All Electric Locos Avail.`. The current gate is narrower than a plain override: when the issue-opinion result stays positive and none of those three editor bytes are enabled, that positive result alone seeds the local availability flag; but once any of the editor family bytes is nonzero, the helper instead requires one matching intersection between the per-record family bytes `[this+0x30..0x32]` and the corresponding scenario bytes `0x4c97..0x4c99`. Independent of that family check, record field `[this+0x7b]` can still carry the path into the later year-window gate. On the simpler path it falls straight to an era-window gate using the current scenario year with floor `0x726` against `[this+0x105]` and `[this+0x109]`, plus one current-month-like check from `[0x006cec78+0x0f]`. The helper returns `1` when the era and engine family pass those combined scenario, opinion, availability, and year gates; otherwise `0`. Current grounded callers are `company_select_preferred_available_locomotive_id` `0x004078a0` and `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + year-window correlation + scenario-gate correlation + editor-locomotive-availability correlation + WhaleL carveout correlation + engine-data correlation"
 0x00417790,160,map_angle_rotate_grid_offset_pair_into_world_offset_pair,map,cdecl,inferred,objdump + callsite inspection + math-table correlation,2,"Small angle-table rotation helper beneath the placement projection family. The helper normalizes the caller-supplied heading float into the engine's cyclic angle domain, indexes one sine or cosine-like basis table under `0x006d4024`, and then applies that basis pair to the caller-supplied X or Y grid offsets before writing the rotated world-space offset pair through the two out-pointers. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, so this now looks like the low-level offset-rotation helper rather than a generic trig wrapper.","objdump + callsite inspection + math-table correlation"
 0x00417840,205,placed_structure_project_candidate_grid_extent_offset_by_rotation,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Projects one candidate-sized local grid extent into rotated world-space X or Y offsets for placement and mutation previews. The helper resolves the caller-supplied placed-structure id through the current collection, pulls one local grid basis pair through `0x00413d80`, reads the linked candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, converts those grid extents into local offset terms, and then re-enters `map_angle_rotate_grid_offset_pair_into_world_offset_pair` `0x00417790` with the caller-supplied heading float to produce the rotated output pair. Current grounded callers include the city-connection placement chooser `0x00402cb0`, the placed-structure local rebuild lane at `0x0040de78`, subtype-`1` placement validation inside `0x004197e0`, and later world-side update branches at `0x00417b6f`, `0x00417e27`, `0x0041a250`, `0x0041a615`, `0x004802c6`, `0x00480875`, and `0x00480d50`. This now looks like the shared projected-footprint offset helper beneath placement validation rather than an unnamed geometry routine.","objdump + caller xrefs + callsite inspection + placement-correlation"
+0x004185a0,100,world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small world-grid mask helper beneath the neighboring projected-rectangle raster family. The helper walks one caller-supplied rectangle from the four dwords rooted at stack arg `+0x04`, reads the aligned float sample band from the caller buffer at stack arg `+0x08`, skips cells whose sample is still the sentinel `0x497423f0`, and otherwise toggles bit `0x01` in the grid-byte mask rooted at `[0x0062c120+0x2135]` by XORing it with the low bit of the caller-supplied byte flag at stack arg `+0x0c`. Current grounded callers are the higher projected-rectangle workers at `0x00418610`, `0x00418a60`, and `0x00418d40`, so this is now bounded as a non-sentinel mask-toggle helper rather than another generic grid writer.","objdump + caller inspection + local disassembly + grid-mask correlation"
+0x00418610,584,world_grid_refresh_projected_rect_sample_band_and_flag_mask,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan.","objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation"
+0x00418a60,372,placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan.","objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation"
+0x00418be0,346,placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper.","objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation"
 0x004197e0,5232,placed_structure_validate_projected_candidate_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`.","objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation"
 0x00480210,448,placed_structure_construct_linked_site_record_from_anchor_and_coords,map,thiscall,inferred,objdump + caller inspection + constructor inspection,3,"Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`.","objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation"
 0x00413580,160,placed_structure_collection_refresh_quarter_subset_route_style_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper computes a start index from the scenario time byte at `0x006cec78+0x11` modulo `4`, then walks every fourth live placed-structure record in the collection, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass.","objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation"
+0x00414fa0,118,world_grid_count_flagged_cells_and_collect_float_samples,map,cdecl,inferred,objdump + callsite inspection,3,"Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues.","objdump + callsite inspection + world-grid scan correlation"
+0x00415020,1968,world_grid_refresh_flagged_region_float_extrema_and_mean,map,cdecl,inferred,objdump + caller inspection,3,"Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper.","objdump + caller inspection + version-gate correlation + world-grid scan correlation"
+0x00415f20,403,placed_structure_recursive_collect_connected_component_tile_bounds,map,thiscall,inferred,objdump + caller inspection,3,"Recursive connected-component bounds collector over linked placed-structure records. Starting from one placed-structure node, the helper expands four caller-owned tile-bound out slots from the record-local rectangle fields `[record+0x4a0..0x4ac]`, tags the record with the current component pass id at `[record+0x73e]`, then walks the component membership map rooted at `0x0062ba7c` to find adjacent records whose packed tile key falls inside the current rectangle and whose prior pass id differs. Matching adjacent records recurse through the same helper until the reachable component rectangle is exhausted. On return the helper also seeds one default local rectangle owner through `0x004159e0` when `[record+0x732] == -1`, then refreshes the neighboring runtime side through `0x0040ee10`. Current grounded callers are the wrapper at `0x004160c0` and internal recursive self-calls.","objdump + caller inspection + recursive-component correlation + placed-structure-bound correlation"
+0x004160c0,168,placed_structure_collect_connected_component_tile_bounds_with_version_gate,map,cdecl,inferred,objdump + caller inspection,3,"Wrapper above `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`. The helper initializes four tile-bound accumulators to sentinel values, increments one world-grid reentry depth counter at `0x0062c120+0x2205`, and then chooses between two paths. On builds `1.03` and earlier, or when scenario field `[0x006cec78+0x46c38]` is still clear, it re-enters the recursive component walk through `0x00415f20`; otherwise it skips that older walk entirely. In both cases it decrements the reentry counter and then expands the surviving rectangle by `2` tiles on each side before publishing it through `0x0044d410`. Current grounded caller is the route-entry-backed component wrapper at `0x004161a0`, so this now looks like the version-gated connected-component bounds collector rather than another generic tracker helper.","objdump + caller inspection + version-gate correlation + connected-component correlation"
+0x00416170,345,placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tile-range wrapper above `placed_structure_collect_connected_component_tile_bounds_with_version_gate` `0x004160c0`. The helper seeds the current connected-component pass keys at `0x0062ba7c` and `0x0062ba80`, iterates the caller-supplied tile rectangle, allocates or reuses one small per-tile record from the caller-owned queue, and looks up the packed `(row << 16) | col` key through the component map rooted at `0x0062ba7c` via `0x0053dae0`. When one mapped component record exists and the current placed-structure owner at stack arg `+0x0c` still has `[site+0x732] == -1`, the world-side latch at `[0x0062b2fc+0x9c]` is clear, scenario field `[0x006cec74+0x4fd]` is clear, and the caller-supplied suppress-refresh flag at stack arg `+0x10` is zero, it follows the mapped component chain and re-enters `0x004160c0` for each linked record; otherwise it clears one world-grid byte through `0x00448a70`. The resolved or refreshed record is then stored back through `0x0053d9e0` and `0x0053d960`. Current grounded callers are the neighboring local-runtime passes at `0x00418a60` and `0x00418be0`, so this is now the strongest current owner for mapping one tile rectangle into connected-component records with optional bounds refresh rather than another bare recursive walk.","objdump + caller inspection + local disassembly + connected-component-map correlation"
+0x00416e20,156,indexed_collection_resolve_live_entry_id_by_stem_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small live-entry resolver over an indexed collection. The helper walks the live slot count through `indexed_collection_slot_count` `0x00517cf0`, fetches each live id through `indexed_collection_get_nth_live_entry_id` `0x00518380`, resolves the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and compares the caller-supplied string against the record stem at `[record+0x04]` through `0x005a57cf`. On success it returns the matching live id. On failure it emits localized id `189` through the shell string helpers and returns `-1`. Current grounded callers are the neighboring placed-structure local-runtime builders at `0x00418be0` and `0x0040e450`, plus one shell-side branch at `0x00507e80`, so this is now the strongest current match for a stem-to-live-id resolver rather than an unowned search loop.","objdump + caller inspection + local disassembly + stem-compare correlation"
+0x00416ec0,1867,placed_structure_build_projected_runtime_scratch_from_candidate_and_coords,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy projected-runtime scratch builder beneath the neighboring local placed-structure runtime family. The helper resolves one candidate record from the caller-supplied id, derives rotated footprint extents and centered world-space bounds from the caller-supplied coordinate and heading inputs, allocates and clears several temporary per-footprint mask bands on the stack, then walks up to four candidate-side shape or access sublanes rooted at `[candidate+0xcf]`, `[candidate+0xd3]`, `[candidate+0xd7]`, and `[candidate+0xdb]`. Within that deeper loop it projects rotated footprint cells through the basis pair at `0x006d4024`, rejects out-of-bounds or duplicate cells, checks multiple world-grid acceptance gates through `0x00448af0`, `0x00534e10`, `0x004499c0`, and `0x00413df0`, and marks the surviving cells into both temporary stack masks and the live world-grid byte lane at `[0x0062c120+0x2131]`. The tail publishes the finished scratch payload through `0x00416620`. Current grounded caller is `0x00418be0`, which then copies that scratch block into one queued local runtime record, so this is now the safest current name for the projected-runtime scratch builder rather than a generic placement validator.","objdump + caller inspection + local disassembly + projected-footprint correlation"
+0x00418040,1168,placed_structure_render_local_runtime_overlay_payload_from_projected_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy local-runtime overlay-payload builder beneath the broader local-runtime record family. The helper derives one projected bounds rectangle through `0x004142e0` and `0x00417f20`, rejects very small payloads, allocates one temporary dword buffer, folds that buffer through `0x00415370`, and then walks the projected rectangle producing one packed dword payload per cell. Current bounded gates include a duplicate-entry or occupancy fast path keyed by `[var_10h]`, world-grid rejection through `0x004499c0`, and several distance- and ratio-shaped thresholds built from the projected rectangle geometry. On accepted cells it writes one four-byte packed value into the caller output stream. Current grounded caller is `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` `0x00418be0`, where the result is stored into `[0x0062b7c8]`, so this is now the safest current read for the local-runtime overlay payload renderer rather than a generic geometric sweep.","objdump + caller inspection + local disassembly + overlay-payload correlation"
+0x00414470,10,placed_structure_cache_projected_rect_profile_slot_id,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny setter for the projected-rectangle profile-slot cache at `0x005ee030`. The helper just stores the caller-supplied dword into that global cache. Current grounded caller is `0x0040e450`, where the cached value is set immediately before the current-subject local-runtime clone path at `0x00418a60`.","objdump + caller inspection + local disassembly + global-cache correlation"
+0x00416620,521,placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Publishes one projected-runtime rectangle and its companion globals beneath the local-runtime scratch builder. The helper copies the current scratch owner id from `0x0062b304` into `0x0062b308`, stores the caller-supplied pair into `0x0062b30c/0x0062b310`, grows the active rectangle bounds at `0x0062b7ac` and `0x0062b7b4` when needed, clears one current index slot in `0x0062b318`, and then validates the rectangle against the route-entry store `0x006cfca8` through `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`. On failure it raises localized id `185`; on one special-candidate branch keyed by `[record+0x123]` it re-enters `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, either expands the rectangle by three cells on each side and refreshes the per-cell side tables through `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` or fails with localized id `186`; and on the ordinary branch it can scan the temporary cell-value bank at `0x0062b300` across the rectangle and fail with localized id `187` before again tailing into `0x00414e10`. Current grounded callers are `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0` and the placement validator `0x004197e0`, so this now looks like the projected-runtime rectangle publisher plus side-window validator rather than an anonymous scratch tail.","objdump + caller inspection + local disassembly + projected-rectangle-global correlation"
+0x00415570,317,placed_structure_try_select_projected_rect_profile_slot,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small projected-rectangle profile selector beneath `0x00416620`. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, resets the shared slot id at `0x0062ba3a`, derives one companion value through `0x00413eb0` into `0x0062ba3e`, and then probes the current rectangle at `0x0062b7a8..0x0062b7b4` through repeated `0x004153f0` checks. One fast path reuses the cached selector at `0x005ee030`; another starts from localized id `11` through `0x00518be0`; and both update `0x0062ba3a` on success. Current grounded caller is the special-candidate branch inside `0x00416620`, where the returned success decides whether the rectangle can be expanded and the companion byte tables refreshed. This is therefore best-read as a projected-rectangle profile-slot selector rather than a broad route or placement policy helper.","objdump + caller inspection + local disassembly + rectangle-probe correlation"
+0x00414e10,200,world_grid_refresh_projected_rect_surface_and_region_byte_tables,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan.","objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation"
+0x00494240,195,route_entry_collection_query_rect_window_passes_entry_type_gate,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan.","objdump + caller inspection + local disassembly + route-entry-window correlation"
 0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection,3,"Rebuilds the per-candidate cargo summary tables after one runtime descriptor array has been materialized. The helper clears the two cargo-id pointer tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and one float-like per-cargo accumulator band rooted at `[this+0x0a1]`, then walks every live `0xbc` descriptor in `[this+0x37]` against the current scenario year at `[0x006cec78+0x0d]`. For each active subordinate cargo row in the descriptor-owned `0x1c`-byte entry band it resolves one cargo id through the global cargo collection at `0x0062ba8c`, updates the per-cargo accumulator, and tracks one or two levels of cargo membership before compacting those marks into the two emitted cargo-id tables. The stronger production-mode result is now bounded here rather than only in the editor importer: when the descriptor-side mode flag at `[desc+0x00]` is zero the subordinate row amount is multiplied by the shared recipe-book production cap at `[this+0x2a]` and divided by the descriptor amount at `[desc+0x04]`; when that mode flag is nonzero the helper bypasses that scaling path. That matches the editor-side split where production mode keeps the entered annual amount on the supply half while the demand half is normalized to `1.0`, so the demand-side production branch now looks like a normalized input selector or gate while the supply side is the branch that receives cap-scaled runtime rates. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + scenario-state correlation + cargo-collection correlation"
 0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When the runtime cargo-economy latch at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-collection correlation"
 0x004125f0,87,structure_candidate_count_active_scaled_supply_descriptors,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts active runtime descriptors that participate in the scaled supply-side production lane for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, selects only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active scaled-supply descriptors.","objdump + caller xrefs + callsite inspection"
@ -48,6 +69,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. Current grounded caller is the placed-structure sweep around `0x00452e60`, where the result gates per-instance activation against one requested cargo id.","objdump + caller xrefs + callsite inspection + cargo-summary correlation"
 0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062ba8c`. The helper iterates the collection twice against the paired availability bytes at `[candidate+0xba]` and `[candidate+0xbb]`, chooses one existing record to clone when the scenario-side owner id at `[candidate+0x794]` matches, otherwise clears the target record, and then repopulates the candidate runtime fields from the active scenario state rooted at `0x006cec78`. For each rebuilt candidate it copies the recipe-line count from `[state+0x1024]`, the shared production-cap float from `[state+0x13d4]`, and the packed `0xbc` descriptor array from `[state+0x1028]`, then refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` at `0x00411ee0` and the neighboring mode-flag pass at `0x00411ce0`. One bounded text side branch also republishes the candidate label from the scenario-side recipe-book name around `[state+0x0fe8]` when that string ends in `:`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` at `0x00435630` and the larger collection load path at `0x00412fb0`, so this now looks like the candidate-side bridge that projects editor recipe-book state into live runtime records rather than another generic collection copy loop.","objdump + caller xrefs + callsite inspection + scenario-state correlation"
 0x00412ca0,192,world_region_pick_commercial_profile_label_by_region_rank,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`.","objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings"
+0x004133b0,132,placed_structure_collection_refresh_local_runtime_records_and_position_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b26c` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller is no longer just an anonymous raw callsite: it sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep.","objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation"
+0x00413f50,47,placed_structure_local_runtime_site_id_queue_pop_next,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"
+0x00414480,6,placed_structure_local_runtime_site_id_queue_count,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny count getter over the temporary placed-structure id queue used by the local-runtime refresh family. The helper simply returns the current queue count at `0x0062ba64`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the returned count bounds the queue-drain loop before the later all-sites side refresh.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"
 0x0041ea50,179,world_setup_building_collection_phase,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. The helper iterates the building-related collection at `0x0062ba8c`, chooses either the full pass or one modulo-selected bucket from the current world byte at `[0x006cec78+0x0f]`, resolves each entry through `0x00518380` and `0x00518140`, and then dispatches the selected record into the lower setup worker at `0x0041e2b0`. Current grounded callsite is the early collection sweep inside world_run_post_load_generation_pipeline immediately before the localized progress update `Setting up Players and Companies...`, so this looks like the collection-owned building-setup staging phase rather than one of the later player-speed or shell-frame loops.",objdump + caller context + RT3.lng strings
 0x0041e220,52,structure_candidate_is_enabled_for_current_year,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper.","objdump + caller xrefs + callsite inspection + cargo-economy filter correlation"
 0x0041e650,142,structure_candidate_query_route_style_or_local_availability_metric,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + collection-correlation,3,"Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader.","objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation"
@ -64,6 +88,14 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004682c0,58,placed_structure_route_link_collection_recompute_all_endpoint_pair_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide recompute sweep over the live `0x006ada90` route-link family. The helper iterates every live route-link id through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` on each resolved record. This is the clean whole-collection state refresh companion to the per-record recompute helper rather than another allocator or cleanup path.","objdump + caller inspection + collection-iteration inspection + recompute-helper correlation"
 0x00468300,235,placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state,map,thiscall,inferred,objdump + caller inspection + world-grid correlation + collection-iteration inspection,3,"Higher-level rebuild pass above the route-link family that resets the route-style world-grid counters and then recomputes live endpoint state across `0x006ada90`. The helper first reads three candidate-class ids from the structure-candidate side table at `0x0062ba8c+0x88/+0x8a/+0x8c`, walks the active world-grid tables rooted at `[0x0062c120+0x2129]`, and clears the aligned per-cell dword lanes at offset `+0x103` for those three classes. It then iterates every live route-link record in `0x006ada90`, clears state bit `0x2` in each record's flag byte at `+0x12`, and re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current grounded callers include the recurring simulation-maintenance branch at `0x0040a575`, the world bring-up side near `0x00444b2f`, and one later world-side update path at `0x00481157`, which makes this the clearest current owner of the full-family route-style counter-and-state rebuild rather than just another collection walk.","objdump + caller inspection + world-grid correlation + collection-iteration inspection + route-style-class correlation"
 0x0041e2b0,589,structure_candidate_rebuild_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `world_setup_building_collection_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate.","objdump + caller xrefs + callsite inspection + world-grid correlation"
+0x0042db20,1040,scenario_event_refresh_runtime_record_from_packed_state,scenario,thiscall,inferred,objdump + caller inspection + local disassembly + shell-event-window correlation,2,"Heavy per-event runtime materializer beneath the live event collection at `0x0062be18`. The helper reads one packed event definition from the caller-supplied state or stream object, conditionally clears and repopulates several fixed text bands on the destination event record at offsets such as `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, then rebuilds two event-runtime row families from caller-supplied counts and packed row payloads. Current shell-side xrefs now tighten that split. The first family allocates `0x1e`-byte rows, fills scalar and byte fields from the packed source, conditionally extends the row on later-format branches, remaps bounded id ranges through the live structure-candidate collection `0x0062ba8c`, and links the resulting rows through one standalone event-side list anchor; the adjacent helper cluster `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is only consumed by `EventConditions.win`, so this first family now reads as the runtime condition-row list. The second family repeats the same materialization pattern with `0x28`-byte rows across four grouped slots on the destination event record, applying version-gated field extension and bounded remap logic against the locomotive collection `0x006ada84`, the live structure-candidate collection `0x0062ba8c`, and the global candidate pool `0x0062b268` before linking each rebuilt row into one of four grouped list anchors; the generic deep-copy helper `0x0042e050` now clones those same grouped lists during event duplication, so this second family still reads as the grouped event-effect row side rather than another condition list. Current grounded caller is the collection-wide wrapper `0x00433130`, so this is now the safest current read for one live event's runtime-record refresh from packed scenario-state data rather than a generic collection helper.","objdump + caller inspection + local disassembly + event-record materialization correlation + candidate-and-locomotive-remap correlation + shell-event-window correlation"
+0x0042d700,59,scenario_event_query_standalone_condition_row_list_class_and_modifier_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates the class and modifier bits implied by one live event's standalone `0x1e`-row condition list. The helper first short-circuits to literal `0x7f` when event byte `[event+0x82b]` is set, then otherwise walks the list rooted at `[event+0x00]`, OR-ing the static row-class byte from `0x005f3e04 + id*0x81` for ordinary nonnegative row ids and using the negative-id fallback branch only to preserve special marker value `0x7f`. Current grounded callers are the condition-window summary refreshes `0x004d9970` and the broader control refresh `0x004da0f0`, so this is the safest current read for the standalone condition-list class or modifier aggregate rather than a generic linked-list scan.","objdump + EventConditions.win refresh correlation + local disassembly + condition-row-class-table correlation"
+0x0042d740,87,scenario_event_query_grouped_effect_row_list_type_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates one grouped effect-row type bitfield for a live event. The caller supplies the grouped list ordinal on the stack, and the helper walks the selected grouped anchor at `[event + group*4 + 0x04]`, OR-ing one descriptor byte from `0x006103fd + opcode*0x6e` across the linked `0x28`-row family. One caller-controlled boolean also enables a narrower normalization path that remaps a small special opcode subset to shared bit `0x08` before the OR step. Current grounded callers are the conditions-window refresh family `0x004d9d10` and `0x004da0f0`, plus one world-side branch at `0x00431120`, so this is the safest current read for grouped effect-row type flags rather than a standalone condition helper.","objdump + EventConditions.win refresh correlation + local disassembly + grouped-effect-descriptor correlation"
+0x0042df30,63,scenario_event_condition_row_list_has_class_bit0_or_flag7f9_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Tiny predicate over the standalone `0x1e`-row event-condition list rebuilt by `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. The helper walks the linked list rooted at the caller-supplied event record, tests each nonnegative row id against class-bit `0x01` in the static per-condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7f9]`. Current grounded callers are the `EventConditions.win` refresh path at `0x004da19a` and `0x004da23c`, so this now reads as the class-bit-0 condition-summary gate rather than a generic list scan.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
+0x0042df70,63,scenario_event_condition_row_list_has_class_bit1_or_flag7fa_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x02` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7fa]`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da1de`, so this now reads as the class-bit-1 condition-summary gate rather than another anonymous list helper.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
+0x0042dfb0,62,scenario_event_condition_row_list_has_class_bit2_or_type63_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to the event-record dword check `[event+0x7f0] == 0x63`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da2be`, so this now reads as the class-bit-2 condition-summary gate rather than another generic scan.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-type correlation"
+0x0042dff0,82,scenario_event_condition_row_list_has_any_class_bit012_or_special_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Broad predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as the smaller `0x0042df30/0x0042df70/0x0042dfb0` family, tests each nonnegative row id against any of class bits `0x01|0x02|0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to any of the three special event-record checks `[event+0x7f9]`, `[event+0x7fa]`, or `[event+0x7f0] == 0x63`. Current grounded caller is the early `EventConditions.win` refresh gate at `0x004da17d`, so this now reads as the broad condition-summary eligibility probe rather than a generic linked-list walk.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
+0x0042e050,603,scenario_event_clone_runtime_record_deep_copy,scenario,cdecl,inferred,objdump + caller xrefs + local disassembly + shell-event-window correlation,2,"Deep-copy helper for one already-materialized live event runtime record. The helper copies the six fixed text bands at destination offsets `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, mirrors the compact event metadata band at `+0x7ee..+0x80e`, then deep-copies the standalone `0x1e`-row linked list and the four grouped `0x28`-row linked lists from one live event-runtime record into the caller-supplied destination record. Current grounded caller is `shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal` `0x004db8b0`, where it clones the currently selected live event into a newly created event record before selector refresh. This is therefore the safest current owner for deep-copy of an already-materialized event runtime record rather than another packed-state loader or an effects-only staging helper.","objdump + caller xrefs + local disassembly + shell-event-window correlation + deep-copy correlation"
 0x0042c1b0,886,placed_structure_redistribute_local_service_pressure_from_neighbors,map,thiscall,inferred,objdump + caller xrefs + neighborhood sweep inspection,3,"Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop.","objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation"
 0x0041eac0,794,structure_candidate_collection_refresh_cargo_economy_filter_flags,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + rdata strings,3,"Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and one neighboring mode gate at `[0x006cec78+0x4afb]`, and writes the resulting enabled-or-filtered state into `[entry+0x56]` before re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule into live structure-candidate filtering rather than a purely editor-side helper.","objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation"
 0x00421b60,180,world_region_collection_seed_default_regions,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup.","objdump + RT3.lng strings + caller xrefs + callsite inspection"
@ -114,6 +146,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00429990,86,company_collection_get_nth_active_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows.","objdump + caller inspection + active-company roster correlation"
 0x004299f0,84,company_collection_count_active_companies_before_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`.","objdump + caller inspection + active-company roster correlation"
 0x00429a50,62,company_collection_count_active_companies,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math.","objdump + caller inspection + active-company roster correlation"
+0x00433130,169,scenario_event_collection_refresh_runtime_records_from_packed_state,scenario,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper stages one small packed header read from the caller-supplied state or stream object, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` at `0x00444959` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk.","objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation"
 0x00434050,11,shell_has_auxiliary_preview_owner,shell,cdecl,inferred,objdump + caller inspection + side-owner correlation,4,"Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live.","objdump + caller inspection + side-owner correlation + caller xrefs"
 0x00434300,881,world_runtime_release_global_services,map,cdecl,inferred,objdump + analysis-context,3,Releases or clears a broad set of world-runtime global services owned by the current map object before a new world entry or sibling save branch continues. The helper walks the owner collection at [this+0x66b2] and then touches many global manager slots including 0x0062b244 0x0062cfcbc 0x0062be10 0x0062c120 0x0062ba8c 0x0062ba88 0x0062b2fc 0x0062b268 0x006cea4c and 0x006acd34 through repeated release-style calls and nulling writes. Current grounded callers are the heavier world-entry branch at 0x00443a50 the sibling .smp world-state branch at 0x00446d40 and shell_transition_mode at 0x00482ec0.,objdump + analysis-context + caller xrefs
 0x0043cb00,295,world_view_step_heading_quadrant,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag.,objdump + caller xrefs + callsite inspection
@ -159,6 +192,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00494e40,61,aux_route_entry_tracker_reset,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Zeroes or reinitializes one small auxiliary route-entry tracker record. The helper seeds the two endpoint-entry ids at `+0x04` and `+0x08` to `-1`, clears the small refcount at `+0x10`, clears the cached route-key and class-signature words at `+0x18` and `+0x1e`, resets the boolean latch at `+0x1c` to `0`, and clears the trailing payload band through `+0x42`. Current grounded callers are the tracker allocator paths at `0x004a42b0` and several neighboring `0x006cfcb4` setup sites, so this is the clearest current initializer for the auxiliary route-entry tracker family.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
 0x00494e90,15,aux_route_entry_tracker_seed_owner_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Seeds one auxiliary route-entry tracker with its owner or primary route-entry id. The helper writes the caller-supplied id into tracker field `+0x00` and clears the small accumulator fields at `+0x42` and `+0x46`. Current grounded callers are the tracker allocator paths at `0x004a42b0`, which use it immediately after allocating one `0x006cfcb4` record keyed by a route-entry id.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
 0x00494eb0,15,aux_route_entry_tracker_adjust_refcount,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Adds the caller-supplied delta into the small refcount field at tracker offset `+0x10` and returns the updated total. Current grounded callers are the collection-side tracker updater `0x004a4340`, where a zero result triggers the tracker's destruction path.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
+0x00494ed0,26,aux_route_entry_tracker_contains_endpoint_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Small membership probe over one auxiliary route-entry tracker. The helper returns `1` when the caller-supplied route-entry id matches either tracker endpoint slot `+0x04` or `+0x08`, and `0` otherwise. Current grounded callers include several tracker-regroup and repair branches around `0x00490d62`, `0x0049a9ed`, `0x0049f162`, and `0x004a4ce0`, where it acts as the cheap endpoint-membership test beneath adjacent-chain transfer and duplicate-split logic.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
 0x00494f00,176,aux_route_entry_tracker_merge_or_bind_endpoint_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Binds one route-entry id into the two-endpoint auxiliary tracker record. The helper resolves the supplied route-entry through `0x006cfca8`, derives one route-key-like value through `0x0048aa70`, reads the route-entry signature fields at `+0x22e` and byte `+0x44`, and then either seeds both endpoint slots `+0x04/+0x08` on the first bind or merges the new entry into one side when the signature, route-key, and boolean class latch match the tracker's existing state. On failure it returns `0`; on success it returns `1`. Current grounded callers are the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring `0x006cfcb4` tracker update branches around `0x0049f1ce`, `0x0049f38d`, `0x0049f90b`, `0x004a4685`, `0x004a4830`, `0x004a4982`, `0x004a5175`, and `0x004a5189`. This now looks like the tracker-side endpoint bind or merge helper rather than a generic route-entry accessor.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
 0x00494fb0,97,aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Refreshes the small boolean class latch at tracker offset `+0x1c` and notifies the owning route-entry group when that latch changes. When the route-store latch `[0x006cfca8+0xf1]` is clear, the helper resolves the current endpoint-entry ids from `+0x04` and `+0x08`, recomputes whether the bound endpoint pair carries the nonzero route-entry byte `+0x44` on both sides, writes the resulting boolean back into `+0x1c`, compares it against the previous latch value, and on change calls `0x004a6360` on the auxiliary tracker collection `0x006cfcb4` with the owner entry id at `+0x00`. Current grounded callers are the neighboring route-state branch at `0x004915e0` and the compatible endpoint-slot rewrite helper `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0`. This now looks like the tracker-side boolean class-latch refresh plus owner-notify path rather than a generic predicate helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-notify correlation"
 0x00495020,188,aux_route_entry_tracker_refresh_cached_match_fields_and_maybe_split_duplicate_pair,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + field-layout inspection,3,"Refreshes one auxiliary tracker's cached match metadata and clears its trailing relationship payload band. Under two scenario-threshold branches keyed by `[0x006cec78+0x46c34]`, the helper seeds or refreshes tracker cache fields from the currently bound endpoint pair: it derives one route-key-like value through `0x0048aa30`, reuses one endpoint signature word from route-entry field `+0x22e`, and falls back to constant `1` when no endpoint slot is available on the active branch. After that it zeroes the trailing payload band at `+0x24..+0x46`. When both endpoint slots `+0x04` and `+0x08` still point to the same route-entry id and the tracker refcount `+0x10` is greater than `1`, it tail-calls the deeper split or reseed path at `0x004a51a0` with the owner route-entry id at `+0x00`. Current grounded caller is the broader tracker-side branch at `0x004a41b0`. The current objdump shape keeps the exact `+0x18/+0x1e` destination split slightly irregular on the second threshold path, so this row stays conservative about the final field assignment while still grounding the helper as cached-match refresh plus duplicate-pair split prep.","objdump + caller xrefs + callsite inspection + field-layout inspection + tracker-family correlation"
@ -172,7 +206,19 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00494cb0,398,route_entry_collection_try_find_route_entry_covering_point_window,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Searches the current route-entry collection for one entry whose sampled span covers the caller's point window. The helper rejects immediately when the supplied window radius is nonpositive, quantizes the caller's center coordinates into world-grid bounds, iterates the resulting rectangular tile window inside `0x0062c120`, and repeatedly re-enters `0x004921a0` on each candidate tile or route bucket until it finds one acceptable route-entry id. Current grounded callers include the station-attachment validation lane at `0x00403d30`, the placement validator at `0x00417ba1` and `0x0041a2c9`, the world-side route mutation lane at `0x00480d88`, the initial candidate sweep `0x0049bd40`, the search core `0x0049d724`, and several neighboring route-search branches. This now looks like the shared route-entry point-window coverage query beneath both placement-side track attachment and the heavier route-entry search family rather than a generic tile scan.","objdump + caller xrefs + callsite inspection + world-grid correlation + route-window correlation"
 0x004a42b0,79,aux_route_entry_tracker_collection_allocate_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Allocates one new tracker record in the auxiliary route-entry collection at `0x006cfcb4` and seeds it for one owner route-entry id. The helper resets a small local tracker template through `aux_route_entry_tracker_reset` `0x00494e40`, allocates one live record from the collection through `0x00518900`, resolves that record, seeds its owner entry id through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90`, and returns the new tracker id. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x0049e174`, `0x0049e3d8`, `0x0049e427`, `0x0049e45c`, `0x0049f1b0`, `0x0049f3b5`, `0x0049f91a`, `0x004a466d`, `0x004a4814`, `0x004a4966`, and `0x004a5054`, so this is now the clearest current allocator for the auxiliary route-entry tracker family.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
 0x004a4340,55,aux_route_entry_tracker_collection_adjust_refcount_or_destroy,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Looks up one tracker record in the auxiliary route-entry collection at `0x006cfcb4`, adjusts its small refcount through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`, and destroys the record through the collection vtable when the resulting count reaches zero. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x00490da5`, `0x0049a9b8`, `0x0049abca`, `0x0049f178`, `0x0049f1a2`, `0x0049f1e0`, `0x0049f37e`, `0x0049f3a7`, `0x004a4f9c`, `0x004a4fb0`, and `0x004a5161`. This now looks like the shared refcount or destroy path for the auxiliary route-entry tracker family rather than another anonymous collection helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
-0x004a45f0,1420,aux_route_entry_tracker_collection_refresh_route_entry_group_membership,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy regrouping pass over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper starts from one route-entry record, rejects the trivial case where both adjacent route-entry fields `[entry+0x206]` and `[entry+0x20a]` are unset, optionally runs one broader prepass at `0x004a4380` keyed by the route entry's current tracker id in `[entry+0x212]`, and then refreshes ownership around that id. On the simpler branch it can allocate one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, bind one or more route-entry ids into it through `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, assign the resulting tracker id back into route-entry field `+0x212` through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalance tracker refcounts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. The current endpoint-bind semantics are tighter now too: the bind helper groups entries only when their route-key-like value from `0x0048aa70`, route-entry signature word `+0x22e`, and boolean class latch derived from byte `+0x44` all agree. On the larger branch this pass walks adjacent route-entry links through the `+0x206/+0x20a/+0x20e` family, can allocate or reuse additional trackers, uses `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` to rewrite compatible endpoint slots between old and new groups, and can re-enter the nearby cached-match refresh path `0x00495020` before dropping empty tracker records through the collection vtable. Current grounded caller is `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where this pass runs immediately after literal-policy-`2` route-anchor rebuild and bind. This now looks like the auxiliary tracker regrouping pass beneath the broader linked-site route-anchor rebuild lane rather than a generic collection sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + linked-site refresh correlation + endpoint-match-tuple correlation"
+0x004a4380,619,aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Broader prepass beneath the auxiliary route-entry tracker regrouping family at `0x006cfcb4`. Starting from one existing tracker id, the helper snapshots the source tracker's cached match tuple at `+0x18/+0x1c/+0x1e` plus its endpoint slots `+0x04/+0x08`, walks the adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family, and watches for a subchain whose route-key-like value from `0x0048aa70`, signature word `+0x22e`, or boolean class byte `+0x44` no longer matches the source tracker. When that mismatch survives the surrounding guards, it allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, seeds or binds the moved entries through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90` and `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, reassigns the traversed route entries through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalances the two trackers' counts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`, where this helper runs as the early split prepass keyed by the current route entry's tracker id. This now looks like the chain-splitting helper that carves a mismatching adjacent subchain into one fresh tracker group rather than a generic collection walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + regrouping prepass correlation"
+0x004a45f0,1420,aux_route_entry_tracker_collection_refresh_route_entry_group_membership,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy regrouping pass over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper starts from one route-entry record, rejects the trivial case where both adjacent route-entry fields `[entry+0x206]` and `[entry+0x20a]` are unset, optionally runs `aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group` `0x004a4380` keyed by the route entry's current tracker id in `[entry+0x212]`, and then refreshes ownership around that id. On the simpler branch it can allocate one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, bind one or more route-entry ids into it through `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, assign the resulting tracker id back into route-entry field `+0x212` through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalance tracker refcounts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. The current endpoint-bind semantics are tighter now too: the bind helper groups entries only when their route-key-like value from `0x0048aa70`, route-entry signature word `+0x22e`, and boolean class latch derived from byte `+0x44` all agree. On the larger branch this pass walks adjacent route-entry links through the `+0x206/+0x20a/+0x20e` family, can re-enter `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate compatible neighboring subchains between tracker groups, uses `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` to rewrite compatible endpoint slots, and can re-enter the nearby cached-match refresh path `0x00495020` before dropping empty tracker records through the collection vtable. Current grounded caller is `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where this pass runs immediately after literal-policy-`2` route-anchor rebuild and bind. This now looks like the auxiliary tracker regrouping pass beneath the broader linked-site route-anchor rebuild lane rather than a generic collection sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + linked-site refresh correlation + endpoint-match-tuple correlation + chain-transfer correlation"
+0x004a4c00,224,aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate,map,thiscall,inferred,objdump + callsite inspection + field-layout inspection,3,"Compatibility gate used before adjacent tracker-chain transfers. Given two route-entry records, the helper validates both current tracker ids in the auxiliary tracker collection at `0x006cfcb4`, resolves the two tracker records, and then requires a matching cached comparison tuple across both trackers: byte `+0x1d` must be nonzero on both sides, dwords `+0x18` and `+0x1e` must match, and boolean latch byte `+0x1c` must match. It also requires both candidate route entries to keep their special side fields at `+0x20e` and `+0x222` unset at `-1`. Only when all of those checks pass does it return `1`; otherwise it returns `0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links` `0x004a6360`, where this gate sits directly above the adjacent-chain transfer helper `0x004a4ce0`. This now looks like the reusable adjacent-chain transfer compatibility gate rather than a generic pairwise predicate.","objdump + callsite inspection + field-layout inspection + tracker-family correlation + transfer-gate correlation"
+0x004a4ce0,777,aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Reusable cross-group migration helper beneath the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids plus one cached match tuple, the helper first verifies that collection-busy latches are clear, validates the destination tracker's cached fields at `+0x18/+0x1c/+0x1d/+0x1e`, then walks one adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family while using `aux_route_entry_tracker_contains_endpoint_entry_id` `0x00494ed0` to avoid trampling the destination tracker's existing endpoint entries. Compatible traversed entries are reassigned into the destination group through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, source and destination tracker populations are rebalanced through `aux_route_entry_tracker_collection_adjust_refcount_or_destroy` `0x004a4340` and the raw `+0x14` count field, and the destination endpoint slots can be rewritten through `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` before any emptied source tracker is destroyed. Current grounded callers include the owner-refresh family at `0x004a6360` plus neighboring route-state branches at `0x0049ac78`, `0x0049ff6e`, and `0x004a645a..0x004a65a3`. This now looks like the adjacent-chain transfer helper between compatible tracker groups rather than a generic collection mutator.","objdump + caller xrefs + callsite inspection + tracker-family correlation + adjacent-chain transfer correlation"
+0x004a4ff0,454,aux_route_entry_tracker_collection_reseed_group_from_route_entry_component,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repair or reseed helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. Starting from one route-entry id whose current tracker membership is missing or invalid, the helper allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, assigns that tracker id into the starting entry through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, walks the connected route-entry component through `0x0048e140` and `0x0048e160`, and migrates each adjacent member that still carries the stale tracker id into the new group while counting the moved entries. It then updates the involved tracker populations, binds the new component's endpoint entries back into the fresh tracker through two calls to `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, and returns. Current grounded callers include the route-state repair branch at `0x0048b896` and the broader tracker traversal pass at `0x004a6244`. This now looks like the component-level tracker-group reseed helper used when a route-entry component has lost valid tracker ownership rather than a generic regrouping walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + reseed correlation"
+0x004a5fc0,928,aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide traversal refresh for the auxiliary route-entry tracker family at `0x006cfcb4`. The helper clears the collection dirty latch at `[this+0x8c]`, allocates one temporary queue array at `[this+0x94]`, resets every live tracker's traversal label field at `+0x0c` to `-1`, and then repeatedly walks connected tracker groups until every live record has one stable component label. While traversing, it destroys dead tracker records whose active count has fallen nonpositive, follows adjacent route-entry links outward from each tracker endpoint through the `+0x206/+0x20a/+0x20e` route-entry family, and when one neighboring route entry carries an invalid tracker id it repairs that side immediately through `aux_route_entry_tracker_collection_reseed_group_from_route_entry_component` `0x004a4ff0` before continuing the walk. The refreshed component labels are stored back into tracker field `+0x0c`, and neighboring collection-side queries reuse them after the dirty latch has been cleared. Current grounded callers are the adjacent tracker-query helper at `0x004a6320` and neighboring owner-refresh branches that first test `[this+0x8c]` before trusting cached component labels. This now looks like the collection-wide connected-component refresh and invalid-group reseed pass rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + traversal-label correlation + reseed correlation"
+0x004a6360,592,aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Owner-side adjacent-group refresh beneath the auxiliary route-entry tracker family at `0x006cfcb4`. Starting from one owner route-entry id, the helper validates the current tracker, requires its tracker-side enable byte `+0x1d` to be nonzero, resolves the two bound endpoint entries from tracker slots `+0x04` and `+0x08`, and first requires those endpoint entries to agree on the boolean class state derived from route-entry byte `+0x44`. It then inspects adjacent route-entry links hanging off both endpoint sides through the `+0x206/+0x20a` family and, whenever a neighboring route entry belongs to a different tracker group, runs `aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate` `0x004a4c00` before re-entering `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate that compatible adjacent chain into the owner's tracker group. Current grounded caller is `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0`, which invokes this helper only when the tracker's boolean class latch at `+0x1c` changes. This now looks like the owner-adjacent compatible-group refresh path triggered by latch changes rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-refresh correlation + compatibility-gate correlation"
+0x004a62c0,79,aux_route_entry_tracker_query_tracker_component_labels_match,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Small dirty-aware equality test over tracker component labels in the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids, the helper first refreshes stale labels through `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when collection dirty latch `[this+0x8c]` is set, resolves both tracker records, and returns `1` only when both ids are live and tracker field `+0x0c` matches across the pair. Invalid tracker ids return `0`. Current grounded callers include the alternate recursive pair-metric branch at `0x004a5900`, where this helper gates same-component recursion before adjacent-neighbor expansion.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label equality correlation"
+0x004a6320,64,aux_route_entry_tracker_collection_query_component_label_by_tracker_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Dirty-aware query helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper first checks collection dirty latch `[this+0x8c]` and re-enters `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when the cached component labels are stale. It then validates the caller-supplied tracker id through the collection, resolves the live tracker record, and returns the connected-component label stored in tracker field `+0x0c`; invalid tracker ids return `-1`. Current grounded callers are the heavier pair-selection family around `0x004a6630`, where this helper is the reusable query side of the component-label sweep rather than another traversal owner.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label query correlation"
+0x004a65b0,128,aux_route_entry_tracker_dispatch_route_entry_pair_metric_query,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Version-switched lower metric query beneath the auxiliary route-entry tracker pair-selection family. The helper forwards one fixed route-entry pair, one companion output pair, and the surrounding score or scratch arguments into one of two heavier internal algorithms: it dispatches to `0x004a5280` when the shared build-version query at `runtime_query_hundredths_scaled_build_version` `0x00482e00(0x006cec74)` reports at least `0x67`, and otherwise dispatches to `0x004a5900`. The recovered cutovers now line up with executable build values `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`, so this branch is no longer best-read as a time or era gate. Current grounded caller is the broader chooser at `0x004a6630`, which can invoke this helper repeatedly across multiple endpoint combinations, keep the smallest non-`-1` returned score, and publish the chosen route-entry pair through out pointers. Current evidence is therefore tight enough to treat this as the reusable route-entry-pair metric dispatcher beneath that chooser, while the exact algorithm split between the `0x004a5280` and `0x004a5900` branches remains open.","objdump + caller xrefs + callsite inspection + tracker-family correlation + pair-metric correlation + version-gate correlation"
+0x004a5280,1664,aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation"
+0x004a5900,1728,aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan.","objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation"
+0x004a6630,892,aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation"
 0x004a9460,65,train_current_route_context_uses_strict_reachability_mode,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open.","objdump + caller xrefs + callsite inspection + route-context correlation"
 0x004a94b0,381,train_finalize_aux_route_entry_buffer_preserving_subflags,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,3,"One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open.","objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation"
 0x004ab980,760,train_set_route_operating_mode_and_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open.","objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation"
@ -207,7 +253,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004baef0,2793,shell_building_detail_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,4,"Primary refresh path for the shell-side `BuildingDetail.win` family. The helper rebuilds the top-level control bands under `0x7d02..0x8051`, including the paired mode switch `0x7d02/0x7d03` from subject flag `0x40`, the smaller special-service toggles `0x7d0f/0x7d10` from subject bits `0x20` and `0x10`, the current-selection status widget around `0x7d0d/0x7d0e`, the selected-building cargo or service rows through `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`, the paired subject-value rows through `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20`, and the flagged service or capability rows through `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current control-building correlation now makes the leading special-row bands explicit too: the short-label triplet `0x7dc8..0x7dca`, its adjacent asset/icon triplet `0x7e90..0x7e92`, and the popup/selectable triplet `0x7f58..0x7f5a` are the fixed express-side branch before the broader ordinary candidate rows. Current branch structure is tighter too: when subject bit `0x40` is set the refresh ends on the selected-subject cargo/service family rooted at `0x004ba3d0`, while the clear branch instead ends on the flagged capability-selector family rooted at `0x004b9a20`. It also hides or shows the larger control ranges `0x7dc8..0x7f57`, `0x7f58..0x801f`, and `0x8020..0x8051` through the shared shell control toggles at `0x53fe00`. Current grounded callers are the main constructor-side and focus refreshes at `0x004bbace`, `0x004bc0cc`, and `0x004bc0de`, and the message dispatcher at `0x004bb9e0`.","objdump + caller inspection + control-range inspection + subject-flag correlation + helper-family correlation + branch-end correlation + control-family triplet correlation"
 0x004bc0a0,71,shell_building_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `BuildingDetail.win` object later published at `0x006cfe00`. The constructor seeds the local vtable at `0x005d05e0`, binds the window resource through `0x0053fa50`, and immediately refreshes the visible subject and control bands through `0x004baef0`. Current grounded caller is `shell_open_or_focus_building_detail_window` at `0x004bc100`, and current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + singleton correlation"
 0x004bc100,203,shell_open_or_focus_building_detail_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `BuildingDetail.win` singleton. The caller supplies the building-detail list helper in `ECX`, one current building subject in `EDX`, and one selected ordinal on the stack. The helper seeds the shared family globals at `0x006cfe04`, `0x006cfe08`, and `0x00621df4`, validates that the supplied building subject resolves to one live world object through the placed-structure collection at `0x006cec20`, allocates a `0x78`-byte shell object when no detail window is live, constructs it through `shell_building_detail_window_construct` at `0x004bc0a0`, publishes it through the shell runtime at `0x006d401c`, and tears it back down on return while clearing `0x006cfe00`. Current grounded callers include the world-side branch around `0x004bbace`, which updates the current building subject before opening this detail family. Current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + publish-path inspection + singleton correlation"
-0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]`, can run one preliminary branch through `0x00437743`, and then advances through a more bounded staged setup sequence with shell progress updates through `0x004834e0`. The visible banner order is now grounded from the direct string ids in the function body: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs world_compute_transport_and_pricing_grid at `0x0044fb70`, the early collection pass world_setup_building_collection_phase at `0x0041ea50`, and the conditional region pair world_region_collection_seed_default_regions at `0x00421b60` plus world_region_border_overlay_rebuild at `0x004882e0`; only after those complete does the pipeline post id `319` `Setting up Players and Companies...`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair world_seed_default_chairman_profile_slots at `0x004377a0` plus world_build_chairman_profile_slot_records at `0x00437220`, but current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths; `[0x006cec74+0x174]` is the direct building-population gate above id `320` `Setting Up Buildings...` and world_region_collection_run_building_population_pass at `0x00421c20`; `[0x006cec74+0x178]` is the direct seeding-burst gate above id `321` `Seeding Economy...` and simulation_run_chunked_fast_forward_burst at `0x00437b20`; and id `322` `Calculating Heights...` finishes through `0x0044d410`. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation"
+0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]`, can run one preliminary branch through `0x00437743`, and then advances through a more bounded staged setup sequence with shell progress updates through `0x004834e0`. The visible banner order is now grounded from the direct string ids in the function body: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs world_compute_transport_and_pricing_grid at `0x0044fb70`, the early collection pass world_setup_building_collection_phase at `0x0041ea50`, and the conditional region pair world_region_collection_seed_default_regions at `0x00421b60` plus world_region_border_overlay_rebuild at `0x004882e0`; only after those complete does the pipeline post id `319` `Setting up Players and Companies...`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair world_seed_default_chairman_profile_slots at `0x004377a0` plus world_build_chairman_profile_slot_records at `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths; `[0x006cec74+0x174]` is the direct building-population gate above id `320` `Setting Up Buildings...` and world_region_collection_run_building_population_pass at `0x00421c20`; `[0x006cec74+0x178]` is the direct seeding-burst gate above id `321` `Seeding Economy...` and simulation_run_chunked_fast_forward_burst at `0x00437b20`; and id `322` `Calculating Heights...` finishes through `0x0044d410`. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation"
 0x00435630,648,scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables,map,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book payload at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared maximum annual production float that precedes the first line, counts active lines across five repeated `0x30`-byte line records, and then imports those five lines into one parallel runtime array of `0xbc`-byte descriptors. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves nonempty cargo strings through the global cargo collection at `0x0062ba8c`, and builds paired runtime halves for the mode families `2/3` and `1/3`. Current mode gating is now tight enough to treat the polarity as grounded rather than provisional: the source token at `line+0x08` is the supplied-cargo field because it is the branch activated for `Supply Only` and `Production Demand->Supply`, while the source token at `line+0x1c` is the demanded-cargo field because it is the branch activated for `Demand Only` and `Production Demand->Supply`. The constructor and handler now tighten the amount semantics too: `line+0x04` is the per-line annual-demand field only in mode `1`, but it becomes the annual-supply field in modes `2/3`. The importer matches that split by copying `line+0x04` directly into the supply-side runtime half for modes `2/3`, while the production-mode demand half is normalized to `1.0` rather than reusing the entered amount. That makes the five editor-side row entries look like generic cargo-line slots rather than five fixed named production roles. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`.","objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation"
 0x00437b20,218,simulation_run_chunked_fast_forward_burst,simulation,thiscall,inferred,objdump,3,"Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `0x006cec74+0x178` and active-mode flag `[0x006cec78+0x4af7]`, then repeatedly advances the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path.","objdump + caller context + RT3.lng strings + phase ordering"
 0x00434680,435,world_set_game_speed_mode,simulation,thiscall,inferred,objdump + strings,3,"Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.`","objdump + RT3.lng strings + multiplayer handoff"
@ -346,6 +392,50 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004c5b99,428,shell_company_detail_bankruptcy_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` bankruptcy action flow. The branch checks the localized cooldown and eligibility strings `965` through `967`, rejects requests when the selected company is not yet bankruptable, and on acceptance commits the change through `company_declare_bankruptcy_and_halve_bond_debt` at `0x00425a90`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + bankruptcy-dialog correlation"
 0x004c5fc9,659,shell_company_detail_buy_territory_access_rights_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` territory-access purchase flow for the currently selected territory. The branch first resolves the selected territory from the territory-summary controls rooted at `0x948c..0x948e`, requires that the detail panel is still showing the current chairman-owned company, then splits cleanly by access state. When the company lacks rights but the territory is purchasable, it computes the access-rights price through `0x004879f0`, shows localized id `961` when purchase is possible, id `962` when cash is insufficient, and id `963` when rights cannot be purchased at all. Accepting id `961` commits the change through `company_set_territory_access_rights_byte` at `0x00424030` and the cash-side mutation at `0x0042a040`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + territory-access branch correlation"
 0x004c98a0,880,shell_open_custom_modal_dialog_with_callbacks,shell,cdecl,inferred,objdump + caller inspection,4,"Generic shell modal opener for callback-driven custom dialogs. The helper snapshots the current detail-owner context, stores one caller-supplied mode or prompt token at `0x00621f40`, stores one optional custom control callback or row-owner token at `0x006cfeb0`, allocates a shared `0xa0`-byte modal object with vtable `0x005d0a04`, and seeds it through the lower constructor at `0x004c86c0` using the caller's custom message, setup, and render callbacks plus the surrounding button or style parameters. When the optional callback slot is present it also binds that callback onto control `0x03ed`. The same helper temporarily pushes shell modal state through `0x0053f000`, enters the visible modal loop through `0x00538f10`, and then tears the object back down while restoring the surrounding shell or world presentation state. Current grounded callers include the CompanyDetail finance dialogs for bond issue, stock issue, stock buyback, and dividend changes, plus `multiplayer_open_staged_text_entry_dialog` at `0x004ee0e0`.","objdump + caller inspection + modal-lifecycle correlation"
+0x004d57c0,540,shell_event_conditions_window_construct,shell,thiscall,inferred,objdump + EventConditions.win string xref + control-binding inspection,3,"Constructs the shell-side `EventConditions.win` window. The constructor installs vtable `0x005d0cd4`, binds `EventConditions.win` through `0x0053fa50`, stores the incoming live event record pointer at `[this+0x84]`, seeds the selected condition row id at `[this+0x78]` plus the adjacent subselector at `[this+0x7c]`, binds the condition-row action callbacks at `0x004d5790` and `0x004d57b0`, and then populates the visible controls and status rows through the same window-local refresh path. Current grounded string xref is direct at `0x004d5803`, which makes this the clean owner for the conditions window rather than just another anonymous scenario dialog.","objdump + EventConditions.win string xref + control-binding inspection + state-field correlation"
+0x004d59e0,166,shell_event_conditions_window_handle_message,shell,thiscall,inferred,objdump + EventConditions.win vtable slot + local disassembly,3,"Primary shell-message dispatcher bound in vtable slot `0x005d0cd8` for `EventConditions.win`. The handler switches on incoming shell messages `0xc9`, `0xca`, and the callback-style `0x04` path, remaps the constructor-bound callback controls at `0x4f73` and `0x4fd1` into the `0xc9` branch after validation through `0x004d54d0`, and dispatches the window-local command strip rooted at ids such as `0x4fb4..0x509c` through helpers like `0x004d4560`, `0x004d4838`, and `0x004d4d10`. Current direct evidence is the `EventConditions.win` vtable at `0x005d0cd4`, whose second slot points to `0x004d59e0`, so this is the clean message owner for the conditions window rather than just another small callback helper.","objdump + EventConditions.win vtable slot + local disassembly + callback-remap correlation"
+0x004d5d00,605,shell_event_effects_window_refresh_effect_type_selector,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Selector refresh beneath `EventEffects.win`. The helper rebuilds the effect-type list control rooted at `0x4fb2` from the static descriptor family starting near `0x006103e7`, filters entries by the current availability or permission state from control `0x5033`, selects the best current row by the descriptor float lane, and republishes the chosen effect-type index through `[this+0x7c]` plus the visible selector control state. Current grounded callers are the effects-window constructor `0x004d6d60`, the message dispatcher `0x004d7060`, and the selected-editor refresh family under `0x004d6090`, so this is now the safest current owner for the effect-type selector rather than an anonymous table walk.","objdump + EventEffects.win constructor and handler correlation + local disassembly + selector-table correlation"
+0x004d5f50,320,shell_event_effects_window_refresh_selected_effect_parameter_rows,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Parameter-row refresh beneath `EventEffects.win`. The helper reads the current effect-type index at `[this+0x7c]`, consults the compact descriptor tables rooted at `0x004d5fde` and `0x004d600a`, and then repaints the grouped parameter-label or parameter-enable rows through the generic control path under control family `0x4ff6` plus the smaller row-style helper `0x004d5f83`. Current grounded callers are the effects-window constructor `0x004d6d60`, the message dispatcher `0x004d7060`, and the heavier editor refresh at `0x004d6090`, so this is the safest current read for the selected-effect parameter-row repaint rather than another anonymous row helper.","objdump + EventEffects.win constructor and handler correlation + local disassembly + parameter-table correlation"
+0x004d6090,1752,shell_event_effects_window_refresh_selected_staged_effect_editor_panels,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Heavier editor refresh beneath `EventEffects.win`. The helper first resets the smaller grouped parameter rows through `0x004d5f83`, then interprets the currently staged effect row at `[this+0x78]` by reading opcode byte `+0x08`, scalar dword `+0x04`, grouped value lanes `+0x09` and `+0x0d`, and the bounded numeric fields `+0x11`, `+0x12`, `+0x14`, and `+0x16`. It uses that staged row plus the current effect-type descriptor state at `[this+0x7c]` to repaint the main effect-editor controls rooted at ids such as `0x4fc7`, `0x4fce`, `0x4ff6`, `0x4ff9`, `0x4ffc`, `0x5041`, `0x5044`, `0x5046`, and `0x5047`, including the numeric-entry affordances, sign or comparator toggles, and the type-specific parameter bands. Current grounded callers are the effects-window constructor `0x004d6d60` and message dispatcher `0x004d7060`, which keeps this as the clearest current owner for staged effect-editor repaint rather than a generic event formatter.","objdump + EventEffects.win constructor and handler correlation + local disassembly + staged-row-field correlation"
+0x004d77b0,251,shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Refreshes the grouped-effect summary band affordances beneath `EventConditions.win`. The helper checks whether selected-event mode control `0x4e8f` is active and whether the current selector rooted at `0x5000` resolves to control `0x5002`; only on that branch does it enable the grouped summary-band controls `0x4fed..0x4ff0`, otherwise it disables that four-control band with style `0x87`. Current grounded callers include the mode-dependent detail-row switch `0x004d9390` and nearby condition-window refresh tails around `0x004d9970` and `0x004daf40`, so this is the safest current read for grouped summary-band affordance refresh rather than another anonymous style helper.","objdump + caller xrefs + local disassembly + grouped-band-control correlation + selector-gate correlation"
+0x004d7ef0,301,shell_event_effects_window_refresh_event_selector_list_and_selected_event_id,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Event-selector refresh beneath the broader event editor family. The helper clears the current selected event id at `[this+0x84]`, the visible row count at `[this+0x90]`, and the adjacent selection latches at `[this+0x88]` and `[this+0x8c]`, then iterates the live event collection `0x0062be18` to populate the visible selector control rooted at `0x4e84` with each event name from `+0x18` plus the paired count field at `+0x14`. When at least one live event exists it republishes the chosen event id through `[this+0x84]` and enables the list-selection affordance on control `0x4e84`. Current grounded caller is the effects-side command family near `0x004dbb35`, which makes this the safest current owner for event-list selector refresh rather than a generic event walk.","objdump + caller correlation + local disassembly + event-collection iteration correlation"
+0x004d8120,1968,shell_event_conditions_window_refresh_condition_row_list_panel,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Heavier row-list refresh beneath `EventConditions.win`. The helper resolves the currently selected live event through `[this+0x84]`, walks the standalone condition-row list rooted at `[event+0x00]`, and repaints the condition-row panel rooted at `0x4eaf` by formatting special sentinel rows `-1` and `-2` through fixed localized ids `0x47e` and `0x47f` while ordinary rows derive their caption and comparator text from the condition tables rooted near `0x005f3de3` and `0x004d88cc`. The same pass also rebuilds the current selected-row index at `[this+0x94]`, maintains the per-row seen bitmap on the stack, and republishes the current selection row list through the generic control path before the surrounding condition-window refresh continues. Current grounded callers are the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, so this is the safest current owner for condition-row list repaint rather than a generic formatter.","objdump + caller correlation + local disassembly + condition-row-list correlation"
+0x004d88f0,1115,shell_event_conditions_window_refresh_selected_grouped_effect_row_list_panel,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation,3,"Grouped effect-row list refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]` to walk the grouped `0x28`-byte row list anchored at `[event + group*4 + 0x04]`, clears list control `0x4ed5`, and resets selected grouped row index `[this+0x98] = -1` before rebuilding the visible row band. Formatting is now tighter than a generic list repaint: ordinary grouped rows flow through the effect descriptor table at `0x006103a0` and RT3.lng `1154..1159` to build `Set %1 to FALSE/TRUE`, timed `for %1 months/years`, and scalar assignment lines, while opcode byte `+0x08 == 8` takes the wider multivalue path over fields `+0x11/+0x12/+0x14/+0x16` before publishing the finished text into `0x4ed5`. The helper finishes by re-enabling `0x4ed5` with active style when the selected grouped list is nonempty. Current grounded callers are the selected-event refresh family `0x004db120/0x004d9390/0x004dbf93` plus grouped effect add, edit, and remove verbs `0x004da7c0/0x004da860/0x004da920`, so this is the safest current read for selected grouped-effect row-list repaint rather than an anonymous formatter.","objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation + grouped-list-anchor correlation"
+0x004d8d50,320,shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small commit helper beneath `EventConditions.win` that snapshots the current grouped-effect summary editor state back into the selected live event before the grouped selector changes. The helper resolves the selected event through `[this+0x84]`, uses current grouped index `[this+0x9c]`, samples control `0x500a` into event byte lane `[event + group*4 + 0x7ff]`, maps the hidden mutually exclusive selector family rooted at `0x5006` into ordinal byte `[event + group + 0x7fb] = 0..8`, and stores current local selector state `[this+0x8c]` into event dword lane `[event + group*4 + 0x80f]`. The ordinal mapping is now explicit in the commit-side jump table: controls `0x5006..0x500e` store values `0..8`, and the refresh side later maps those same ordinals one-to-one onto visible controls `0x5014..0x501c`. Current evidence therefore reads `0x5006..0x500e` as the hidden canonical selector family and `0x5014..0x501c` as its visible display mirror, not as two distinct semantic families. The strongest current RT3.lng fit for the stored scope family is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`. Current grounded caller is the grouped-band dispatcher case at `0x004dbf93`, so this is the safest current read for grouped-effect summary-state commit before group switch rather than a generic editor helper.","objdump + caller xrefs + local disassembly + grouped-selector-state correlation + ordinal-mapping correlation + RT3.lng correlation"
+0x004d8ea0,1165,shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selected-event commit helper beneath `EventConditions.win` that snapshots the currently visible mode-strip text panels back into the live event record before selection, grouped-action, or grouped-band changes. The helper resolves the selected live event through `[this+0x84]`, samples active controls `0x4e8e`, `0x4e8f`, `0x4ed9`, `0x4edb`, `0x4edd`, and `0x4e91`, and uses those active-state checks to rewrite event mode byte `[event+0x7ee]` plus the fixed text bands at `[event+0x0e0]`, `[event+0x401]`, `[event+0x4ca]`, `[event+0x593]`, `[event+0x65c]`, and `[event+0x725]` from the current shell control payloads. Current grounded callers are selected-event previous and next navigation `0x004db520/0x004db5e0`, the selected-event id setter `0x004db6a0`, and the grouped-action selector case at `0x004dbfca`, so this is the safest current read for committing current selected-event text panels before selection change rather than another repaint helper.","objdump + caller xrefs + local disassembly + event-text-band correlation + selection-change correlation"
+0x004d91e0,343,shell_event_conditions_window_commit_selected_event_summary_headers_and_group_mode,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Selected-event summary-header and grouped-mode commit helper beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, snapshots the active modifier bands rooted at `0x4fd7` and `0x4fd8` into event bytes `[event+0x7f9]` and `[event+0x7fa]`, stores the inverted toggle state of control `0x4e93` into event byte `[event+0x800]`, writes summary header control `0x4ead` into event dword `[event+0x7f5]`, mirrors window field `[this+0x88]` into event dword `[event+0x7f0]`, re-enters `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, and then commits one grouped-mode choice from controls `0x4eca/0x4ecb/0x4ecc` into event byte `[event+0x7f4]`. Current grounded caller is the broader selected-event strip refresh at `0x004db120`, so this is the safest current read for committing selected-event summary headers and grouped mode rather than another grouped-action helper.","objdump + local disassembly + caller correlation + control-band correlation + event-record-field correlation"
+0x004d9360,43,shell_event_conditions_window_remove_selected_event_and_refresh_selector,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Delete verb for the selected live event beneath `EventConditions.win`. When `[this+0x84]` holds a valid event id, the helper resolves collection `0x0062be18`, removes that live event through the collection vtable delete slot, and then immediately rebuilds the visible event selector through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`. Current grounded dispatcher caller is control `0x4e8a` through `0x004dbc48`, so this is the safest current read for selected-event deletion and selector refresh rather than a generic collection wrapper.","objdump + local disassembly + dispatcher correlation + collection-delete correlation"
+0x004d9390,1504,shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Mode-dependent detail-row switch beneath `EventConditions.win`. The helper samples which selected-event mode button is active across controls `0x4e8f`, `0x4e90`, `0x4e91`, and `0x4e92`, then shows or hides the corresponding detail-row families rooted at `0x4ed7..0x4edd` and `0x4fdb..0x4fe6` through the generic shell control path. The same pass also re-enters `shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances` `0x004d77b0`, resets grouped selection field `[this+0x9c]` when the chosen mode does not keep it, refreshes the grouped row list through `0x004d88f0`, and toggles the trailing affordance at `0x4fed`. Current grounded callers are the selected-event strip refresh `0x004d9f50`, the broader condition-window dispatcher `0x004dbb80`, and one nearby secondary dispatcher at `0x004daf40`, so this is the safest current read for selected-event mode-dependent detail rows rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + mode-button correlation + detail-row-band correlation + grouped-band-affordance correlation"
+0x004d9970,925,shell_event_conditions_window_refresh_condition_class_summary_and_group_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Refreshes the condition-class summary and grouped-row affordance bands beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, queries the standalone condition-row aggregate flags through `scenario_event_query_standalone_condition_row_list_class_and_modifier_flags` `0x0042d700`, and then restyles the summary header or status rows rooted at `0x4eae`, `0x4eb4`, `0x4fd9`, `0x4fda`, `0x4ec0..0x4ec4`, and `0x4eb6..0x4eba`. Current local bit correlation is tighter than a generic status repaint: aggregate bit `0x01` drives the `0x4fd9` / `0x4ec0..0x4ec4` band, aggregate bit `0x02` drives the `0x4fda` / `0x4eb6..0x4eba` band, aggregate bit `0x04` drives the header pair `0x4eae` and `0x4eb4`, and the higher modifier bits `0x10` and `0x20` refine the style of `0x4ec1` and `0x4eb6`. Current RT3.lng adjacency now gives the strongest current player-facing fit for this whole branch too: selector `0x5001` above it reads as the `1573` `Test against...` side, with the grouped company and player target-family rows under `0x4ec0..0x4ec4` and `0x4eb6..0x4eba` aligning to the adjacent `1574..1592` company/player test-scope text family. Event byte `[event+0x7f4]` also gates one special affordance in each grouped band. Current grounded callers include the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, plus several surrounding condition-window refresh tails, so this is the safest current owner for the condition-summary and grouped-row repaint rather than a generic style loop.","objdump + caller xrefs + local disassembly + condition-aggregate correlation + grouped-band correlation + RT3.lng correlation"
+0x004d9d10,53,shell_event_conditions_window_refresh_selected_grouped_effect_territory_target_affordance,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small territory-target affordance refresh beneath `EventConditions.win` for the current grouped effect selection. The helper resolves the selected live event at `[this+0x84]`, queries grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, and enables control `0x500b` only when the returned flags include bit `0x04` and the neighboring controls `0x5019` plus `0x5002` are already active. Otherwise it disables the same affordance with style `0x87`. The strongest current label fit is that `0x5019/0x500b` are the RT3.lng `1619/1620` `to territories` lane, with `0x500b` carrying the stored territory-target parameter from `[event + group*4 + 0x80f]`. Current grounded callers are the broader condition-window refresh `0x004da0f0` and the main dispatcher `0x004dbb80`, so this is the safest current read for the selected grouped-effect territory-target affordance rather than a generic control-style toggle.","objdump + caller xrefs + local disassembly + grouped-flag correlation + control-enable correlation + RT3.lng correlation"
+0x004d67f0,456,shell_event_effects_window_commit_current_editor_state_into_staged_row,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Commit helper beneath `EventEffects.win` that normalizes the current editor controls back into the staged effect row at `[this+0x78]`. The helper stores the selected effect-type index from `[this+0x7c]` into row dword `+0x00`, rewrites opcode byte `+0x08` and scalar dword `+0x04` through the descriptor-driven mapper at `0x004d64a0`, preserves or clears the sign bit on the opcode byte as needed, and then refreshes the smaller boolean or numeric side fields before the staged row is ready for the higher-level window logic. Current grounded callers are the constructor `0x004d6d60`, the vtable-bound message dispatcher `0x004d7060`, and the smaller callback remap path around `0x004d70a2`, so this is the safest current read for editor-state commit into the staged effect row rather than another formatter.","objdump + EventEffects.win constructor and handler correlation + local disassembly + staged-row-commit correlation"
+0x004d6d60,763,shell_event_effects_window_construct,shell,thiscall,inferred,objdump + EventEffects.win string xref + control-binding inspection,3,"Constructs the shell-side `EventEffects.win` window. The constructor installs vtable `0x005d0cf4`, binds `EventEffects.win` through `0x0053fa50`, stores the incoming staged effect-row record at `[this+0x78]`, mirrors its key fields into the local window state at `[this+0x7c]` and the stack-built numeric caches used by the row editors, binds the grouped effect-row callbacks at `0x004d6d30`, and then repaints the visible controls through the same window-local refresh family. Current grounded string xref is direct at `0x004d6da5`, which makes this the clean owner for the effects window rather than a generic event editor child.","objdump + EventEffects.win string xref + control-binding inspection + staged-row-field correlation"
+0x004d7060,166,shell_event_effects_window_handle_message,shell,thiscall,inferred,objdump + EventEffects.win vtable slot + local disassembly,3,"Primary shell-message dispatcher bound in vtable slot `0x005d0cf8` for `EventEffects.win`. The handler switches on incoming shell messages `0xc9`, `0xca`, and the callback-style `0x04` path, remaps the constructor-bound callback controls at `0x4fb1` and `0x4fd4` into the `0xc9` branch, validates staged effect-row state through `0x004d67f0`, and dispatches the effect-window command strip rooted at ids such as `0x4fb3..0x5047` through the grouped-row and detail refresh helpers `0x004d5d00`, `0x004d5f50`, and `0x004d6090`. Current direct evidence is the `EventEffects.win` vtable at `0x005d0cf4`, whose second slot points to `0x004d7060`, so this is the clean message owner for the effects window rather than just the smaller callback lane.","objdump + EventEffects.win vtable slot + local disassembly + callback-remap correlation"
+0x004d9dc0,123,shell_open_event_conditions_modal_and_return_result,shell,cdecl,inferred,objdump + constructor call correlation + local disassembly,3,"Shared modal opener for `EventConditions.win`. The helper allocates an `0x88`-byte window object, constructs it through `shell_event_conditions_window_construct` `0x004d57c0` with the caller-supplied live condition row pointer plus the extra boolean argument, enters the common shell modal loop through `0x538f10`, then destroys and frees the modal object before returning the dialog result code. Current grounded callers are the add and edit condition-row verbs around `0x004da640` and `0x004da700`, which makes this the clean owner for condition-row modal launch rather than an anonymous allocator wrapper.","objdump + constructor call correlation + local disassembly + modal-loop correlation"
+0x004d9e40,120,shell_open_event_effects_modal_and_return_result,shell,cdecl,inferred,objdump + constructor call correlation + local disassembly,3,"Shared modal opener for `EventEffects.win`. The helper allocates an `0x80`-byte window object, constructs it through `shell_event_effects_window_construct` `0x004d6d60` with the caller-supplied staged effect-row pointer, enters the common shell modal loop through `0x538f10`, then runs the effect-window close tail at `0x004d5b90`, destroys the modal object, and returns the dialog result code. Current grounded callers are the add and edit grouped-effect verbs around `0x004da7c0` and `0x004da860`, which makes this the clean owner for the effect-row modal launch rather than another small wrapper.","objdump + constructor call correlation + local disassembly + modal-loop correlation"
+0x004d9ed0,116,shell_event_conditions_window_remove_selected_condition_row,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Remove verb beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses the current selected condition-row index at `[this+0x94]` to unlink one node from the standalone condition-row list rooted at `[event+0x00]`, frees the removed `0x1e`-row allocation through `0x53b080`, then refreshes the visible row list through `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120` and re-enters the surrounding condition-window repaint tail at `0x004d9970`. Current grounded caller is the conditions-side command family under `0x004dbcc3`, so this is the safest current read for selected condition-row deletion rather than a generic list unlink helper.","objdump + caller correlation + local disassembly + linked-list-unlink correlation"
+0x004d9f50,546,shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Refreshes the selected-event mode strip and summary text panels beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, republishes the boolean toggle on control `0x4e93` from event byte `[event+0x800]`, selects one mode button across `0x4e8f/0x4e90/0x4e91` from event byte `[event+0x7ee]`, and restyles the whole mode strip `0x4e8e..0x4e92` with the current active choice. It then re-enters `shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows` `0x004d9390` and republishes several dynamic-text controls from the current event record, including the main summary text at `[event+0x0e0]` into `0x4eac` and the later fixed text bands rooted at offsets `+0x4ca`, `+0x593`, and `+0x65c` into controls such as `0x4fdf`, `0x4fe0`, and `0x4fe1`. Current grounded callers are the broader conditions refresh family `0x004db120` and the main conditions-window dispatcher `0x004dbb80`, so this is the safest current read for the selected-event mode strip and summary-panel refresh rather than a generic text repaint.","objdump + caller xrefs + local disassembly + mode-strip correlation + dynamic-text-panel correlation"
+0x004da640,185,shell_event_conditions_window_append_default_condition_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Add verb beneath `EventConditions.win`. The helper allocates and zero-initializes one default `0x1e`-byte condition row, seeds row dword `+0x00` with default id `0x0e` plus row byte `+0x04` with subtype `4`, then opens the condition-row modal through `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0`. When the modal returns accept code `0x4f73`, the helper either appends the resulting row at the end of the current condition-row list or installs it as the first row on an empty event, then refreshes the visible list through `0x004d8120` and the surrounding condition-window repaint through `0x004d9970`. Current grounded caller is the conditions-side command family at `0x004dbca8`, which makes this the clean current owner for default condition-row creation rather than an anonymous allocator branch.","objdump + caller correlation + local disassembly + modal-return correlation"
+0x004da700,182,shell_event_conditions_window_edit_selected_condition_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Edit verb beneath `EventConditions.win`. The helper resolves the selected live event and selected condition-row index `[this+0x94]`, walks the standalone condition-row list to the chosen row, and opens the current row in the condition modal through `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0`. On accept code `0x4f73`, it writes the edited row back in place; one negative-id branch also duplicates the selected row into a fresh `0x1e` allocation before reinserting it at the head. The helper then refreshes the row list through `0x004d8120` and the surrounding condition-window repaint through `0x004d9970`. Current grounded caller is the conditions-side command family at `0x004dbcb1`, so this is the safest current read for selected condition-row edit rather than another raw list walk.","objdump + caller correlation + local disassembly + modal-return correlation"
+0x004da7c0,155,shell_event_effects_window_append_grouped_effect_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Add verb beneath `EventEffects.win`. The helper allocates and zero-initializes one default `0x28`-byte grouped effect row, seeds row dword `+0x00` with default opcode `2`, opens the effects modal through `shell_open_event_effects_modal_and_return_result` `0x004d9e40`, and on accept code `0x4fb1` appends the resulting row to the currently selected effect-group list anchor `[event + group*4 + 0x04]` using the active group index at `[this+0x9c]`. It then refreshes the grouped effect rows through `0x004d88f0` and re-enters the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbc84`, which makes this the clean current owner for grouped effect-row creation rather than another allocator stub.","objdump + caller correlation + local disassembly + grouped-list-append correlation"
+0x004da860,179,shell_event_effects_window_edit_selected_grouped_effect_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Edit verb beneath `EventEffects.win`. The helper resolves the selected live event, selected effect group `[this+0x9c]`, and selected row index `[this+0x98]`, copies the chosen `0x28`-byte grouped effect row into a stack staging buffer, and opens the effects modal through `shell_open_event_effects_modal_and_return_result` `0x004d9e40`. On accept code `0x4fb1` it writes the edited row back in place, then refreshes the grouped effect rows through `0x004d88f0` and the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbd02`, so this is the safest current read for selected grouped effect-row edit rather than another modal wrapper.","objdump + caller correlation + local disassembly + grouped-row-staging correlation"
+0x004da920,126,shell_event_effects_window_remove_selected_grouped_effect_row,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Remove verb beneath `EventEffects.win`. The helper resolves the selected live event, selected effect group `[this+0x9c]`, and selected row index `[this+0x98]`, unlinks one node from the chosen grouped effect-row list anchored at `[event + group*4 + 0x04]`, frees the removed `0x28`-byte allocation through `0x53b080`, then refreshes the grouped effect rows through `0x004d88f0` and the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbd1d`, so this is the safest current read for selected grouped effect-row deletion rather than a generic list helper.","objdump + caller correlation + local disassembly + grouped-list-unlink correlation"
+0x004da9a0,400,shell_event_conditions_window_refresh_current_grouped_effect_summary_state_from_selected_event,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation,3,"Selected grouped-summary state refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, mirrors event dword lane `[event + group*4 + 0x80f]` into local selector field `[this+0x8c]` and control `0x500b` when that stored value is nonnegative, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible target-scope display family `0x5014..0x501c`. The jump table is now explicit here too: ordinal `0..8` activates visible controls `0x5014..0x501c` one-to-one, which is the strongest current evidence that those visible rows are a display mirror over the hidden canonical selector family `0x5006..0x500e` rather than a second label-distinct mode family. Current strongest label fit for those stored ordinals is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`; each ordinal case then tails directly into the broader grouped-effect target-scope refresh at `0x004da0f0`. Current grounded callers are the selected-event strip refresh `0x004db120` and grouped-band selection tail `0x004dbf93`, so this is the safest current read for republishing the currently selected grouped summary state from stored event data rather than a generic control write loop.","objdump + local disassembly + grouped-summary-state correlation + ordinal-mapping correlation + RT3.lng correlation"
+0x004dab60,212,shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation + grouped-band dispatch-table decode,3,"Refreshes the selected grouped-effect target-scope strip beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, reads current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible display family `0x5014..0x501c`. The surrounding enable logic is tighter too: grouped effect-row type mask bit `0x08` gates `0x5015` (`whole game`), bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x02` gates the player-target trio `0x501a..0x501c`, and bit `0x04` gates the paired territory-target lane `0x500b/0x5019`. When the territory lane is absent the helper falls back to local selector state `[this+0x8c]` for `0x500b`; and when any target-scope lane is active it first tries to re-enable one hidden selector from `0x5006..0x500e`, falling back to the persisted control id in `0x00622074` only when no current visible target-scope display row is already active. Current code now makes the hidden/display split firmer too: `0x5006..0x500e` are the canonical hidden selectors stored by `0x004d8d50`, while `0x5014..0x501c` are the visible one-to-one mirror rows republished by `0x004da9a0` and styled here. The grouped-band `0x4dc09c` table keeps the remaining boundary explicit: visible rows `0x5014..0x501c` do not dispatch to the target-scope selector case directly; they only re-enter the smaller `0x004d9d10` territory-target affordance path on the `0xcf` side, so this helper remains the safest current owner for the actual stored target-scope refresh rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + ordinal-mapping correlation + persisted-selection correlation + RT3.lng correlation + grouped-band dispatch-table decode"
+0x004daf40,367,shell_event_conditions_window_reset_selected_event_summary_placeholders,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selection-bootstrap helper beneath `EventConditions.win` that clears and republishes the dynamic-text placeholder band when the selected event changes or no live event is currently active. The helper writes the same fixed placeholder text block rooted at `0x005c87a8` back into controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`, then repaints those controls through the generic shell path before the broader selected-event refresh continues. Current grounded callers are `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and the callback-binding bootstrap `0x004db6f0`, so this is the safest current read for selected-event summary placeholder reset rather than another local dispatcher fragment.","objdump + caller xrefs + local disassembly + placeholder-control correlation"
+0x004da0f0,1350,shell_event_conditions_window_refresh_controls,shell,thiscall,inferred,objdump + caller xrefs + EventConditions.win correlation + RT3.lng correlation + grouped-band dispatch-table decode,3,"Shared refresh pass for `EventConditions.win`. The helper resolves the currently selected live event record from collection `0x0062be18`, samples grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, then consults the adjacent runtime-condition helpers `0x0042dff0`, `0x0042df30`, `0x0042df70`, and `0x0042dfb0` to decide which condition rows should be enabled, disabled, or summarized through the condition-side controls rooted at ids such as `0x5005..0x501c`. The selector pair `0x5001/0x5002` now has a tighter split here: `0x5001` gates the standalone condition test-scope side consumed by `0x004d9970`, with RT3.lng `1573` `Test against...` now the strongest current label fit, while `0x5002` gates the grouped-effect target-scope side, with RT3.lng `1606` `Apply effects...` now the strongest current label fit. On that `0x5002` branch, when control `0x4ed5` is active and the current condition aggregates permit it, the helper builds dynamic-text control `0x5014` from RT3.lng `1160..1164`, yielding `to the company/player/player (i.e. chairman)/territory for which the condition is TRUE`; current RT3.lng correlation then gives the strongest current label fit for the remaining visible target-scope display rows as `0x5015 = to the whole game`, `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories` with a stored target parameter, and `0x501a..0x501c = to all/human/AI players`. The same pass now has a tighter mask split too: grouped effect-row type flag bit `0x08` gates `0x5015`, bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x04` gates the territory-target lane `0x500b/0x5019`, and bit `0x02` gates the player-target trio `0x501a..0x501c`. The grouped-band `0x4dc09c` table now keeps the interaction boundary honest too: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into the grouped target-scope selector case `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` route only to the smaller `0x004d9d10` affordance path. The same pass also re-enters `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, and the smaller territory-target affordance helper `0x004d9d10` before finishing the common window-side repaint tail. Current grounded callers sit in the surrounding event-condition message family near `0x004dbce0`, which makes this the safest current owner for condition-window refresh rather than only a one-off formatter.","objdump + caller xrefs + EventConditions.win correlation + condition-helper correlation + grouped-effect-flag correlation + RT3.lng correlation + grouped-band dispatch-table decode"
+0x004db120,1024,shell_event_conditions_window_refresh_selected_event_strip_and_navigation,shell,thiscall,inferred,objdump + local disassembly + caller xrefs + event-selector correlation,3,"Broad selected-event repaint beneath `EventConditions.win`. The helper first enables or disables the selected-event strip rooted at `0x4e84..0x5077` depending on whether `[this+0x84]` holds a live event id, seeds grouped selector `[this+0x9c]` to `0`, re-enables the first grouped summary band `0x4fed`, republishes the persisted grouped target-scope selector id from `0x00622074`, and then resolves the selected live event through collection `0x0062be18` before re-entering `0x004dab60`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120`, and the grouped-row refresh tail `0x004d88f0`. The same pass also republishes the fixed selected-event selector band `0x4e98..0x4ea2` from event byte `[event+0x7ef]`, the summary headers `0x4ead/0x4eae` from `[event+0x7f5]` and `[event+0x7f0]`, the modifier bands `0x4ec0..0x4ec4` and `0x4eb6..0x4eb9` from `[event+0x7f9]` and `[event+0x7fa]`, and the grouped-mode trio `0x4eca..0x4ecc` from `[event+0x7f4]`. The closing count check against `0x0062be18` also gates navigation controls `0x4e85` and `0x4e86`, so this is the safest current owner for selected-event strip and navigation refresh rather than a generic repaint tail.","objdump + local disassembly + caller xrefs + event-record-field correlation + grouped-selection-bootstrap correlation + navigation-control correlation"
+0x004db520,192,shell_event_conditions_window_select_previous_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Backward selected-event stepping verb beneath `EventConditions.win`. When `[this+0x84]` holds a live event id, the helper resolves the current event record, queries the neighboring live event id through collection helper `0x005184f0(..., 2)`, and when a valid predecessor exists it clears staged condition selection through `0x004d8ea0`, copies the stepped event id into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, and re-enters the broader selected-event repaint `0x004db120`. It finally republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the first event-strip navigation case at `0x004dbc5c`, so this is the safest current read for selected-event previous-step and refresh rather than a generic collection walk.","objdump + local disassembly + dispatcher correlation + event-selector-list correlation"
+0x004db5e0,192,shell_event_conditions_window_select_next_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Forward selected-event stepping verb beneath `EventConditions.win`. The helper mirrors `0x004db520`, but after querying the stepped event id through `0x005184f0(..., 2)` it rejects the end-of-strip sentinel when the returned ordinal reaches current field `[this+0x90]`, then commits the next live event into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the sibling event-strip navigation case at `0x004dbc70`, so this is the safest current read for selected-event next-step and refresh rather than another generic list walk.","objdump + local disassembly + dispatcher correlation + end-of-strip-sentinel correlation"
+0x004db6a0,80,shell_event_conditions_window_set_selected_event_id_and_refresh_if_open,shell,cdecl,inferred,objdump + local disassembly + callback-binder correlation,3,"Shared selected-event setter beneath `EventConditions.win`. The helper accepts one live event id in `edx`, checks whether the global conditions-window singleton at `0x006cff84` is either inactive or ready for refresh through `0x004d8ea0`, and then writes the requested event id into `[window+0x84]`, re-enters `0x004daf40` plus the broader selected-event repaint `0x004db120`, and mirrors the same id into pending field `0x00622070`. Current grounded caller is the event-selector callback bound on control `0x4e84` from `0x004db6f0`, so this is the safest current owner for selected-event id publish and refresh rather than a generic global setter.","objdump + local disassembly + callback-binder correlation + pending-selection-field correlation"
+0x004db6f0,1168,shell_event_conditions_window_bind_event_selector_callbacks_and_seed_pending_selection,shell,thiscall,inferred,rizin + local disassembly + callback-binding correlation,3,"Post-construction callback binder and pending-selection bootstrap for `EventConditions.win`. The helper installs callback-style bindings across the selected-event and summary controls, including the event selector `0x4e84` through `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and several summary bands through the window-local callback family rooted at `0x004d71b0`, `0x004d78d0`, `0x004d7950`, `0x004d7960`, `0x004d7970`, and `0x004d7980`. It then seeds the current event selection from pending id `0x00622070`, resets grouped selection `[this+0x9c]`, refreshes the smaller summary side through `0x004d7fe0`, rebuilds the event selector list through `0x004d7ef0`, re-enters `0x004daf40`, and finishes with the broader selected-event repaint `0x004db120`. Current grounded caller is the neighboring conditions-window bring-up branch at `0x004ce204`, so this is the safest current read for event-selector callback binding and pending-selection bootstrap rather than a generic constructor fragment.","rizin + local disassembly + callback-binding correlation + pending-selection-bootstrap correlation"
+0x004db8b0,718,shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + dispatcher correlation,3,"Selected-event add or clone helper beneath `EventConditions.win`. One caller-controlled boolean selects between a blank event path and a clone-selected-event path: boolean `0` seeds the modal text from localized ids `0x47a` and `0x47c`, while boolean `1` uses the current selected event name plus localized ids `0x47b` and `0x47c`. On accept the helper opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, creates and selects a new live event through `0x00432ea0`, optionally deep-copies the currently selected live event into that new record through `scenario_event_clone_runtime_record_deep_copy` `0x0042e050`, then rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters the broader selected-event repaint `0x004db120`, and republishes control `0x4e84`. Current grounded dispatcher callers are controls `0x4e87` and `0x4e88` through `0x004dbbfd` and `0x004dbc1e`, so this is the safest current read for blank-event append or selected-event clone via name modal rather than an effects-window refresh.","objdump + caller xrefs + local disassembly + dispatcher correlation + modal-name-flow correlation"
+0x004dba90,236,shell_event_conditions_window_rename_selected_event_via_name_modal,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Rename verb for the selected live event beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, copies the current name field `[event+0x18]`, opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x47d`, and on accept writes the edited name back into the live event record before rebuilding the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, restoring the selected id, re-entering `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishing control `0x4e84`. Current grounded dispatcher caller is control `0x4e89` through `0x004dbd6e`, so this is the safest current read for selected-event rename via name modal rather than another selector refresh tail.","objdump + local disassembly + dispatcher correlation + modal-rename correlation"
+0x004dbe7a,100,shell_event_conditions_window_open_choice_event_single_player_only_warning_modal,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + RT3.lng string correlation,3,"Small warning-modal branch beneath `EventConditions.win` reached from the `0x4ec6/0x4ec7` control pair. The helper first checks whether selected-event mode control `0x4e8f` is active, and only on that branch forces grouped-mode control `0x4eca` active before opening the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x0f2f` `3887`, whose grounded RT3.lng text warns that `Choice` events are single-player only and not allowed in multiplayer games. The branch does not otherwise mutate persistent event state, so this is the safest current read for a choice-event single-player-only warning modal rather than a grouped-action commit path.","objdump + local disassembly + switch-table decode + RT3.lng string correlation + mode-control correlation"
+0x004dbeeb,116,shell_event_conditions_window_publish_pending_shared_summary_text_triplet,shell,thiscall,inferred,objdump + local disassembly + switch-table decode,3,"Pending dynamic-text publish helper beneath `EventConditions.win` reached from control `0x4ed9` when global latch `0x006d07d8` is clear. The helper copies one current shell text payload into a local `0x7d0` buffer, republishes that same text into controls `0x4eac`, `0x4ed9`, and `0x4edb` through the generic type-`0x6f` dynamic-text path, and then clears `0x006d07d8`. This is therefore the safest current read for publishing one pending shared summary-text triplet rather than a generic selection refresh.","objdump + local disassembly + switch-table decode + dynamic-text-control correlation"
+0x004dbb80,1074,shell_event_conditions_window_dispatch_selected_event_strip_and_grouped_band_actions,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + control-id correlation + grouped-band dispatch-table decode,3,"Broader `EventConditions.win` command dispatcher above the selected-event strip and grouped-band controls. The helper switches on shell messages `0xca`, `0xcb`, and `0xcf`, then uses the decoded `0x4dc000`, `0x4dc018`, `0x4dc050`, and `0x4dc08c` tables to route control families rooted at `0x4e84..0x4ea1`, `0x4eac..0x4ed9`, and `0x4fed..0x501c`. The selected-event strip is now explicit on the `0xcb` side: controls `0x4e85/0x4e86` step previous or next events through `0x004db520/0x004db5e0`, `0x4e87/0x4e88` add a blank event or clone the selected event through `0x004db8b0(0/1)`, `0x4e89` renames the selected event through `0x004dba90`, and `0x4e8a` deletes it through `0x004d9360`. The `0xca` side also owns the selected-event mode strip rooted at `0x4e98..0x4ea1`, where the baseline band writes event byte `[event+0x7ee] = 0` before re-entering `0x004d9f50`, while control `0x4ea1` writes special mode `4` and then refreshes the same strip. The later grouped-band `0xcf` cases are now bounded more tightly by the `0x4dc09c` byte map: grouped summary controls `0x4fed..0x4ff0` route to `0x004dbf93`, selector pair `0x5001/0x5002` route to `0x004dbfca`, visible target-scope display rows `0x5014..0x501c` route only to `0x004dbf7f -> 0x004d9d10`, and the remaining `0x4ff1..0x5013` span falls through the default no-op case. This is therefore the safest current owner for selected-event strip and grouped-band action dispatch rather than leaving those bands distributed across unnamed case blocks.","objdump + local disassembly + switch-table decode + control-id correlation + grouped-band correlation + grouped-band dispatch-table decode"
+0x004dbfca,32,shell_event_conditions_window_select_grouped_effect_target_scope_mode_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + RT3.lng correlation,3,"Grouped target-scope mode selector case beneath `EventConditions.win` on the `0xcf` grouped-band path. The helper first commits the currently visible selected-event text panels through `shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change` `0x004d8ea0`, then refreshes the grouped-effect target-scope strip through `shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip` `0x004dab60`, and finally stores the clicked control id into global `0x00622074` so the same target-scope selector can be re-enabled during later selected-event bring-up at `0x004db120`. The `0x4dc09c` dispatch table now keeps the control family honest: this case is only reached by controls `0x5001` and `0x5002`, not by visible rows `0x5014..0x501c`. Current RT3.lng adjacency gives those two controls their strongest current player-facing fit too: `0x5001` is the condition-side `Test against...` mode and `0x5002` is the grouped-effect-side `Apply effects...` mode. This is therefore the safest current read for grouped target-scope mode selection and refresh rather than for the whole visible target-scope display family.","objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + persisted-selection correlation + RT3.lng correlation"
+0x004dbf93,55,shell_event_conditions_window_select_grouped_effect_summary_band_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Grouped-band selector verb beneath `EventConditions.win`. The helper first commits the current grouped-effect summary editor state through `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, stores the newly chosen grouped selector ordinal `control_id - 0x4fed` into `[this+0x9c]`, refreshes the visible grouped rows through `0x004d88f0`, re-enters the surrounding condition-window repaint through `0x004da0f0`, and then finishes with the smaller grouped summary tail at `0x004da9a0`. Current grounded dispatcher caller is the `0x4fed..0x4ff0` case family under `0x004dbb80`, so this is the safest current read for grouped-effect summary band selection and refresh rather than a generic selector write.","objdump + local disassembly + dispatcher correlation + grouped-band-selector correlation"
 0x004c8670,11,shell_mark_custom_modal_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with the shared callback-driven custom modal family rooted at `0x006cfeb4`. The helper stores `1` into `0x006cfeac`, which current nearby call patterns treat as the custom-modal refresh or service request latch after the lower constructor at `0x004c86c0` and opener `shell_open_custom_modal_dialog_with_callbacks` have published a live modal object. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"
 0x004c8680,14,shell_has_live_custom_modal_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared callback-driven custom modal family. The helper reads the live modal singleton at `0x006cfeb4`, returns `1` when that pointer is positive or nonnull, and returns `0` otherwise. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this branch now sits beside the `LoadScreen`, file-options, and other shell-window probes rather than any detached gameplay-only UI owner.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"
 0x004e1d60,1169,shell_load_screen_refresh_page_strip_and_page_kind_controls,shell,thiscall,inferred,objdump + descriptor-table decode + caller inspection,4,"Shared refresh helper beneath the shell-side `LoadScreen.win` family. The helper reads the active 13-byte page descriptor record at `0x006220a0 + page*0x0d` using current page id `[this+0x78]`, where the record now grounds as `{ page_kind_dword, title_string_id, back_link_page_dword, selected_company_header_flag_byte }`. It copies the descriptor kind into `[this+0x80]`, refreshes the page-strip and companion controls `0x3e80`, `0x3e81`, `0x3eee..0x3ef7`, `0x3ef8`, `0x3efb`, `0x3efc`, `0x3f0a`, `0x3f0b`, and `0x3f0e` through the generic shell control path at `0x00540120`, and applies page-specific row-band styling from current page-local row state `[this+0x7c]`, row count `[this+0x84]`, and stacked selection history `[this+0x0a0..0x118]`. The descriptor decode now also bounds control `0x3ef8` as the table-driven backlink affordance: page `0` keeps backlink `0`, page `1` backlinks to page `2`, page `8` backlinks to page `7`, page `0x0b` backlinks to page `0x0a`, and page `0x0d` backlinks to page `0x0c`. Current descriptor decode therefore keeps page `0` as kind `0`, title id `1200` `XXX`, backlink `0`, and header flag `0`; page `1` as company-overview kind `1` with backlink page `2`; page `8` as player-detail kind `3` with backlink page `7`; page `0x0b` as dormant train-detail title with backlink page `0x0a`; and page `0x0d` as dormant station-detail title with backlink page `0x0c`. Current grounded caller is `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`, which uses this helper after storing a new page or subject selection.","objdump + descriptor-table decode + caller inspection + control-style correlation + backlink-control correlation"
@ -449,7 +539,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00469700,27,multiplayer_preview_dataset_stage_selected_path,shell,thiscall,inferred,objdump + caller xrefs,3,Small Multiplayer preview-dataset helper that copies one caller-supplied selected path string into the dataset-local staging buffer at `[this+0x8f48]`. Current grounded callers feed it the active session-entry path from the live session list before later preview or launch-side dataset work.,objdump + caller xrefs
 0x00469720,221,multiplayer_preview_dataset_service_frame,shell,thiscall,inferred,objdump + caller xrefs,3,"Recurring shell-frame service for the Multiplayer preview dataset rooted at `0x006cd8d8`. When the gating global at `0x006cd910` and the dataset render target at `[this+0x9884]` are live it walks the active session list under `0x006d40d0`, formats one roster or status line per entry through the template at `0x005ce1ac`, and then pushes the accumulated text through the render/update helper at `0x005519f0` with fixed presentation parameters. The current grounded caller is `shell_state_service_active_mode_frame`, which makes this a shell-owned per-frame refresh path for multiplayer preview text rather than a transport I/O loop.",objdump + caller xrefs + strings
 0x0046b780,368,multiplayer_preview_dataset_service_launch_state_and_warn_out_of_sync,shell,thiscall,inferred,objdump + caller xrefs + strings + callsite inspection,4,"Services one higher-level launch or preview transition slice on the Multiplayer preview dataset rooted at `0x006cd8d8`. At entry it checks global `0x006cd91c` and, when armed, formats localized id `3879` `Out of Sync` through `0x5193f0` and pushes it into the shell status presenter at `0x5386e0` with timeout `0xbb8`; this is the current grounded owner of that string and it is not part of the station-detail overlay. The same helper then gates on preview and launcher globals `0x006cd8dc`, `0x006ce9b8`, `0x006ce9c4`, and shell-state latches under `0x006cec78`, drives one modal shell branch through `0x482150`, timestamps `[this+0x9058]`, chains the internal dataset-side helpers at `0x46af70`, `0x46b0c0`, `0x46ad80`, `0x46aeb0`, `0x469b00`, and `0x46a590`, and can finally relaunch into `shell_map_file_entry_coordinator` at `0x00445ac0` through staged buffer `0x006ce630`. Current grounded callers include the multiplayer-side service loop around `0x004373c5` and `0x00437435`, plus later shell-side branches at `0x00483638`, `0x00483d79`, and `0x00484054`.","objdump + caller xrefs + strings + callsite inspection + multiplayer-preview correlation"
-0x0046a6c0,307,multiplayer_session_event_publish_registration_field,shell,unknown,inferred,ghidra-headless,3,Switch-driven session-event callback that publishes one Multiplayer.win registration/status field into the destination builder passed on the stack. Depending on selector EDX it emits the local session name from `0x006cec74` the profile text at `0x006cd8d8+0x8e10` the constant `0x2328` the live session count from `0x006d40d0` the field at `[0x006d1270+0x3b6]` the active profile string at `[0x006cec7c+0x44]` or fixed strings such as `Initializing...` `openstaging` and `closedplaying`; unsupported selectors fall back to the fixed token at `0x005c87a8`.,ghidra + rizin + llvm-objdump + strings
+0x0046a6c0,307,multiplayer_session_event_publish_registration_field,shell,unknown,inferred,ghidra-headless + objdump,3,"Switch-driven session-event callback that publishes one Multiplayer.win registration or status field into the destination builder passed on the stack. Depending on selector `EDX` it now clearly includes the local executable version string through `runtime_query_cached_local_exe_version_string` `0x00482d80` on runtime root `0x006cec74`, the profile text at `0x006cd8d8+0x8e10`, the constant `0x2328`, the live session count from `0x006d40d0`, the field at `[0x006d1270+0x3b6]`, the active profile string at `[0x006cec7c+0x44]`, or fixed strings such as `Initializing...`, `openstaging`, and `closedplaying`; unsupported selectors fall back to the fixed token at `0x005c87a8`.","ghidra + rizin + llvm-objdump + strings + registration-field correlation"
 0x0046a830,194,multiplayer_session_event_retry_with_random_player_name,shell,unknown,inferred,ghidra-headless,3,Registration-side callback that increments the retry counter at `0x006cd984` and on early retries formats a randomized `RT3Player%d` name into `0x006ae0c0` sanitizes it into a local notification object notifies the current Multiplayer.win owner and forwards that object through multiplayer_transport_set_local_name. On the first retry it also routes request id `5` or `6` through multiplayer_set_pending_session_substate depending on the incoming status flag; after 25 retries it resets `0x006cd984` and `0x006cd974` and calls multiplayer_transport_reset_and_maybe_shutdown instead.,ghidra + rizin + llvm-objdump + strings
 0x0046a900,522,multiplayer_register_session_event_callbacks,shell,thiscall,inferred,ghidra-headless,4,Builds and registers the Multiplayer.win session-event callback table rooted at the local block on `[esp+0x28]`. The function seeds slots with multiplayer_session_event_forward_action1_request multiplayer_session_event_publish_pair_chat_template multiplayer_session_event_publish_action2_single_name multiplayer_session_event_publish_action2_pair multiplayer_session_event_forward_action4_request multiplayer_session_event_forward_action7_request multiplayer_session_event_noop_12byte_stub multiplayer_session_event_publish_registration_field multiplayer_session_event_publish_status_value multiplayer_session_event_publish_fixed_status_text multiplayer_session_event_seed_control_id_list multiplayer_session_event_query_session_count multiplayer_session_event_noop_8byte_stub multiplayer_session_event_latch_status_code multiplayer_session_event_notify_owner_and_queue_action8 multiplayer_init_session_event_transport_state and multiplayer_session_event_retry_with_random_player_name. It allocates the transport callback object under `0x006cd970` stages the session name into the local descriptor block and then finishes registration through multiplayer_transport_register_callback_table which in turn routes through multiplayer_transport_attach_callback_table_descriptor multiplayer_transport_enqueue_descriptor_block_record and multiplayer_transport_dispatch_callback_table_binding.,ghidra + rizin + llvm-objdump + strings
 0x0046c360,32,multiplayer_route_chat_line,shell,cdecl,inferred,ghidra-headless,3,Routes one multiplayer chat line through the active transport object at `0x006cec78` when present or falls back to the local Multiplayer.win chat publisher otherwise. The transport path forwards the supplied text into 0x4554e0 with fixed mode arguments `5 1 0`; the local fallback tail-calls multiplayer_publish_wrapped_chat_message.,ghidra + rizin + llvm-objdump
@ -490,6 +580,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x0047dcd0,64,placed_structure_clear_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + data-layout inspection,3,"Clears the five proximity-bucket arrays rooted at `[this+0x5a4..0x5b4]`, zeroes the corresponding per-bucket counts at `[this+0x590..0x5a0]`, and resets the total proximity-entry count at `[this+0x5b8]`. Current grounded callers are the linked-site teardown pass at `0x00480590` and the sibling route-anchor refresh family at `0x00480719`, so this now reads as the common clear step for the nearby-site bucket family rather than a generic free helper.","objdump + caller xrefs + data-layout inspection + proximity-bucket correlation"
 0x0047dd10,130,placed_structure_remove_site_id_from_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one matching site id from every proximity bucket rooted at `[this+0x590..0x5b8]`. The helper scans all five bucket arrays, matches the supplied site id against the first dword of each eight-byte entry, compacts the surviving tail when needed, decrements the per-bucket count, and decrements the total count at `[this+0x5b8]`. Current direct caller is the collection sweep at `0x004814e9`, which makes this the remove-one-site companion to the nearby-site bucket append path rather than a broader route helper.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
 0x0047fdb0,317,placed_structure_append_nearby_transit_site_distance_bucket_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Appends one nearby station-or-transit site into the current record's five proximity buckets. The helper first requires the caller-supplied peer record to pass `0x0047fd50`, then measures the current-to-peer distance through `0x00455800`, `0x00455810`, and `math_measure_float_xy_pair_distance` `0x0051db80`, rejects peers outside the fixed distance threshold at `0x005c8738`, classifies the surviving peer through `0x0040d350`, and finally appends one `(peer site id, distance)` pair into the corresponding eight-byte bucket array at `[this+bucket*4+0x5a4]` while incrementing both the per-bucket count and total count `[this+0x5b8]`. Current direct caller is the collection sweep at `0x004814a9`.","objdump + caller xrefs + callsite inspection + distance-threshold correlation + proximity-bucket correlation"
+0x00482d10,110,runtime_query_cached_local_exe_version_float,simulation,thiscall,inferred,objdump + local disassembly,3,"Returns one cached local executable version as a float-like `major + minor/100` value. On first use the helper queries the version-info resource of the literal stem `RT3.EXE` at `0x005cec18` through `0x0055d9c0`, splits the returned packed dword into low and high 16-bit words, converts them into one float as `hi + lo/100.0`, caches the result at `0x006cec5c`, and returns that cached value on later calls. The sibling formatter `0x00482d80` and the rounded hundredths query `0x00482e00` both consume the same source, which now makes this the clearest current owner for the local `1.03/1.04/1.05/1.06`-style version float rather than a gameplay progress value.","objdump + local disassembly + version-resource correlation"
+0x00482d80,128,runtime_query_cached_local_exe_version_string,simulation,thiscall,inferred,objdump + local disassembly + string inspection,3,"Returns one cached local executable version string formatted from the same `RT3.EXE` version-info source used by `0x00482d10`. On first use the helper queries the packed local version dword through `0x0055d9c0`, formats it with the literal pattern `%d.%02d` at `0x005ced5c`, allocates one small shell string object at `0x006cec24`, and returns that cached string on later calls. Current grounded callers include `multiplayer_session_event_publish_registration_field` `0x0046a6c0` and the later shell text path at `0x00503254`, which makes this the clearest current local version-string owner.","objdump + local disassembly + string inspection + caller xrefs + version-resource correlation"
+0x00482e00,70,runtime_query_hundredths_scaled_build_version,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared rounded hundredths-scaled build-version query used by route, company, train, and world-side logic. In the ordinary local path the helper consults the cached local executable version float from `runtime_query_cached_local_exe_version_float` `0x00482d10`, adds the fixed offset `0.0001`, multiplies by `100.0`, and rounds the result through the CRT helper at `0x005a10d0`, which makes the local outputs line up with integer build values such as `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`. When the multiplayer-side runtime rooted at `0x006cd8d8` is active, or when the local scenario-state gate at `0x004349a0` reports a later mode, it instead delegates to the multiplayer companion path at `0x0046a4b0`, which can reuse a cached network-side integer at `0x006cd96c` or scan live session-peer version fields before falling back to the same local executable-version path. Current grounded callers include the city-connection route builder `0x00402cb0`, the auxiliary tracker pair-metric dispatcher `0x004a65b0`, and numerous neighboring world-side maintenance branches. This is no longer best-read as a gameplay progress or era index: the recovered threshold pattern is a shared executable or session build-version gate.","objdump + caller xrefs + local disassembly + multiplayer-fallback correlation + version-resource correlation + threshold-correlation"
 0x004801a0,105,placed_structure_is_linked_transit_site_reachable_from_company_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean gate between one linked transit site and one company-side route anchor. The helper first requires the current placed structure to pass the station-or-transit gate `0x0047fd50`, then requires its linked-instance class test through `0x0040c990 == 1`. It resolves the caller-supplied company id through the live company collection `0x0062be10`, asks that company for one cached route-anchor entry id through `company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860`, resolves the site's own route-entry anchor through collection `0x006cfca8`, and finally re-enters `0x0048e3c0` to test whether the two route-entry anchors lie in the same reachable route-side family. Current grounded caller is `company_rebuild_linked_transit_site_peer_cache` `0x004093d0`, where this helper gates whether a foreign linked transit site can still participate in the current company's peer cache.","objdump + caller xrefs + callsite inspection + linked-transit reachability correlation"
 0x00480590,371,placed_structure_teardown_linked_site_runtime_state_before_removal,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Tears down the mutable runtime side of one linked placed-structure record before collection removal. The helper clears the route-style scratch lane through `0x004077e0`, clears the proximity buckets through `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, frees the trailing scratch buffer at `[this+0x34]`, clears the route-link list through `0x0047f320`, detaches or invalidates the current route-entry anchor at `[this+0x08]` through the route-entry collection `0x006cfca8`, recomputes the current grid-keyed owner lane through `0x0042bbf0`, frees the three per-site byte arrays at `[this+0x24..0x2c]`, clears this record's indexed byte in the corresponding arrays of every later placed-structure record in `0x006cec20`, and finally re-enters the scenario-side follow-on at `0x00436040` with the current site id. Current direct caller is `placed_structure_collection_remove_linked_site_record` `0x004813d0`, so this now looks like the linked-site teardown pass rather than another route-anchor refresh helper.","objdump + caller xrefs + callsite inspection + linked-site teardown correlation"
 0x00480bb0,1535,placed_structure_refresh_linked_site_display_name_and_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Single-site post-create or post-edit refresh helper reached from `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10` when the current placed structure keeps one linked site id at `[this+0x2a8]`. The helper operates on that linked placed-structure record, optionally rebuilds one route-entry anchor at `[this+0x08]` through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` with both optional endpoint-entry ids unset and literal policy byte `2`, then binds the chosen route entry back to the site through `0x0048abc0` and re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0` so the auxiliary tracker family at `0x006cfcb4` can regroup around the refreshed anchor. Current caller correlation makes that byte the strongest current match for the broader linked-site route-anchor rebuild lane, as opposed to the narrower direct endpoint-anchor creation or replacement lane that neighboring repair branches drive through literal byte `1` into `0x00493cf0`. It also rebuilds the display-name buffer at `[this+0x46b]`: when the current site coordinates resolve a city or region entry through `0x0044a830` it copies that entry name from `[entry+0x356]`, optionally appends one civic suffix from RT3.lng ids `585..588` `Township`, `New`, `Modern`, and `Renaissance`, and on special linked-instance class branches appends `589` `Service Tower` or `590` `Maintenance Facility` with per-city counters instead. When no city entry resolves it falls back to `591` `Anytown`. The ordinary non-special branch also rotates through RT3.lng ids `578..584` `Junction`, `Crossing`, `Depot`, `Corners`, `Exchange`, `Point`, and `Center` via the static table at `0x005f2cf8`. After trimming trailing spaces it conditionally re-enters `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` when the narrower station-or-transit gate `0x0047fd50` passes, clears or seeds adjacent city-side cached state through `0x004358d0` and `0x00420650`, and returns. Current direct caller is `0x0040f626`, so this now looks like the linked-site display-name and route-anchor refresh beneath placed-structure finalization rather than another city-connection owner.","objdump + caller xrefs + callsite inspection + RT3.lng strings + route-anchor correlation + linked-site refresh correlation + linked-site policy-byte split correlation + tracker-regrouping correlation"
--- a/docs/atlas/README.md
+++ b/docs/atlas/README.md
@ -0,0 +1,22 @@
+# Atlas Notes
+
+These notes are a finer-grained navigation layer over the canonical longform atlas in
+[control-loop-atlas.md](/home/jan/projects/rrt/docs/control-loop-atlas.md).
+
+Current subsystem views:
+
+- [startup-shell-and-content.md](/home/jan/projects/rrt/docs/atlas/startup-shell-and-content.md)
+- [multiplayer.md](/home/jan/projects/rrt/docs/atlas/multiplayer.md)
+- [runtime-and-world-tools.md](/home/jan/projects/rrt/docs/atlas/runtime-and-world-tools.md)
+- [route-entry-and-trackers.md](/home/jan/projects/rrt/docs/atlas/route-entry-and-trackers.md)
+- [company-and-ledger.md](/home/jan/projects/rrt/docs/atlas/company-and-ledger.md)
+- [editor-and-site-service.md](/home/jan/projects/rrt/docs/atlas/editor-and-site-service.md)
+
+Scope policy:
+
+- [function-map.csv](/home/jan/projects/rrt/artifacts/exports/rt3-1.06/function-map.csv) remains
+  the single canonical ledger.
+- [control-loop-atlas.md](/home/jan/projects/rrt/docs/control-loop-atlas.md) remains the canonical
+  longform narrative.
+- These files are curated subsystem views intended to keep active reverse-engineering passes
+  smaller and easier to navigate.
--- a/docs/atlas/company-and-ledger.md
+++ b/docs/atlas/company-and-ledger.md
@ -0,0 +1,49 @@
+# Company and Ledger
+
+Primary atlas sources:
+
+- [control-loop-atlas.md#input-saveload-and-simulation](/home/jan/projects/rrt/docs/control-loop-atlas.md#input-saveload-and-simulation)
+
+This view isolates the company-side shell panes, linked-transit company maintenance, city-connection
+news, and annual finance-policy thresholds.
+
+Current grounded owners:
+
+- `shell_company_list_window_construct`
+- `shell_company_detail_window_construct`
+- `shell_company_detail_window_handle_message`
+- `shell_load_screen_window_construct`
+- `company_service_periodic_city_connection_finance_and_linked_transit_lanes`
+- `company_evaluate_annual_finance_policy_and_publish_news`
+- `company_balance_linked_transit_train_roster`
+- `company_try_buy_unowned_industry_near_city_and_publish_news`
+- `company_evaluate_and_publish_city_connection_bonus_news`
+- `simulation_try_select_and_publish_company_start_or_city_connection_news`
+
+Current bounded finance verbs:
+
+- bankruptcy
+- bond repayment
+- bond issuance
+- public-share repurchase
+- public-share issuance
+- dividend adjustment
+
+Current bounded shell families:
+
+- `CompanyDetail.win`
+- `CompanyList`
+- `LoadScreen.win`
+
+What this note is for:
+
+- CompanyDetail section ownership and finance dialogs
+- Ledger and report-page ownership
+- Linked-transit autoroute and train-roster maintenance
+- City-connection announcement and bonus lanes
+- Annual finance-policy thresholds and same-cycle reaction latches
+
+Highest-value open edge:
+
+- The remaining semantic meaning of the annual finance ladders and governance-support slots, not
+  ownership of the verbs or shell windows.
--- a/docs/atlas/editor-and-site-service.md
+++ b/docs/atlas/editor-and-site-service.md
@ -0,0 +1,54 @@
+# Editor and Site Service
+
+Primary atlas sources:
+
+- [control-loop-atlas.md#input-saveload-and-simulation](/home/jan/projects/rrt/docs/control-loop-atlas.md#input-saveload-and-simulation)
+- [control-loop-atlas.md#station-detail-overlay](/home/jan/projects/rrt/docs/control-loop-atlas.md#station-detail-overlay)
+
+This view isolates the map-editor page families, candidate and site-service runtime chain, and the
+station-detail or station-list read-side consumers.
+
+Current grounded editor owners:
+
+- `map_editor_panel_select_active_section`
+- `map_editor_panel_dispatch_active_section_message`
+- `map_editor_scenario_metadata_panel_refresh_controls`
+- `map_editor_scenario_special_conditions_panel_handle_message`
+- `map_editor_economic_cost_slider_panel_construct`
+- `map_editor_available_chairman_panel_handle_message`
+- `map_editor_city_region_panel_handle_message`
+- `map_editor_territory_panel_handle_message`
+- `map_editor_locomotive_availability_panel_handle_message`
+- `map_editor_industry_availability_panel_handle_message`
+- `map_editor_port_warehouse_cargo_panel_handle_message`
+
+Current grounded runtime chain:
+
+- `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables`
+- `structure_candidate_collection_rebuild_runtime_records_from_scenario_state`
+- `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables`
+- `structure_candidate_query_cargo_runtime_summary_channels`
+- `structure_candidate_collection_refresh_cargo_economy_filter_flags`
+- `placed_structure_rebuild_candidate_cargo_service_bitsets`
+- `placed_structure_rebuild_candidate_local_service_tables`
+- `placed_structure_refresh_local_service_score_bundle`
+
+Current grounded shell-side consumers:
+
+- `shell_station_detail_format_freight_and_express_summary`
+- `shell_station_detail_format_candidate_local_service_summary`
+- `shell_station_list_format_freight_and_express_availability_summary`
+- `world_render_station_candidate_service_map_overlay`
+
+What this note is for:
+
+- Editor page ownership and field semantics
+- Port or warehouse cargo recipe runtime path
+- Candidate enablement and cargo-economy filtering
+- Per-site local service tables and caps
+- Station-detail and station-list read-side summaries
+
+Highest-value open edge:
+
+- The deeper gameplay meaning of the per-site local service tables and how those scores drive live
+  city or structure behavior beyond the currently bounded shell summaries.
--- a/docs/atlas/multiplayer.md
+++ b/docs/atlas/multiplayer.md
@ -0,0 +1,37 @@
+# Multiplayer
+
+Primary atlas source:
+
+- [control-loop-atlas.md#multiplayer-session-and-transport-flow](/home/jan/projects/rrt/docs/control-loop-atlas.md#multiplayer-session-and-transport-flow)
+
+Current grounded owners:
+
+- `multiplayer_window_init_globals`
+- `multiplayer_window_service_loop`
+- `multiplayer_register_session_event_callbacks`
+- `multiplayer_dispatch_requested_action`
+- `multiplayer_preview_dataset_service_frame`
+- `multiplayer_transport_service_frame`
+- `multiplayer_transport_service_worker_once`
+- `multiplayer_transport_service_route_callback_tables`
+- `multiplayer_transport_service_status_and_live_routes`
+
+Current bounded state blocks:
+
+- session globals at `0x006d40d0`
+- active session-event transport at `0x006cd970`
+- preview dataset at `0x006cd8d8`
+- Multiplayer window backing block at `0x006d1270`
+- selector-view store rooted at `[transport+0xab4]`
+
+What this note is for:
+
+- Multiplayer window and preview-dataset ownership
+- Session-event transport routing
+- GameSpy-facing callback and live-route semantics
+- Selector-view refresh, retry, and probe state
+
+Highest-value open edge:
+
+- The remaining owner-side callback roles behind the validated GameSpy packet branches and the
+  exact user-facing meaning of the selector-view sample or companion fields.
--- a/docs/atlas/route-entry-and-trackers.md
+++ b/docs/atlas/route-entry-and-trackers.md
@ -0,0 +1,125 @@
+# Route Entry and Trackers
+
+Primary atlas sources:
+
+- [control-loop-atlas.md#input-saveload-and-simulation](/home/jan/projects/rrt/docs/control-loop-atlas.md#input-saveload-and-simulation)
+
+This note isolates the lower route-entry, linked-site, route-link, and auxiliary tracker families
+that are easy to lose inside the broader runtime section.
+
+Current grounded owners:
+
+- `city_connection_try_build_route_with_optional_direct_site_placement`
+- `route_entry_collection_try_build_path_between_optional_endpoint_entries`
+- `route_entry_collection_search_path_between_entry_or_coord_endpoints`
+- `route_entry_collection_create_endpoint_entry_from_coords_and_policy`
+- `route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte`
+- `aux_route_entry_tracker_collection_refresh_route_entry_group_membership`
+- `aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group`
+- `aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate`
+- `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups`
+- `aux_route_entry_tracker_collection_reseed_group_from_route_entry_component`
+- `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups`
+- `aux_route_entry_tracker_query_tracker_component_labels_match`
+- `aux_route_entry_tracker_collection_query_component_label_by_tracker_id`
+- `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links`
+- `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query`
+- `aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search`
+- `aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk`
+- `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks`
+- `placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state`
+- `placed_structure_rebuild_route_style_candidate_scores_and_peer_links`
+
+Current bounded policy split:
+
+- policy byte `1`: single-track endpoint synthesis and direct linked-site anchor create or replace
+- policy byte `2`: broader linked-site anchor rebuild plus tracker regrouping
+- policy byte `4`: double-track endpoint synthesis with the larger track-laying-capacity charge
+
+Current bounded tracker side:
+
+- allocator at `0x004a42b0`
+- refcount or destroy path at `0x004a4340`
+- group-id setter at `0x00489f80`
+- endpoint-membership probe at `0x00494ed0`
+- bind helper at `0x00494f00`
+- latch refresh at `0x00494fb0`
+- cached-match refresh at `0x00495020`
+- adjacent transfer gate at `0x004a4c00`
+- component-label refresh sweep at `0x004a5fc0`
+- component-label equality test at `0x004a62c0`
+- component-label query at `0x004a6320`
+- owner-adjacent compatible-group refresh at `0x004a6360`
+- pair-metric dispatcher at `0x004a65b0`
+- weighted recursive metric branch at `0x004a5280`
+- alternate recursive neighbor-walk branch at `0x004a5900`
+- endpoint-fallback chooser at `0x004a6630`
+
+Current bounded time-side cutover:
+
+- `runtime_query_hundredths_scaled_build_version` at `0x00482e00` is the shared rounded
+  hundredths-scaled executable or session build-version query above the `>= 0x67` branch in
+  `0x004a65b0`
+- it is not a gameplay progress flag; in the local path it comes from the `RT3.EXE` version-info
+  source through `0x00482d10`, then `+0.0001`, `*100.0`, and round, while the multiplayer path
+  delegates through `0x0046a4b0`
+- the recovered `>= 0x67`, `>= 0x68`, `>= 0x69`, and `>= 0x6a` caller pattern now lines up with
+  executable build values `1.03`, `1.04`, `1.05`, and `1.06`
+- nearby callers now make two more compatibility reads concrete:
+  build `1.04+` keeps one `Recycling Plant` stem-specific branch alive inside `0x004101e0`, and
+  build `1.05+` skips one older descriptor-side attenuation fallback in that same rebuild family
+- the adjacent world-side compatibility lane is bounded too:
+  build `1.03+` can skip one older recursive connected-component bounds walk through
+  `0x004160c0 -> 0x00415f20` when scenario field `[0x006cec78+0x46c38]` is already active
+- the wrapper above that compatibility read is bounded now too:
+  `0x00416170` maps the current tile rectangle into the component table rooted at `0x0062ba7c`
+  and only re-enters `0x004160c0` when the current owner still lacks cached bounds and the local
+  suppressor gates stay clear
+- the higher neighboring projected-rectangle lane is tighter too:
+  `0x00418610` refreshes the temporary sample band at `0x0062b7d0`, republishes the surviving
+  rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle
+  mask bit `0x01` for the corresponding non-sentinel cells
+- the owner split above that lane is bounded now too:
+  `0x00418be0` is the broader local-runtime record builder from candidate stem plus projected
+  scratch, while `0x00418a60` is the smaller current-subject clone path over the same
+  mask-refresh and component-bounds helpers
+- the scratch tail is tighter now too:
+  `0x00416620` publishes the projected rectangle into the shared local-runtime globals, validates
+  route-entry coverage through `0x00494240`, can branch into the special projected-slot picker
+  `0x00415570`, and refreshes the compact per-cell side tables through `0x00414e10`
+- the last side helpers under that local-runtime branch are bounded now too:
+  `0x00414470` is just the projected-slot cache setter above the subject-clone path, while
+  `0x00418040` is the optional local-runtime overlay-payload renderer sampled by the broader
+  stem-based builder at `0x00418be0`
+- the higher local-runtime owner chain is bounded now too:
+  `0x004133b0` first drains the temporary placed-structure id queue through `0x00414480` and
+  `0x00413f50`, rebuilding cloned local-runtime records through `0x0040e450`, and then sweeps all
+  live placed structures through `0x0040ee10`
+- the owner context above that local-runtime refresh is tighter now too:
+  inside the `Setting up Players and Companies...` `319` lane of
+  `world_run_post_load_generation_pipeline`, the pipeline refreshes the route-entry collection
+  `0x006cfca8`, then the auxiliary route-entry tracker collection `0x006cfcb4`, then
+  `0x004133b0`, then a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only
+  after that the later route-entry post-pass at `0x00491c20`
+- the side refresh split is tighter now too:
+  `0x0040ee10` publishes one local position/scalar triplet through `0x00530720` and then tails
+  into `0x0040e360`, whose current grounded subtype-`1`, class-`3` branch recomputes a linked-site
+  anchor triplet from the peer route-entry anchor when that anchor is still live
+- the heavier sibling above that side refresh is bounded now too:
+  `0x0040eba0` is the world-coordinate mutation helper that rewrites cached grid coordinates,
+  updates the subtype-`4` proximity-bucket family when needed, rebuilds the same triplet, and then
+  tails into `0x0040e360`
+
+What this note is for:
+
+- Route-search ownership and quality gates
+- Linked-site route-anchor rebuilds
+- Auxiliary route-entry tracker regrouping semantics
+- Route-style peer-link emission and route-link state
+- Track-laying-capacity interactions with route synthesis
+
+Highest-value open edge:
+
+- The remaining semantic edge is why build `1.03+` selects the weighted tracker branch in
+  `0x004a65b0`, now that the version gate itself is grounded and the linked-transit peer-cache side
+  is tighter as step count plus normalized continuity share rather than a generic ratio.
--- a/docs/atlas/runtime-and-world-tools.md
+++ b/docs/atlas/runtime-and-world-tools.md
@ -0,0 +1,135 @@
+# Runtime and World Tools
+
+Primary atlas sources:
+
+- [control-loop-atlas.md#input-saveload-and-simulation](/home/jan/projects/rrt/docs/control-loop-atlas.md#input-saveload-and-simulation)
+
+This view keeps together the runtime-side shell input path, world-view tool surfaces, world bring-up
+pipeline, and the large shell-window families that hang off the recurring frame owner.
+
+Current grounded owners:
+
+- `shell_controller_window_message_dispatch`
+- `simulation_frame_accumulate_and_step_world`
+- `simulation_advance_to_target_calendar_point`
+- `simulation_service_periodic_boundary_work`
+- `world_run_post_load_generation_pipeline`
+- `shell_ensure_game_uppermost_window`
+- `game_uppermost_window_service_world_hotspot_band`
+- `station_place_window_handle_message`
+- `track_lay_window_handle_message`
+- `shell_open_or_focus_load_screen_page`
+- `shell_open_or_focus_overview_window`
+- `shell_open_or_focus_trainbuy_window`
+- `shell_open_or_focus_train_detail_window`
+
+Current bounded tool families:
+
+- `TrackLay.win`
+- `StationPlace.win`
+- `GameUppermost.win`
+- `LoadScreen.win`
+- `Overview.win`
+- `Trainbuy.win`
+- `TrainDetail.win`
+
+Current bounded post-load detail:
+
+- inside `world_run_post_load_generation_pipeline`, the later `Setting up Players and Companies...`
+  `319` lane now has a tighter interior order:
+  route-entry collection refresh on `0x006cfca8`,
+  auxiliary route-entry tracker collection refresh on `0x006cfcb4`,
+  placed-structure local-runtime refresh through `0x004133b0`,
+  flagged world-grid cleanup through `0x00448af0/0x00533fe0`,
+  later route-entry post-pass through `0x00491c20`,
+  and a separate event-side runtime materialization pass on the live event collection `0x0062be18`
+  through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`
+  plus the per-record helper `0x0042db20`
+- the event-side branch is tighter now too:
+  the first rebuilt linked row family under `0x0042db20` aligns with the standalone condition list
+  later consumed by `EventConditions.win`,
+  while the second rebuilt family aligns with the four grouped effect lists later deep-copied
+  through `scenario_event_clone_runtime_record_deep_copy` `0x0042e050` during event duplication
+  and effect staging
+- the shell-side event windows are tighter too:
+  `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` now read as class-bit predicates over the
+  standalone condition-row list, and the window vtables bind
+  `shell_event_conditions_window_handle_message` `0x004d59e0` plus
+  `shell_event_effects_window_handle_message` `0x004d7060` as the primary message owners
+- the conditions-side refresh split is tighter too:
+  `0x0042d700` now reads as the standalone condition-list class or modifier aggregate,
+  `0x0042d740` as the grouped effect-row type-flag aggregate for one selected grouped list,
+  `0x004d77b0` as the grouped summary-band affordance gate for `0x4fed..0x4ff0`,
+  `0x004d9970` as the condition-class summary and grouped-row status refresh,
+  `0x004d9d10` as the smaller grouped-effect territory-target affordance refresh on control `0x500b`,
+  `0x004d9f50` as the selected-event mode strip and summary-panel refresh,
+  `0x004d9390` as the mode-dependent detail-row switch beneath that strip,
+  and `0x004da0f0` as the broader refresh owner that now cleanly splits selector `0x5001` versus
+  `0x5002`, with the strongest current RT3.lng fit reading `0x5001 = Test against...` and
+  `0x5002 = Apply effects...`; the `0x5002` branch then builds `0x5014` from RT3.lng
+  `1160..1164` as the target-subject text `to the company/player/player (i.e. chairman)/territory
+  for which the condition is TRUE`, while the strongest current RT3.lng fit for `0x5015..0x501c`
+  is `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`
+- the selected-event strip is tighter now too:
+  `0x004db120` now reads as the broader selected-event repaint and navigation refresh,
+  `0x004db520/0x004db5e0` as the previous/next selected-event stepping verbs,
+  `0x004db8b0` as the add-blank or clone-selected-event modal helper,
+  `0x004dba90` as the rename-selected-event modal helper,
+  `0x004d9360` as the delete-selected-event helper,
+  `0x004db6a0` as the live selected-event id setter behind control `0x4e84`,
+  `0x004db6f0` as the callback-binding plus pending-selection bootstrap path,
+  and `0x004dbb80` as the broader strip and grouped-band dispatcher above the
+  `0x4e85..0x4e8a` previous/next/add/clone/rename/delete cases
+- the selection bootstrap and grouped-band side is tighter too:
+  `0x004daf40` is the placeholder reset helper for the selected-event summary controls,
+  and `0x004dbf93` is the grouped-effect summary-band selector that commits current state through
+  `0x004d8d50` before switching grouped selector `[this+0x9c]`
+- the grouped target-scope strip is tighter too:
+  `0x004d8ea0` now reads as the selected-event text-panel commit helper before selection changes,
+  `0x004d91e0` as the selected-event summary-header and grouped-mode commit helper above
+  `0x004d8d50`,
+  `0x004d8d50` now grounding the hidden ordinal selector family `0x5006..0x500e -> 0..8`,
+  `0x004d88f0` as the selected grouped-effect row-list renderer on `0x4ed5` using RT3.lng
+  `1154..1159`,
+  `0x004da9a0` as the stored grouped-summary-state reload that republishes `0x500a`, `0x500b`,
+  and visible action selection `0x5014..0x501c` from the selected event,
+  `0x004dab60` as the selected grouped-effect target-scope strip refresh that projects that ordinal
+  onto visible controls `0x5014..0x501c` while still honoring the grouped-effect type-mask gates on
+  `0x5015`, `0x5016..0x5018`, `0x500b/0x5019`, and `0x501a..0x501c`, `0x004dbfca` as the grouped
+  target-scope mode selector that persists the chosen control id into `0x00622074`, with
+  `0x5001/0x5002` now strongest-fit as `Test against...` and `Apply effects...`, `0x004dbeeb` as
+  the pending shared
+  summary-text triplet publish helper, and
+  `0x004dbe7a` as the narrower `0x4ec6/0x4ec7` choice-event single-player-only warning modal
+  branch
+- the hidden/display split is tighter too:
+  `0x5006..0x500e` now read as the canonical hidden target-scope selector family stored into
+  `[event + group + 0x7fb]`, while `0x5014..0x501c` are the visible one-to-one mirror rows
+  republished from that ordinal rather than a second independently named selector family
+- the grouped-band dispatch boundary is tighter too:
+  the `0x4dc09c` table now shows `0x5001/0x5002` are the only `0x4fed..0x501c` controls that
+  route into `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` route only to
+  the smaller `0x004d9d10` affordance path and `0x4ff1..0x5013` are default no-ops
+- the effects-side editor stack is tighter too:
+  `0x004d5d00` now reads as the effect-type selector refresh,
+  `0x004d5f50` as the selected-effect parameter-row repaint,
+  `0x004d6090` as the heavier staged-effect editor refresh,
+  and `0x004d67f0` as the commit back into the staged effect row
+- the editor verbs are tighter too:
+  `0x004d9dc0` and `0x004d9e40` are the shared modal openers for `EventConditions.win` and
+  `EventEffects.win`, `0x004da640/0x004da700/0x004d9ed0` now read as add-edit-remove over the
+  standalone condition list, and `0x004da7c0/0x004da860/0x004da920` are the matching
+  add-edit-remove verbs for grouped effect rows
+
+What this note is for:
+
+- Shell-owned simulation cadence
+- World-view pan, zoom, rotate, and hotspot handling
+- Post-load generation phases and setup banners
+- Track-lay and station-placement semantics
+- Train detail and trainbuy command ownership
+
+Highest-value open edge:
+
+- Whether any later gameplay-owned mode bypasses the shell-controller-backed input and frame path
+  for ordinary world interaction.
--- a/docs/atlas/startup-shell-and-content.md
+++ b/docs/atlas/startup-shell-and-content.md
@ -0,0 +1,34 @@
+# Startup, Shell, and Content
+
+Primary atlas source:
+
+- [control-loop-atlas.md#crt-and-process-startup](/home/jan/projects/rrt/docs/control-loop-atlas.md#crt-and-process-startup)
+- [control-loop-atlas.md#bootstrap-and-shell-service-bring-up](/home/jan/projects/rrt/docs/control-loop-atlas.md#bootstrap-and-shell-service-bring-up)
+- [control-loop-atlas.md#shell-ui-command-and-deferred-work-flow](/home/jan/projects/rrt/docs/control-loop-atlas.md#shell-ui-command-and-deferred-work-flow)
+- [control-loop-atlas.md#presentation-overlay-and-frame-timing](/home/jan/projects/rrt/docs/control-loop-atlas.md#presentation-overlay-and-frame-timing)
+- [control-loop-atlas.md#map-and-scenario-content-load](/home/jan/projects/rrt/docs/control-loop-atlas.md#map-and-scenario-content-load)
+
+Current grounded owners:
+
+- `entry` -> CRT bring-up -> `app_bootstrap_main`
+- `bootstrap_init_shell_window_services`
+- `shell_install_global_controller`
+- `shell_service_pump_iteration`
+- `shell_dispatch_ui_command`
+- `shell_service_frame_cycle`
+- `shell_map_file_entry_coordinator`
+- `shell_map_file_world_bundle_coordinator`
+- `world_entry_transition_and_runtime_bringup`
+
+What this note is for:
+
+- Startup and bootstrap ownership questions
+- Shell controller bring-up and frame-cycle ownership
+- Shell command or deferred-work routing
+- File-flow and content-load boundaries
+- World bring-up versus shell-owned cadence questions
+
+Highest-value open edge:
+
+- Whether any long-lived gameplay cadence later escapes the bootstrap-owned shell service loop
+  entirely, or only nests under it.
--- a/docs/control-loop-atlas.md
+++ b/docs/control-loop-atlas.md
@ -4,6 +4,10 @@ This atlas is the high-level map for RT3 1.06. It is intentionally broader than
 each section explains who owns a loop, where it starts, what dispatches it, which state blocks
 anchor it, and where control is handed to neighboring subsystems.

+Subsystem notes now live under [docs/atlas](/home/jan/projects/rrt/docs/atlas/README.md) for
+faster navigation. The longform atlas remains the canonical narrative reference during this
+transition.
+
 ## CRT and Process Startup

 - Roots: `entry` at `0x005a313b`, CRT helpers in the `0x005a2d..0x005ad4..` range, and
@ -938,11 +942,11 @@ anchor it, and where control is handed to neighboring subsystems.
  placing a new site. The previously vague side family at `0x006cfcb4` is tighter too: current
  evidence now bounds it as a small auxiliary route-entry tracker collection with an allocator at
  `0x004a42b0`, a refcount or destroy path at `0x004a4340`, a direct route-entry group-id setter
-  at `0x00489f80`, a boolean-latch refresh or owner-notify path at `0x00494fb0`, and a
-  two-endpoint merge or bind helper at `0x00494f00`. That bind side is tighter now too: the
-  trackers group route entries only when a route-key-like value from `0x0048aa70`, the route-entry
-  signature word `+0x22e`, and the boolean latch derived from byte `+0x44` all agree. The deeper
-  handoff under that lane is no longer anonymous either:
+  at `0x00489f80`, an endpoint-membership probe at `0x00494ed0`, a boolean-latch refresh or
+  owner-notify path at `0x00494fb0`, and a two-endpoint merge or bind helper at `0x00494f00`.
+  That bind side is tighter now too: the trackers group route entries only when a route-key-like
+  value from `0x0048aa70`, the route-entry signature word `+0x22e`, and the boolean latch derived
+  from byte `+0x44` all agree. The deeper handoff under that lane is no longer anonymous either:
  `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380` is now
  bounded as the internal search core that runs the first candidate sweep, quality gates, and the
  later route-extension fallbacks before returning one resolved route-entry id or `-1`. The first
@ -989,14 +993,108 @@ anchor it, and where control is handed to neighboring subsystems.
  one linked site's route-entry anchor and display-name buffer. That path is tighter now than just
  “bind anchor then touch `0x006cfcb4`”: after the literal-policy-`2` rebuild succeeds it
  re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`,
-  which can repartition adjacent route-entry tracker groups around the refreshed anchor, rewrite
-  compatible endpoint slots through `0x004950f0`, and refresh one nearby cached-match payload band
-  through `0x00495020` before the helper resumes the name-buffer work. The remaining display-name
-  side still matches the earlier
+  which can now be described more concretely. Its early prepass at `0x004a4380` can split one
+  mismatching adjacent subchain into a fresh tracker group; its later helper at `0x004a4ce0` can
+  transfer one compatible adjacent chain between neighboring groups; and the repair-side helper at
+  `0x004a4ff0` can reseed a whole route-entry component into a fresh tracker when the old group id
+  is missing or invalid. The regrouping pass also still rewrites compatible endpoint slots through
+  `0x004950f0` and refreshes one nearby cached-match payload band through `0x00495020` before the
+  helper resumes the name-buffer work. The remaining display-name side still matches the earlier
  grounded text family: copy the resolved city name when available, append civic suffixes
  `Township`, `New`, `Modern`, or `Renaissance`, append `Service Tower` or `Maintenance Facility`
  on the linked-instance class branches, and otherwise fall back through the older
  `Junction`..`Center` and `Anytown` text families.
+  The higher owner-refresh side of that same tracker family is tighter now too. The reusable gate
+  at `0x004a4c00` no longer looks like a stray predicate: it explicitly requires both route-entry
+  trackers to keep matching cached fields `+0x18/+0x1c/+0x1d/+0x1e` and both route entries to keep
+  their special side fields `+0x20e/+0x222` unset before adjacent-chain transfer is allowed. The
+  collection-wide traversal sweep at `0x004a5fc0` is bounded now as the connected-component refresh
+  owner over tracker field `+0x0c`, with a temporary queue at `[this+0x94]` and direct fallback
+  into the reseed helper `0x004a4ff0` whenever one neighboring route entry has lost valid tracker
+  ownership. Above both of those sits `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links`
+  `0x004a6360`, which now reads as the owner-side latch-change refresher invoked from
+  `0x00494fb0`: it starts from one owner route-entry id, confirms both bound endpoint entries agree
+  on the boolean class state implied by route-entry byte `+0x44`, and then probes both endpoint
+  sides for adjacent route-entry groups that can be absorbed through the `0x004a4c00 -> 0x004a4ce0`
+  gate-and-transfer pair. The sibling query side is bounded now too:
+  `aux_route_entry_tracker_collection_query_component_label_by_tracker_id` `0x004a6320` is the
+  dirty-aware accessor for tracker field `+0x0c`, while
+  `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` is the remaining
+  mode-switched lower metric dispatcher beneath the heavier chooser at `0x004a6630`, forwarding
+  fixed route-entry-pair candidate sets into either `0x004a5280` or `0x004a5900` depending on the
+  shared hundredths-scaled build-version query
+  `runtime_query_hundredths_scaled_build_version` `0x00482e00` over `0x006cec74`. The current
+  caller thresholds `>= 0x67`, `>= 0x68`, `>= 0x69`, and `>= 0x6a` now line up with executable
+  build values `1.03`, `1.04`, `1.05`, and `1.06`, so this split is no longer best-read as a
+  time- or era-side cutover at all. That lower split is tighter now too:
+  `0x004a5280` is the weighted recursive branch with heuristic ordering, per-tracker best-cost
+  cache `0x006cfcac`, and prune threshold `0x006cfcb0`, while `0x004a5900` is the alternate
+  recursive neighbor-walk branch that stays within compatible component labels through
+  `0x004a62c0` and accumulates step and mismatch penalties over route-entry links
+  `+0x206/+0x20a/+0x20e`. Above both of them,
+  `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks`
+  `0x004a6630` is now bounded as the real chooser: direct fixed-pair query when both entries pass
+  `0x0048b870`, otherwise endpoint-pair fallback across the two tracker groups.
+  The adjacent route-style rebuild side is tighter now too: the same build-version family reaches
+  `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0`, where build
+  `1.04+` keeps one `Recycling Plant` stem-specific compatibility branch alive and build `1.05+`
+  skips one older descriptor-side attenuation fallback. There is also one neighboring world-side
+  compatibility lane now bounded below the same family: `placed_structure_collect_connected_component_tile_bounds_with_version_gate`
+  `0x004160c0` skips one older recursive component-bounds walk through `0x00415f20` on build
+  `1.03+` when scenario field `[0x006cec78+0x46c38]` is already active. The wrapper above that
+  path is bounded now too: `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh`
+  `0x00416170` walks the caller rectangle, maps tile keys into the component table rooted at
+  `0x0062ba7c`, and only re-enters `0x004160c0` when the current owner still has no cached bounds
+  and the local world or scenario suppressors stay clear. The higher neighboring raster side is
+  tighter too. `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610` is the
+  shared projected-rectangle helper above `world_grid_refresh_flagged_region_float_extrema_and_mean`
+  `0x00415020`: it refreshes the temporary sample band at `0x0062b7d0`, publishes the surviving
+  rectangle through `0x0044d410`, and on the single-sample path re-enters
+  `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` to flip mask bit
+  `0x01` for the corresponding non-sentinel cells. Current grounded callers for `0x00418610` are
+  the neighboring placed-structure local-runtime helper `0x00418be0` and the heavier placement
+  validator `0x004197e0`, so this adjacent family now reads more like projected placement or local
+  raster prep than an unowned generic world-grid scan. The higher owner split is tighter now too.
+  `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch`
+  `0x00418be0` is the broader construction or rebuild lane: resolve one candidate id from a stem,
+  build projected scratch through `0x00416ec0`, then publish the projected rectangle and validate
+  its side windows through `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows`
+  `0x00416620`. That publish pass is bounded now too: it stages `0x0062b308/0x0062b30c/0x0062b310`,
+  validates the rectangle against route-entry coverage through
+  `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, can branch into
+  the special projected-slot picker `placed_structure_try_select_projected_rect_profile_slot`
+  `0x00415570`, and refreshes the compact per-cell side tables through
+  `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` before the
+  finished scratch is copied into one queued runtime record and the new record re-enters
+  `0x00416170` when its rectangle is valid. The smaller sibling
+  `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds`
+  `0x00418a60` now reads as the current-subject clone path above the same connected-component and
+  mask-refresh helpers, returning the cloned local runtime record later stored into `[site+0x24e]`
+  by `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem`
+  `0x0040e450`. The higher wrapper above that clone path is bounded now too:
+  `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`
+  first drains the temporary site-id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` through
+  `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and
+  `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`, rebuilding one cloned
+  local-runtime record per queued placed structure through `0x0040e450`, and only then sweeps all
+  live placed structures through the side refresh helper
+  `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10`.
+  The last lower side reads are tighter now too. `0x0040e450` first seeds the projected-slot cache
+  through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470` before it re-enters
+  `0x00418a60`, and the broader stem-based builder at `0x00418be0` now has one named optional side
+  renderer instead of an anonymous callsite:
+  `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`.
+  The side refresh split is bounded now too. `0x0040ee10` publishes one local position or scalar
+  triplet through the shared setter `0x00530720`, then tails into
+  `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`;
+  that smaller follow-on only runs on the current subtype-`1`, class-`3`, linked-site branch, and
+  recomputes one local-runtime triplet from the linked peer's route-entry anchor when that anchor
+  is still live. The heavier sibling above that side refresh is bounded now too:
+  `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` is the
+  world-coordinate mutation helper that recomputes `[site+0x388]` and `[site+0x38c]`, rewrites the
+  world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`, updates the subtype-`4`
+  proximity-bucket family when needed, rebuilds the same local position or scalar triplet, and
+  then tails into the linked-site anchor follow-on at `0x0040e360`.
  The sibling policy-`1` side is tighter now too. The constructor lane no longer stops at “one
  linked site id at `[site+0x2a8]`”: the subtype-`1` branch in
  `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now clearly
@ -1026,7 +1124,14 @@ anchor it, and where control is handed to neighboring subsystems.
  fast pass stamps a refresh tick at `[company+0x0d3e]`, clears and repopulates the
  placed-structure-side cache cells addressed through `[site+0x5bd][company_id]`, marks the
  eligible linked transit sites for that company, allocates one `0x0d`-stride peer table for each
-  eligible site, and fills those peer rows from the route-side sweep through `0x004a6630`. The
+  eligible site, and fills those peer rows from
+  `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks`
+  `0x004a6630`. That helper no longer reads as one anonymous route sweep: it either uses the fixed
+  pair directly or falls back across tracker endpoint combinations before returning the winning
+  route-entry id, one route-step count, and one companion mismatch count. The fast cache now reads
+  more cleanly too: peer-record dword `+0x05` stores that step count, while float `+0x09` stores
+  the normalized continuity share derived from `(steps - mismatches) / max(steps, 1)`, not a raw
+  delta-per-step ratio. The
  adjacent timed wrapper `company_service_linked_transit_site_caches` `0x00409720` now shows the
  cadence too: `0x004093d0` is the shorter-interval refresh, while the older heavier sibling at
  `0x00407bd0` was only revisited on the longer interval.
@ -1295,8 +1400,94 @@ anchor it, and where control is handed to neighboring subsystems.
  diverting the deeper region worker into alternate logic. The `319` lane itself is no longer the
  open structural gap; it now clearly owns chairman-profile slot seeding, profile-record
  materialization, a shell editor surface over the same local record family, and a separate
-  live-company presentation path through the company-list window. The remaining gaps on this lane
-  are therefore narrower than before: the local slot records are rooted at `[world+0x69d8]`,
+  live-company presentation path through the company-list window. The later interior order of that
+  same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` it
+  refreshes the auxiliary route-entry tracker collection `0x006cfcb4`, then runs
+  `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`,
+  then a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that the
+  later route-entry post-pass at `0x00491c20`. The same later lane now also reaches a separate
+  event-side runtime branch: the live event collection at `0x0062be18` re-enters
+  `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, which in
+  turn materializes each live event record through
+  `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. Current shell-side xrefs
+  now tighten that event branch too: the first rebuilt linked row family under `0x0042db20` aligns
+  with the standalone condition list later queried by `EventConditions.win`, while the second
+  rebuilt family aligns with the four grouped effect lists later deep-copied through
+  `scenario_event_clone_runtime_record_deep_copy` `0x0042e050` during event duplication and effect
+  staging. The condition side is tighter now too: the tiny helper cluster
+  `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is no longer just "some adjacent list scans".
+  Current evidence bounds it as four predicates over the standalone `0x1e`-row condition list,
+  testing class bits `0x01`, `0x02`, `0x04`, or any of those bits in the static table
+  `0x005f3e04 + id*0x81`, with special fallback checks through event fields `[event+0x7f9]`,
+  `[event+0x7fa]`, and `[event+0x7f0] == 0x63`. The shell side is tighter too: vtable slot
+  `0x005d0cd8` now binds `shell_event_conditions_window_handle_message` `0x004d59e0`, and vtable
+  slot `0x005d0cf8` binds `shell_event_effects_window_handle_message` `0x004d7060`. The effects
+  side is tighter too: the lower helper trio is no longer anonymous. `0x004d5d00` now reads as the
+  effect-type selector refresh under control family `0x4fb2`, `0x004d5f50` reads as the selected
+  effect parameter-row repaint, `0x004d6090` is the heavier staged-effect editor refresh over the
+  `0x4fc7/0x4fce/0x4ff6/0x4ff9/0x4ffc/0x5041/0x5044/0x5046/0x5047` bands, and `0x004d67f0`
+  commits the current editor state back into the staged effect row at `[this+0x78]`. The verb side
+  is tighter now too: `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0` and
+  `shell_open_event_effects_modal_and_return_result` `0x004d9e40` are the shared modal openers
+  above the two editor windows; `0x004da640`, `0x004da700`, and `0x004d9ed0` now read as the add,
+  edit, and remove verbs for standalone condition rows; `0x004da7c0`, `0x004da860`, and
+  `0x004da920` are the matching add, edit, and remove verbs for grouped effect rows; and
+  `0x004d8120` is now the heavier condition-row list panel refresh those condition-side verbs
+  re-enter after mutation. The conditions-side refresh split is tighter too: `0x0042d700`
+  aggregates standalone condition-list class or modifier flags, `0x0042d740` aggregates grouped
+  effect-row type flags for one selected grouped list, `0x004d9970` owns the condition-class
+  summary and grouped-row status bands, `0x004d77b0` owns the grouped summary-band affordance gate
+  for `0x4fed..0x4ff0` when selector `0x5000` lands on `0x5002`, `0x004d9d10` owns the smaller
+  grouped-effect territory-target affordance on control `0x500b`, `0x004d9f50` owns the selected-event mode
+  strip and summary text panels, and `0x004d9390` is the mode-dependent detail-row switch beneath
+  that strip. `0x004da0f0` is tighter too: selector `0x5001` now has the strongest current
+  RT3.lng fit as the condition-side `Test against...` mode above `0x004d9970`, while selector
+  `0x5002` has the strongest current fit as the grouped-effect-side `Apply effects...` mode.
+  That `0x5002` branch now clearly builds control `0x5014` from RT3.lng `1160..1164` as `to the
+  company/player/player (i.e. chairman)/territory for which the condition is TRUE` before
+  enabling the adjacent `0x5005`, `0x500a`, and `0x5014..0x501c` family. The strongest current
+  RT3.lng fit for the remaining visible target-scope strip is now `0x5015 = to the whole game`,
+  `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories`, and
+  `0x501a..0x501c = to all/human/AI players`; the grouped effect-row type mask matches that split
+  directly through bits `0x08`, `0x01`, `0x04`, and `0x02`. The
+  selected-event strip is tighter now too: `0x004db120` is the broader selected-event repaint and
+  navigation refresh above those smaller helpers, `0x004db520` and `0x004db5e0` are the previous
+  and next selected-event stepping verbs, `0x004db8b0` is the add-or-clone event modal helper,
+  `0x004dba90` is the rename verb, `0x004d9360` is the delete verb, `0x004db6a0` is the live
+  selected-event id setter behind control `0x4e84`, and `0x004db6f0` is the callback-binding plus
+  pending-selection bootstrap path that seeds the strip during window bring-up. The larger
+  dispatcher at `0x004dbb80` now makes the strip explicit: `0x4e85..0x4e8a` are previous, next,
+  add blank, clone selected, rename, and delete event, while the later grouped band commits current
+  summary state through `0x004d8d50` before changing grouped selector `[this+0x9c]` via `0x004dbf93`.
+  The selection bootstrap side is tighter too: `0x004daf40` is now the placeholder reset helper for
+  the selected-event summary controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`.
+  The grouped target-scope side is tighter too: `0x004d8ea0` now reads as the commit helper for current
+  selected-event text panels before selection or grouped-action changes, `0x004d8d50` now records
+  the hidden selector family `0x5006..0x500e -> 0..8`, and `0x004dab60` projects that ordinal
+  one-to-one onto the visible grouped-effect target-scope display strip `0x5014..0x501c`. That
+  split is firmer now: `0x5006..0x500e` are the canonical hidden selectors that get stored into
+  `[event + group + 0x7fb]`, while `0x5014..0x501c` are the visible mirror rows republished from
+  that same ordinal rather than a second independently named selector family. The grouped row and
+  stored-summary refresh side is tighter too: `0x004d88f0` is now the selected grouped-effect
+  row-list renderer for `0x4ed5`, formatting the grouped `0x28`-byte rows through RT3.lng
+  `1154..1159`, and `0x004da9a0` is the current grouped-summary-state republisher that reloads
+  `0x500a`, `0x500b`, and visible action selection `0x5014..0x501c` from `[event + group + ...]`
+  before tailing back into `0x004da0f0`,
+  `0x004dbfca` as the grouped target-scope mode selector that persists the chosen control id into
+  `0x00622074`, with `0x5001/0x5002` now strongest-fit as `Test against...` and
+  `Apply effects...`, `0x004dbeeb` as the pending shared summary-text triplet publish helper for
+  `0x4eac/0x4ed9/0x4edb`,
+  `0x004d91e0` as the selected-event summary-header and grouped-mode commit helper above
+  `0x004d8d50`, and `0x004dbe7a` as the narrower `0x4ec6/0x4ec7` choice-event single-player-only
+  warning modal branch rooted at RT3.lng `3887`. The remaining gaps on
+  this lane are narrower again because the grouped-band `0x4dc09c` table now closes one earlier
+  overclaim: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into
+  `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` only route to the smaller
+  `0x004d9d10` affordance path and the rest of `0x4ff1..0x5013` are default no-ops. The open
+  question is therefore no longer whether those visible target-scope rows are direct selector verbs;
+  current evidence says they are not.
+  The local slot records are rooted at
+  `[world+0x69d8]`,
  `[slot+0x01]` polarity and the external role gate at `[world+0x0bc3+slot*9]` are now grounded, and
  `[slot+0x03]` now looks like the distinguished primary-human-seat marker because current grounded
  writes seed it only on slot zero and later logic moves it solely by whole-record compaction. The