Preserve Tier2 loader and clone-seed handoff

artifacts/exports/rt3-1.06/function-map.csv

@@ -220,7 +220,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00411e10,50,structure_candidate_try_query_positive_fixed_profile_slot_0x798_scalar_and_trailing_value,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Queries the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and the row dword at offset `+0x14` is positive, the helper writes row dword `+0x20` to the caller outparam and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, where it acts as a prerequisite gate before the heavier fixed-row payload copy sibling `0x00411e50`.","objdump + local disassembly + caller inspection + fixed-table inspection"
 0x00411e50,133,structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_triplet,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Reads the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and row dword `+0x14` is positive, the helper copies the pointed zero-terminated string at row offset `+0x04` to the caller buffer, writes row dwords `+0x18`, `+0x1c`, and `+0x14` to the caller outparams, and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-triplet accessor rather than a narrower effect-family decoder.","objdump + local disassembly + caller inspection + fixed-table inspection"
 0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection + local disassembly,3,"Rebuilds the per-candidate cargo-membership tables and scaled per-cargo rate band after one runtime descriptor array has been materialized. The helper clears the two compact cargo-id tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and the thirteen-dword per-cargo accumulator band rooted at `[this+0x0a1]`, then fills one local `0x35`-byte scratch status array from the live `0xbc` descriptor strip in `[this+0x37]`. The year-status rule is tighter now too: with current scenario year `[0x006cec78+0x0d]`, or fallback year `0x709` when no live world is present, each subordinate cargo row is marked `2` only while `start_year <= current_year < end_year`; rows outside that active window still contribute status `1` as referenced cargo. The helper keeps the maximum status seen per remapped cargo id through `0x0062ba8c+0x9a`. The scaled-rate side is tighter in the same way: for descriptor mode `0` it multiplies each subordinate row amount by the shared production-cap float `[this+0x2a]` and divides by the descriptor amount `[desc+0x04]`, while nonzero-mode descriptors bypass that normalization and publish their row amount directly. After the scan it counts every cargo with scratch status `>= 1` into `[this+0x7a4]`, every cargo with status `>= 2` into `[this+0x7a8]`, allocates the two final `u16` id tables as `(count*2)+1`-byte buffers, zeroes them, and compacts the `status>=1` and `status>=2` sets into `[this+0x79c]` and `[this+0x7a0]` respectively. That keeps the stronger current split narrow and concrete: the first table is the referenced-cargo set, the second is the currently active-cargo set, and the per-cargo float band at `[this+0x0a1..+0x0b8]` is the same cap-scaled runtime rate band later queried by `0x004129d0`. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + local disassembly + scenario-state correlation + cargo-collection correlation + membership-table compaction correlation + year-window correlation"
-0x004120b0,1119,structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Stream-load owner for one live structure candidate record beneath the broader collection load path at `0x00412fb0`. The helper seeds runtime id `[this+0xe4]` from its first caller argument, clears the cargo-membership pointers and mode-summary band at `[this+0x79c..+0x7b0]`, sets the cached summary year `[this+0x788] = -1`, opens one named bundle slot through `0x00530c80`, and then reads the packed candidate body through repeated `0x00531150` calls. The fixed header import is tighter now too: it reads one outer dword header, then the candidate stem or display band at `[this+0x04]` length `0x1e`, the scalar fields at `[this+0x22]`, `[this+0x2a]`, and `[this+0x2e]`, the year words `[this+0x26/+0x28]`, byte `[this+0x32]`, and runtime descriptor count `[this+0x33]`. The descriptor strip itself is allocated as `count*0xbc + 1` bytes into `[this+0x37]`, then every `0xbc` slot is zeroed before the raw read. Descriptor import is tighter in the same way: mode-`0` descriptors immediately resolve their primary token string at `+0x08` back into cargo id `[desc+0x1c]`, subordinate-row descriptors resolve each row token at `+0x30 + row*0x1c` back into `[desc+0x44 + row*0x1c]`, and both paths clamp the descriptor start-year word `[desc+0x20]` upward to the resolved cargo availability floor at `[cargo+0x21]`. The later import band is explicit too: bundles at `>= 0x3ed` load `[this+0x3b..+0xbb]`, including the scalar strip `[this+0x3b/+0x3f/+0x43/+0x47/+0x4b]`, label band `[this+0x4f]`, summary quartet `[this+0x8c..+0xa0]`, per-cargo float lanes `[this+0xa1..+0xb8]`, and selector bytes `[this+0xb9..+0xbb]`; bundles at `>= 0x3f2` then load the wider `0x24`-byte trailer at `[this+0xc0]`, while older bundles keep that trailer in its narrow `0x02`-byte form. When `[this+0x4b]` is nonzero the helper also forces `[this+0x47] = 1.0`, rescales `[this+0x43]` from `[this+0x22]` through `0x005a10d0`, and clamps the final value to at least `0x1388`. After closing the slot through `0x00530a00` it re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, resets stem index `[this+0x798]` to `-1`, normalizes the candidate stem through the two built-in aliases at `0x005c8f94` and `0x005c8e4c`, and then scans the fixed row table `0x005ed338..0x005edca4` until it finds the matching stem index. Current grounded caller is the collection-wide stream-load path at `0x00412fb0`.","objdump + local disassembly + caller correlation + bundle-slot correlation + descriptor-year-floor correlation + stem-table correlation + version-gate correlation + field-width correlation"
+0x004120b0,1119,structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Stream-load owner for one live structure candidate record beneath the broader collection load path at `0x00412fb0`. The helper seeds runtime id `[this+0xe4]` from its first caller argument, clears the cargo-membership pointers and mode-summary band at `[this+0x79c..+0x7b0]`, sets the cached summary year `[this+0x788] = -1`, opens one named bundle slot through `0x00530c80`, and then reads the packed candidate body through repeated `0x00531150` calls. The fixed header import is tighter now too: it reads one outer dword header, then the candidate stem or display band at `[this+0x04]` length `0x1e`, the scalar fields at `[this+0x22]`, `[this+0x2a]`, and `[this+0x2e]`, the year words `[this+0x26/+0x28]`, byte `[this+0x32]`, and runtime descriptor count `[this+0x33]`. The descriptor strip itself is allocated as `count*0xbc + 1` bytes into `[this+0x37]`, then every `0xbc` slot is zeroed before the raw read. Descriptor import is tighter in the same way: mode-`0` descriptors immediately resolve their primary token string at `+0x08` back into cargo id `[desc+0x1c]`, subordinate-row descriptors resolve each row token at `+0x30 + row*0x1c` back into `[desc+0x44 + row*0x1c]`, and both paths clamp the descriptor start-year word `[desc+0x20]` upward to the resolved cargo availability floor at `[cargo+0x21]`. The later import band is explicit too: bundles at `>= 0x3ed` load `[this+0x3b..+0xbb]`, including the scalar strip `[this+0x3b/+0x3f/+0x43/+0x47/+0x4b]`, label band `[this+0x4f]`, summary quartet `[this+0x8c..+0xa0]`, per-cargo float lanes `[this+0xa1..+0xb8]`, and selector bytes `[this+0xb9..+0xbb]`; the selector side is narrower now too because the helper reads `[this+0xba]` and `[this+0xbb]` as separate one-byte stream fields rather than only as part of one undifferentiated tail band. Bundles at `>= 0x3f2` then load the wider `0x24`-byte trailer at `[this+0xc0]`, while older bundles keep that trailer in its narrow `0x02`-byte form. When `[this+0x4b]` is nonzero the helper also forces `[this+0x47] = 1.0`, rescales `[this+0x43]` from `[this+0x22]` through `0x005a10d0`, and clamps the final value to at least `0x1388`. After closing the slot through `0x00530a00` it re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, resets stem index `[this+0x798]` to `-1`, normalizes the candidate stem through the two built-in aliases at `0x005c8f94` and `0x005c8e4c`, and then scans the fixed row table `0x005ed338..0x005edca4` until it finds the matching stem index. Current grounded caller is the collection-wide stream-load path at `0x00412fb0`.","objdump + local disassembly + caller correlation + bundle-slot correlation + descriptor-year-floor correlation + stem-table correlation + version-gate correlation + field-width correlation + selector-byte parser-field correlation"
 0x00412510,72,structure_candidate_is_enabled_for_current_runtime_year_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small enable-or-year gate beneath the live candidate cargo-summary family. The helper first requires latch `[this+0x7ac]` to be nonzero. When shell state `[0x006cec74+0x17c]` is already armed it returns true immediately; otherwise it consults the scenario-side runtime gate at `[0x006cec78+0x46c38]` and compares the current effective year from `[0x006cec78+0x05]` or `[0x006cec78+0x0d]` against candidate word `[this+0x26]`, returning true only when the scenario year has reached that threshold. Current grounded callers are the collection-side wrapper at `0x00413de0` and the linked-count cargo-summary accumulator at `0x0041e795`, so this is the safest current read for the candidate-side availability gate above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` rather than a general profile or editor predicate.","objdump + local disassembly + caller correlation + year-gate correlation"
 0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_selected_mode_bank,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by requiring the primary cargo id at `[desc+0x1c]` to map through the live cargo-availability latch at `0x0062ba8c[cargo].+0x16e`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the inclusive descriptor year window `[desc+0x20]..[desc+0x22]`. The selected-bank split is tighter now too: when caller bank `0` is active the helper rejects descriptors whose dword gate `[desc+0x24]` is nonzero, while caller bank `1` rejects descriptors whose dword gate `[desc+0x28]` is nonzero. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to keep that same live cargo-availability latch `[cargo+0x16e]` nonzero. Current grounded callers are `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-availability-latch correlation + selected-bank-gate correlation + special-condition correlation"
 0x004125f0,87,structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts the currently active mode-`0` runtime descriptors that still own at least one subordinate row for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, keeps only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active mode-`0` descriptors that contribute cap-shared subordinate-row output.","objdump + caller xrefs + callsite inspection + cap-share-bank correlation"
@@ -237,7 +237,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00413bc0,435,station_place_format_preview_description_block_from_profile_text_and_rule_tables,map,thiscall,inferred,objdump + local disassembly + caller correlation + string-table correlation,3,"Formats the multiline description block consumed by the StationPlace preview panel. The helper starts by publishing the current placement record's text at `[record+0x40]` through `0x00518de0`, then uses repeated casefolded compares against record text `[record+0x7c]` and several fixed string tables rooted at `0x005f3c80`, `0x005c94c4`, `0x005c94a0`, and `0x005c947c` to decide which explanatory lines still need to be appended through the same text-publish path. One early branch also selects between format roots `0x005c94d4` and `0x005c94ec` based on dword `[record+0x141]`. Current grounded caller is `station_place_format_preview_panel` `0x00508730`, where this helper owns the paired description block for preview control `0x6984`. The safest current read is therefore a preview-description formatter over one placement profile and several fixed rule tables, rather than a generic message-box or region helper.","objdump + local disassembly + caller correlation + string-table correlation + StationPlace preview correlation"
 0x00413eb0,95,placed_structure_lookup_projected_rect_profile_record_by_label_at_field_0x123,map,cdecl,inferred,objdump + local disassembly + caller correlation + table-layout correlation,3,"Lookup helper beneath the projected-rectangle profile-slot family. It walks the fixed `0x5ef3f0` table in `0xb0`-byte steps, compares each entry's active label pointer against the caller record text rooted at `[arg+0x123]` through `0x005a57cf`, and on the first match returns the enclosing table record base. When no match exists it returns null. Current grounded caller is `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, which uses the returned record to derive companion value `0x0062ba3e` before probing the projected rectangle. This is therefore the safest current read for the fixed projected-rectangle profile-record lookup rather than a broader string-table scan.","objdump + local disassembly + caller correlation + table-layout correlation + projected-rectangle correlation"
 0x00412ab0,56,structure_candidate_collection_refresh_stem_overridable_policy_dword_0xbc,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live candidate manager that simply re-enters `structure_candidate_refresh_stem_overridable_policy_dword_0xbc` `0x004128e0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes the per-candidate dword `[candidate+0xbc]` from the current stem table and the current post-import flag state at `[candidate+0x78c]` plus subtype byte `[candidate+0x32]`. Current grounded callers sit in the same load and collection-service strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side owner above that stem policy refresh.","objdump + local disassembly + caller correlation + collection-sweep correlation + post-import-policy correlation"
-0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + local disassembly + caller xrefs + callsite inspection,4,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062b268`. The helper runs two banked passes keyed by the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]`, and within each bank it steps through the twelve scenario-side recipe books at offsets `0x0fe7 + ordinal*0x4e1`. For each ordinal it scans the live candidate collection twice conceptually: one path remembers the last availability-qualified candidate in the current bank as the template source record, while the parallel reuse path looks for a candidate whose prior ordinal field `[candidate+0x794]` already equals the current ordinal so that same live slot can be reused. When no reusable target exists it allocates one fresh candidate record through collection vtable slot `+0x04` and zeroes its `0x1f2`-dword body; otherwise it resolves the reusable target and clears its dependent pointer fields `[candidate+0x79c]`, `[candidate+0x7a0]`, and `[candidate+0x37]`. When the chosen target differs from the bank template source, it clones the full `0x1f2`-dword template body first. It then seeds the rebuilt candidate from the active scenario state rooted at `0x006cec78`: `[candidate+0x794]` becomes the current ordinal, `[candidate+0xe4]` keeps the live collection id, `[candidate+0x33]` takes the imported recipe-line count from `[state+0x1024]`, `[candidate+0x2a]` takes the shared production-cap float from `[state+0x13d4]`, and `[candidate+0x37]` receives a freshly allocated copy of the packed `0xbc` descriptor array from `[state+0x1028]`. The label side is narrower than earlier notes too: this rebuild owner does not consult the scenario-side recipe-book name at `[state+0x0fe8]`. Instead it formats display stem `[candidate+0x04]` directly from one of the two fixed built-in roots `0x005c93d8` or `0x005c93e8`, chosen by availability bit `[candidate+0xba] & 1`, together with the current ordinal. After that projection it refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and the neighboring mode-flag pass `0x00411ce0`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and the larger collection load path at `0x00412fb0`, so this is the candidate-side bridge that projects editor recipe-book state into live runtime records rather than a generic collection copy loop.","objdump + local disassembly + caller xrefs + callsite inspection + scenario-state correlation + ordinal-reuse correlation + template-clone correlation + display-stem-correction"
+0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + local disassembly + caller xrefs + callsite inspection,4,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062b268`. The helper runs two explicit banked passes keyed by the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]`, and within each bank it steps through the twelve scenario-side recipe books at offsets `0x0fe7 + ordinal*0x4e1`. The pass polarity is now grounded rather than only inferred: pass `0` accepts only rows whose `[candidate+0xba]` byte is nonzero, while pass `1` accepts only rows whose `[candidate+0xbb]` byte is nonzero. For each ordinal it scans the live candidate collection twice conceptually: one path remembers the last availability-qualified candidate in the current bank as the template source record, while the parallel reuse path looks for a candidate whose prior ordinal field `[candidate+0x794]` already equals the current ordinal so that same live slot can be reused. When no reusable target exists it allocates one fresh candidate record through collection vtable slot `+0x04` and zeroes its `0x1f2`-dword body; otherwise it resolves the reusable target and clears its dependent pointer fields `[candidate+0x79c]`, `[candidate+0x7a0]`, and `[candidate+0x37]`. When the chosen target differs from the bank template source, it clones the full `0x1f2`-dword template body first, so the selected seed row carries its already-materialized bank bytes and adjacent runtime fields into the rebuilt numbered record in one shot. It then seeds the rebuilt candidate from the active scenario state rooted at `0x006cec78`: `[candidate+0x794]` becomes the current ordinal, `[candidate+0xe4]` keeps the live collection id, `[candidate+0x33]` takes the imported recipe-line count from `[state+0x1024]`, `[candidate+0x2a]` takes the shared production-cap float from `[state+0x13d4]`, and `[candidate+0x37]` receives a freshly allocated copy of the packed `0xbc` descriptor array from `[state+0x1028]`. The label side is narrower than earlier notes too: this rebuild owner does not consult the scenario-side recipe-book name at `[state+0x0fe8]`. Instead it formats display stem `[candidate+0x04]` directly from one of the two fixed built-in roots `0x005c93d8` or `0x005c93e8`, chosen by availability bit `[candidate+0xba] & 1`, together with the current ordinal. After that projection it refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and the neighboring mode-flag pass `0x00411ce0`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and the larger collection load path at `0x00412fb0`, so this is the candidate-side bridge that projects editor recipe-book state into live runtime records rather than a generic collection copy loop.","objdump + local disassembly + caller xrefs + callsite inspection + scenario-state correlation + ordinal-reuse correlation + template-clone correlation + display-stem-correction + selector-pass polarity correlation"
 0x00412ca0,192,world_region_pick_commercial_profile_label_by_region_rank,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`.","objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings"
 0x004133b0,132,placed_structure_collection_refresh_local_runtime_records_and_position_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b2fc` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep.","objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation"
 0x00413f50,47,placed_structure_local_runtime_site_id_queue_pop_next,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"

artifacts/exports/rt3-1.06/runtime-effect-kind8-tier2-sequencing-note.md

@@ -59,11 +59,16 @@ Current grounded internal relationships:
   - then re-enters `0x00412d70`
 - `0x00412d70`
   - rebuilds candidate runtime records from scenario state
+  - runs two explicit bank passes, first on nonzero `[candidate+0xba]` rows and then on nonzero
+    `[candidate+0xbb]` rows
+  - picks one availability-qualified seed row and either reuses or clones its full `0x1f2`-dword
+    body into the rebuilt numbered record
   - does not consult the scenario-side recipe-book name at `[state+0x0fe8]`
 - `0x00412fb0`
   - broader collection load owner that directly loops through `0x004120b0`, then calls
     `0x00412d70`, then `0x00412ab0`, and only after its later catalog rebuild re-enters
     `0x00412c10`
+  - `0x004120b0` itself explicitly reads selector bytes `[candidate+0xba/+0xbb]` from the stream
 - `0x00434d40`
   - late post-refresh sweep over collection `0x0062b26c`
   - sets `[entry+0x7b0] = 1` for subtype-`2` rows
@@ -79,6 +84,8 @@ The strongest remaining Tier 2 question is sequencing, not naming:
   `0x00435630 -> 0x00412d70`
   and the broader load-side rebuild owner
   `0x00412fb0`,
+  with `0x004120b0` now grounded as the loader that reads `[candidate+0xba/+0xbb]` and
+  `0x00412d70` grounded as the immediate two-pass consumer of those bytes,
   with the early checkpoint only conditionally refreshing `0x00412c10` but the late checkpoint
   always rerunning `0x00435630 -> 0x00437737 -> 0x00412c10 -> 0x00434d40`,
   rather than on a direct `Warehouse05` availability bit or recipe-book display-name leak.

docs/control-loop-atlas/runtime-roots-camera-and-support-families.md

@@ -1410,11 +1410,15 @@
   layouts, not to the live `0x005c93cc` candidate rows.
   The positive candidate-side bound is tighter now too: `0x004120b0` explicitly declares
   `[candidate+0xba]` and `[candidate+0xbb]` as one-byte parser fields through `0x00531150`, and
-  the later helper `0x00412d70` can clone an already-materialized whole candidate row through
-  `rep movsl`, including those bytes, before `0x00412f02` picks the `Port%02d` vs `Warehouse%02d`
-  naming branch from cloned bit `[candidate+0xba]`. So the unresolved Tier-2 seam is no longer
-  “find any direct writer to candidate `+0xba/+0xbb`”; it is “find the earlier seed or projection
-  owner that first makes some source/live rows reach that clone path with nonzero bank bytes.”
+  the later helper `0x00412d70` does not consume them vaguely. It runs two explicit passes, first
+  accepting only nonzero `[candidate+0xba]` rows and then only nonzero `[candidate+0xbb]` rows,
+  remembers one availability-qualified seed row, prefers an existing target whose ordinal field
+  `[candidate+0x794]` already matches, and otherwise clones one whole `0x1f2`-dword candidate body
+  through `rep movsl`, including those bytes, before `0x00412f02` picks the `Port%02d` vs
+  `Warehouse%02d` naming branch from cloned bit `[candidate+0xba]`. So the unresolved Tier-2 seam
+  is no longer “find any direct writer to candidate `+0xba/+0xbb`”; it is “find the earlier seed
+  or projection owner that first makes some source/live rows reach that clone path with nonzero
+  bank bytes.”
   The top-level stock handoff above that clone pass is tighter now too. Direct disassembly of
   `0x004196c0` shows the broader stock `*.bca` rebuild loop formatting the wildcard path rooted at
   `0x005c93fc`, iterating the local `0x005c8190/0x005c8194/0x005c819c` find-first/find-next

docs/rehost-queue.md

@@ -16,7 +16,7 @@ This file is the short active queue for the current runtime and reverse-engineer
   The direct write census is tighter in the same direction: the only grounded explicit write of value `8` into `[event+0x7ef]` is `0x004d91b3` inside that same shell helper, while the runtime-side grounded writers still only cover zero-init, copy, `2/3` follow-on seeds, and the later `5` / `2` retags.
   Preserved checked control-lane detail now lives in [Periodic company control lane](rehost-queue/periodic-company-control-lane-2026-04-21.md).
 - Keep the next static Tier-2 building pass focused on the earlier seed/projection seam into `0x00412d70`, not another broad `BuildingTypes` sweep.
-  The grounded owner strip is `0x004196c0 -> 0x00414490 -> 0x00416ce0 -> 0x00419230`, and the checked candidate-table exports now keep the concrete scenario-side families explicit too: among the `37` probe-bearing maps, `Port00/Warehouse00` stay at `35/43` on `30` maps and shift earlier to `10/18` on `7`, while `Port01..11` / `Warehouse01..11` stay fixed at `45..55` / `56..66` and the numbered trailer family splits independently at `0x00000001 -> 28 maps` versus `0x00000000 -> 9 maps`. The new crossover matrix stays mixed rather than collapsing to one side too: `35/43 :: 0x00000001 -> 25 maps`, `35/43 :: 0x00000000 -> 5 maps`, `10/18 :: 0x00000000 -> 4 maps`, and `10/18 :: 0x00000001 -> 3 maps`. The checked header-cluster export keeps the same root scan bounded to only `3` families: `0x00000000 / 0x00000000 -> 27 maps`, `0xcdcdcdcd / 0xcdcdcdcd -> 9 maps`, and `0x10000000 / 0x00009000 -> 1 map` (`Alternate USA.gmp`). The stock `BuildingTypes` side is narrower too: across `77` checked `.bca` files only `MachineShop.bca` carries nonzero selector bytes at `0xb8..0xbb`, while the broader nonzero stock signal lives in the `22`-file `.bty` alias-root family with `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty` and `Warehouse.bty`. The active open question is therefore which earlier seed/projection path lifts that narrow stock-side signal and the fixed numbered cluster into nonzero live `[candidate+0xba/+0xbb]` before `0x00412d70` and `0x00419230` consume it.
+  The grounded owner strip is `0x004196c0 -> 0x00414490 -> 0x00416ce0 -> 0x00419230`, and the checked candidate-table exports now keep the concrete scenario-side families explicit too: among the `37` probe-bearing maps, `Port00/Warehouse00` stay at `35/43` on `30` maps and shift earlier to `10/18` on `7`, while `Port01..11` / `Warehouse01..11` stay fixed at `45..55` / `56..66` and the numbered trailer family splits independently at `0x00000001 -> 28 maps` versus `0x00000000 -> 9 maps`. The new crossover matrix stays mixed rather than collapsing to one side too: `35/43 :: 0x00000001 -> 25 maps`, `35/43 :: 0x00000000 -> 5 maps`, `10/18 :: 0x00000000 -> 4 maps`, and `10/18 :: 0x00000001 -> 3 maps`. The checked header-cluster export keeps the same root scan bounded to only `3` families: `0x00000000 / 0x00000000 -> 27 maps`, `0xcdcdcdcd / 0xcdcdcdcd -> 9 maps`, and `0x10000000 / 0x00009000 -> 1 map` (`Alternate USA.gmp`). The load-side handoff is narrower now too: `0x004120b0` explicitly reads `[candidate+0xba]` and `[candidate+0xbb]` as one-byte stream fields, and the very next projection owner `0x00412d70` immediately consumes those bytes in two passes, first `+0xba` and then `+0xbb`, to pick one seed row whose full `0x1f2`-dword body will be cloned or reused for each numbered runtime record. The stock `BuildingTypes` side is narrower too: across `77` checked `.bca` files only `MachineShop.bca` carries nonzero selector bytes at `0xb8..0xbb`, while the broader nonzero stock signal lives in the `22`-file `.bty` alias-root family with `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty` and `Warehouse.bty`. The active open question is therefore which earlier seed/projection path lifts that narrow stock-side signal and the fixed numbered cluster into nonzero live `[candidate+0xba/+0xbb]` before `0x00412d70` and `0x00419230` consume it.
   Preserved checked row-family detail now lives in [Tier2 candidate row families](rehost-queue/tier2-candidate-row-families-2026-04-21.md).
   Preserved checked stock selector-byte detail now lives in [Tier2 selector-byte sources](rehost-queue/tier2-selector-byte-sources-2026-04-21.md).
   Preserved checked rebuild sequencing detail now lives in [Tier2 rebuild sequencing](rehost-queue/tier2-rebuild-sequencing-2026-04-21.md).

docs/rehost-queue/tier2-rebuild-sequencing-2026-04-21.md

@@ -18,12 +18,15 @@ owners form one coupled strip:
   - re-enters `0x00412d70`
 - `0x00412d70`
   - rebuilds candidate runtime records from scenario state
+  - runs two explicit bank passes, first on `[candidate+0xba]` and then on `[candidate+0xbb]`
   - does not consult the scenario-side recipe-book name at `[state+0x0fe8]`
+  - picks one availability-qualified seed row and either reuses or clones its full `0x1f2`-dword body
   - re-enters `0x00435630`
   - also re-enters `0x00411ce0` and `0x00411ee0`
 - `0x00412fb0`
   - broader collection-load owner
   - directly loops through the stock/import stream via `0x004120b0`
+  - `0x004120b0` itself explicitly loads selector bytes `[candidate+0xba/+0xbb]` from the stream
   - then calls `0x00412d70`
   - then calls `0x00412ab0`
   - and only after the later catalog rebuild re-enters `0x00412c10`
@@ -79,6 +82,13 @@ This keeps the active Tier-2 owner question on sequencing and data handoff, not
 
 - one side of the strip is the coupled recipe/runtime rebuild family
   `0x00435630 -> 0x00412d70 -> 0x00412fb0`
+- the loader edge is explicit now: `0x004120b0` is the stream-side owner that reads
+  `[candidate+0xba/+0xbb]` as one-byte parser fields before `0x00412fb0` falls into the runtime
+  projection pass
+- the projection edge is explicit in the same way: `0x00412d70` does not just “see banked bytes”
+  abstractly, it runs one pass that accepts only nonzero `[candidate+0xba]` rows and one pass that
+  accepts only nonzero `[candidate+0xbb]` rows, reusing a matching prior ordinal when available and
+  otherwise cloning the full seed-row body
 - the other side is the later named-availability preseed/latch family
   `0x00437737 -> 0x00434f20 -> 0x00412c10`
 - the early checkpoint only refreshes `0x00412c10` when the live candidate pool already exists,