Tighten remaining atlas edge conclusions

artifacts/exports/rt3-1.06/function-map.csv

@@ -940,7 +940,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00595440,98,multiplayer_transport_init_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot.,ghidra + rizin + llvm-objdump + strings
 0x005954b0,238,multiplayer_transport_reset_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.,ghidra + rizin + llvm-objdump
 0x00595620,35,multiplayer_transport_release_route_binding,shell,cdecl,inferred,ghidra-headless,3,Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8].,ghidra + rizin + llvm-objdump
-0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The currently grounded mode transitions converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.,ghidra + rizin + llvm-objdump + strings
+0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,"Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and now has a clearer branch split: mode `0` enters the gsi_am_rating direct-versus-queued descriptor lane, mode `1` applies the ready-bit gate plus queued fallback, mode `2` performs pending-descriptor cleanup, mode `3` forces the empty-table fallback, mode `4` handles the deferred route-status recovery branch, and mode `5` mirrors the staged route companion dword into the local cache family. The stable transitions still converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.","ghidra + rizin + llvm-objdump + strings"
 0x00595860,125,multiplayer_transport_handle_staged_route_callback_submit_result,shell,cdecl,inferred,objdump + local disassembly,3,"Completion callback used by `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`. On a nonzero submit result it first checks whether the third selector-generation counter at `[this+0xac0]` exceeds `1`; when it does, the helper counts matching selector-view entries for slot `2` through `0x594e30` using the current transport name buffer at `[this+0x04]`. A positive count advances the route-mode state machine through mode `3`, and when the transport remains in route mode `3` and the same third selector-generation counter has reached the target at `[this+0xb48]` it advances once more through mode `4`. Otherwise, and on the zero-result path too, it resets selector slot `2` to the default sample through `multiplayer_transport_reset_selector_slot` `0x5954b0`; when the current route mode is still `2` it then re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `2`. This now bounds the callback as a real staged-route-capacity submit result handler rather than a generic route-mode nudge.","objdump + local disassembly + caller correlation + selector-generation correlation"
 0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. Current evidence does not yet prove this tuple is the same field family as the selector-view probe marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation"
 0x00595d00,83,multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple,shell,cdecl,inferred,objdump,3,"Small compatibility gate over one staged route-callback payload versus the current bound route object. It compares the caller payload's primary descriptor dword through `0x58d1f0` against bound-route field `[binding+0x54]`; when payload byte-flag getter `0x58d220` carries bit `0x2`, it also requires getter `0x58d240` to match `[binding+0x58]` and getter `0x58d250` to match word `[binding->route+0x30]`; otherwise it falls back to getter `0x58d200` against that same route word. Current grounded caller is multiplayer_transport_check_openstaging_capacity_gate at `0x595d60`, where this tuple check can short-circuit the broader capacity path. This row is now intentionally scoped to the route-binding descriptor family, not the selector-view `X...X|%d` marker tuple.","objdump + caller inspection + descriptor-getter correlation + route-binding-layout correlation"

docs/atlas/company-and-ledger.md

@@ -66,7 +66,7 @@ Current bounded compatibility impact:
 
 Highest-value open edge:
 
-- The remaining semantic meaning of the annual finance ladders is now narrower:
+- The remaining semantic meaning of the annual finance policy branches is now narrower:
   stat-family `0x2329/0x1d` is now bounded as current `Book Value Per Share` in the stock-issue
   denominator path, `0x2329/0x0d` is now bounded there as the current cash gate before the
   bond-rate-versus-support ladder, the broader support-adjusted share-price or public-support lane
@@ -79,14 +79,20 @@ Highest-value open edge:
   shareholder-payout lane `0x23`,
   raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`, and
   derived slot `0x2b` now reads as the rolling net-profits lane. The main remaining gap is the
-  lower policy interpretation of how those lanes are blended inside the annual bankruptcy,
-  dividend, and city-connection ladders. The current strongest read is:
-  bankruptcy = sustained revenue-band-selected cash-and-debt stress plus repeated net-profit
-  failures and fuel burden, with one later deep-distress fallback when cash is below `-300000`
-  and the first three recent profit years all sit at or below `-20000`; stock issuance = a
-  valuation-versus-borrowing screen over
-  support-adjusted price-to-book against the highest live coupon band; dividend adjustment = a
-  weighted recent-profit-per-share target with a small-unassigned-share cash supplement before the
-  board ceiling clamp. The debt-news tail is also now explicit: it compares total retired versus
-  newly issued principal to pick `2882..2886`, and the stock-buyback tail separately publishes
-  `2887` from the accumulated repurchased-share count.
+  exact weight schedule and gate ordering used inside the already-bounded annual bankruptcy,
+  debt, repurchase, stock-issue, and dividend branches. The current strongest read is now:
+  bankruptcy = first the year, toggle, and cooldown gates, then the three-year scan, then the
+  revenue-band-selected cash-and-debt ladder, then the support-adjusted share-price threshold,
+  then the fuel-cost lane and net-profit accumulator; the later deep-distress fallback then
+  re-checks cash below `-300000` plus the first three recent profit years at or below `-20000`.
+  Stock issuance = first the bond/stock toggle gates, then the outstanding-share tranche sizing,
+  then the `55000` proceeds cap, then the support-adjusted price-to-book screen against the
+  highest live coupon band. Dividend adjustment = first the toggle and age gates, then the
+  weighted recent-profit-per-share target, then the small-unassigned-share cash supplement, then
+  the board ceiling clamp. The remaining gap is now mostly the near-cutoff ordering inside the
+  stock-issue lane, and the current strongest read places the liquidity gate at `0x2329/0x0d`
+  before the valuation gate at `0x2329/0x1d`. The dividend-ceiling clamp is already separately
+  bounded on the dividend branch. That is now a final precedence question, not a missing
+  ownership gap in the annual finance verbs themselves. The debt-news tail is also now explicit:
+  it compares total retired versus newly issued principal to pick `2882..2886`, and the
+  stock-buyback tail separately publishes `2887` from the accumulated repurchased-share count.

docs/atlas/editor-and-site-service.md

@@ -32,6 +32,9 @@ Current grounded runtime chain:
 - `placed_structure_rebuild_candidate_cargo_service_bitsets`
 - `placed_structure_rebuild_candidate_local_service_tables`
 - `placed_structure_refresh_local_service_score_bundle`
+- `placed_structure_query_candidate_local_service_metrics`
+- `placed_structure_count_candidates_with_local_service_metrics`
+- `placed_structure_query_cached_express_service_class_score`
 
 Current grounded shell-side consumers:
 
@@ -50,5 +53,12 @@ What this note is for:
 
 Highest-value open edge:
 
-- The deeper gameplay meaning of the per-site local service tables and how those scores drive live
-  city or structure behavior beyond the currently bounded shell summaries.
+- The deeper gameplay meaning of the per-site local service tables is now mostly about whether
+  those scores stay confined to placement, overlay, and station-summary presentation through the
+  query helpers, or whether the same query outputs also feed live cargo-economy filter flags,
+  per-site service-cap rebuilds, or nearby-structure behavior beyond the currently bounded shell
+  summaries. The grounded chain strongly suggests the read-side path is dominant, the query
+  helpers themselves still read as read-only consumers, and the only grounded mutation bridge is
+  the collection-wide cargo-economy filter refresh. The remaining open question is whether that
+  filter refresh is the full policy sink for the local service tables or whether an additional
+  mutation-side writer exists outside the local corpus.

docs/atlas/multiplayer.md

@@ -150,9 +150,10 @@ Highest-value open edge:
   The negative result is stronger now too: the neighboring replay-band fields
   `[transport+0x176c]`, `[transport+0x1770]`, `[transport+0x1774]`, `[transport+0x177c]`,
   `[transport+0x1780]`, and `[transport+0x1784]` all have direct local lifecycle owners, but
-  `[transport+0x1778]` still only appears as the single read in `0x595bc0`. So the remaining
-  writer is upstream and indirect rather than one ordinary direct field store in the local text
-  cluster. One adjacent staged-route callback is
+  `[transport+0x1778]` still only appears as the single read in `0x595bc0`. So this is no longer
+  a local ownership gap: no local writer is grounded, and the remaining staging path is best read
+  as upstream and indirect rather than one ordinary direct field store in the local text cluster.
+  One adjacent staged-route callback is
   tighter now too: `0x595860` is the submit-result handler below
   `0x5958e0`, using the already-grounded third selector-generation counter at `[transport+0xac0]`
   plus the target at `[transport+0xb48]` to choose whether staged route-callback traffic can

docs/atlas/route-entry-and-trackers.md

@@ -127,8 +127,15 @@ What this note is for:
 
 Highest-value open edge:
 
-- The remaining semantic edge here is narrower now:
-  whether the pre-`1.03` versus `1.03+` tracker metric split has any meaningful downstream effect
-  beyond ranked linked-transit site choice and seeded peer-route choice, since current evidence
-  says the company train-pressure target still sums raw site cache `+0x12` rather than the
-  weighted lanes fed by step count and continuity.
+- The remaining semantic edge here is now mostly about ranking, not company pressure:
+  the pre-`1.03` versus `1.03+` tracker metric split still looks meaningful for the weighted
+  linked-transit site-score cache at `company_rebuild_linked_transit_autoroute_site_score_cache`
+  `0x00407bd0` and the seeded peer-route chooser at `company_build_linked_transit_autoroute_entry`
+  `0x00408380`, but current evidence says the company train-pressure target still sums raw site
+  cache `+0x12` rather than the weighted lanes fed by step count and continuity. The lower
+  route-entry pair metric still has other grounded consumers such as the initial route sweep and
+  the train route validator through `0x004a6630`, but no downstream consumer of the cached weighted
+  site lanes `+0x0e/+0x16` is currently grounded beyond the autoroute selector `0x00408280` and
+  builder `0x00408380`. So the remaining question here is no longer about current local ownership;
+  it is only whether some still-ungrounded consumer outside the current corpus also reads those
+  cached weighted lanes.

docs/atlas/runtime-and-world-tools.md

@@ -131,5 +131,10 @@ What this note is for:
 
 Highest-value open edge:
 
-- Whether any later gameplay-owned mode bypasses the shell-controller-backed input and frame path
-  for ordinary world interaction.
+- Whether any later gameplay-owned mode introduces a distinct input or frame owner for ordinary
+  world interaction, or whether the grounded `shell_controller_window_message_dispatch` plus
+  `simulation_frame_accumulate_and_step_world` path remains the sole coordinator after world
+  entry and the first grounded non-camera world-input coordinator. Current evidence now points
+  strongly to the second reading: the shell-fed input and frame path remains the only grounded
+  coordinator after world entry, and no separate outer gameplay loop or gameplay-only input object
+  is grounded in the local corpus.

docs/control-loop-atlas.md

@@ -983,9 +983,9 @@ transition.
   failure strings 3083 3084 3837 and 3900, the binding-registry lookup path at `0x0045f370`, the
   registration block at `0x00460769` through `0x004608e7`, and the localized labels in
   `Data/Language/RT3.lng` ids `3466` through `3473`.
-- Open Questions: no separate outer gameplay loop is grounded above
-  `simulation_frame_accumulate_and_step_world` yet and no deeper gameplay-only input object is
-  grounded either. The new setup-pipeline evidence narrows that question in one direction: the
+- Open Questions: current evidence grounds the shell-controller-backed input and frame path as the
+  only coordinator after world entry; no separate outer gameplay loop or gameplay-only input
+  object is grounded yet. The new setup-pipeline evidence also points the same way: the
   currently grounded chunked burst path at `0x00437b20` now looks subordinate to
   `world_run_post_load_generation_pipeline` rather than to the ordinary speed controls, and even
   there it still reuses the same lower stepper and pumps shell work between chunks instead of