Tighten remaining atlas edge conclusions

artifacts/exports/rt3-1.06/function-map.csv

@@ -940,7 +940,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x00595440,98,multiplayer_transport_init_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot.,ghidra + rizin + llvm-objdump + strings
 0x005954b0,238,multiplayer_transport_reset_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.,ghidra + rizin + llvm-objdump
 0x00595620,35,multiplayer_transport_release_route_binding,shell,cdecl,inferred,ghidra-headless,3,Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8].,ghidra + rizin + llvm-objdump
-0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The currently grounded mode transitions converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.,ghidra + rizin + llvm-objdump + strings
+0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,"Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and now has a clearer branch split: mode `0` enters the gsi_am_rating direct-versus-queued descriptor lane, mode `1` applies the ready-bit gate plus queued fallback, mode `2` performs pending-descriptor cleanup, mode `3` forces the empty-table fallback, mode `4` handles the deferred route-status recovery branch, and mode `5` mirrors the staged route companion dword into the local cache family. The stable transitions still converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.","ghidra + rizin + llvm-objdump + strings"
 0x00595860,125,multiplayer_transport_handle_staged_route_callback_submit_result,shell,cdecl,inferred,objdump + local disassembly,3,"Completion callback used by `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`. On a nonzero submit result it first checks whether the third selector-generation counter at `[this+0xac0]` exceeds `1`; when it does, the helper counts matching selector-view entries for slot `2` through `0x594e30` using the current transport name buffer at `[this+0x04]`. A positive count advances the route-mode state machine through mode `3`, and when the transport remains in route mode `3` and the same third selector-generation counter has reached the target at `[this+0xb48]` it advances once more through mode `4`. Otherwise, and on the zero-result path too, it resets selector slot `2` to the default sample through `multiplayer_transport_reset_selector_slot` `0x5954b0`; when the current route mode is still `2` it then re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `2`. This now bounds the callback as a real staged-route-capacity submit result handler rather than a generic route-mode nudge.","objdump + local disassembly + caller correlation + selector-generation correlation"
 0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. Current evidence does not yet prove this tuple is the same field family as the selector-view probe marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation"
 0x00595d00,83,multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple,shell,cdecl,inferred,objdump,3,"Small compatibility gate over one staged route-callback payload versus the current bound route object. It compares the caller payload's primary descriptor dword through `0x58d1f0` against bound-route field `[binding+0x54]`; when payload byte-flag getter `0x58d220` carries bit `0x2`, it also requires getter `0x58d240` to match `[binding+0x58]` and getter `0x58d250` to match word `[binding->route+0x30]`; otherwise it falls back to getter `0x58d200` against that same route word. Current grounded caller is multiplayer_transport_check_openstaging_capacity_gate at `0x595d60`, where this tuple check can short-circuit the broader capacity path. This row is now intentionally scoped to the route-binding descriptor family, not the selector-view `X...X|%d` marker tuple.","objdump + caller inspection + descriptor-getter correlation + route-binding-layout correlation"