# Input, Save/Load, and Simulation: Runtime Roots, Camera, and Support Families

### Runtime Roots and Cadence

- Roots: the shell controller window-message ingress `shell_controller_window_message_dispatch` at
  `0x0054e3a0`, the shell input-state object initialized at `0x006d4018` through
  `shell_input_state_init` `0x0054e710`, the saved-world restore path
  `world_load_saved_runtime_state_bundle` at `0x00446d40`, the live-world save path
  `world_runtime_serialize_smp_bundle` at `0x00446240`, `world_entry_transition_and_runtime_bringup`
  at `0x00443a50`, the frame-owned cadence `simulation_frame_accumulate_and_step_world` at
  `0x00439140`, the recurring `GameMessage.win` service branch through
  `game_message_window_service_if_present` `0x004e0720`, the world-facing `GameUppermost.win`
  overlay branch ensured by `shell_ensure_game_uppermost_window` `0x004e0e40` and serviced through
  `game_uppermost_window_service_world_hotspot_band` `0x004e0780`, and the lower step family rooted
  at `simulation_advance_to_target_calendar_point` `0x0040ab50` with periodic branches through
  `simulation_service_periodic_boundary_work` `0x0040a590`.
- Trigger/Cadence: shell-side input is event-driven by controller-window `WM_*` traffic while save
  or load work is triggered either directly from shell commands or through the `fileopt.win` branch
  flags into the `.smp` runtime-state family; post-bring-up world service becomes recurring once a
  world root exists at `0x0062c120`, but the current grounded top-level cadence still remains the
  shell-owned `shell_service_pump_iteration` path, which calls
  `simulation_frame_accumulate_and_step_world` directly and lets it accumulate elapsed wall-clock
  time into one or more simulation-step quanta. A second ingress is now bounded too:
  `simulation_run_chunked_fast_forward_burst` at `0x00437b20` repeatedly calls the same lower
  stepper `simulation_advance_to_target_calendar_point`, but current grounded callers put that
  helper inside the larger post-load generation pipeline `world_run_post_load_generation_pipeline`
  at `0x004384d0` under the `Seeding Economy...` phase rather than under the ordinary player-facing
  speed buttons. That setup pipeline is now clearer at the progress-banner level too: on the fuller
  setup path it first runs one preliminary named-candidate availability prepass through `0x00437737`
  before any visible progress banner is posted. One startup-side selector edge is tighter now too:
  `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` reaches an early
  selector-`2` branch at `0x00438a66..0x00438c00` that refreshes one support-family type-`7`
  record from setup path buffer `0x006d1370` through `0x0053d130`, strips the basename extension
  into a local label buffer, briefly drops the nested mouse-cursor hold through `0x0053f310`,
  builds three progress-text payloads, and re-enters the hold through `0x0053f2f0` before the
  common world-root bring-up continues. After that, localized id `318`
  `Computing Transportation and Pricing...` stays visible while the pipeline runs
  `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection-owned staging pass
  `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`,
  `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50`, and the conditional region pair
  `world_region_collection_seed_default_regions` `0x00421b60` plus
  `world_region_collection_refresh_neighbor_and_profile_bands` `0x00420f30`. One save-load-side
  status-stack strip is now tighter too: `0x004422d0/0x00442330` push and pop the low bytes of the
  same four shell lanes `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte
  `[0x006cec78+0x4c74]` through the local stack `0x0062be90` with depth `0x0062bedc`, and the
  paired wrappers
  `0x004423a0/0x004423d0` bracket that same band while also servicing the live TrackLay.win and
  StationPlace.win tool objects through `0x0050e070`, `0x00507a50`, `0x0050a530`, and
  `0x0050e1e0`. The live `.smp` serializer uses the higher pair, while the neighboring world-entry
  branch `0x00443a50` and non-`.smp` package-save tail under `shell_map_file_world_bundle_coordinator`
  `0x00445de0` now show the raw split explicitly. `0x00443a50` calls `0x004422d0` at `0x444e2c`,
  services TrackLay.win and StationPlace.win entry-side helpers through `0x444e3b/0x444e4a`, then
  later calls `0x00442330` at `0x444ecb` and services the recurring tool frames through
  `0x444eda/0x444ee9`. The package-save tail similarly calls `0x00442330` directly at `0x00445a55`
  and then services StationPlace.win and TrackLay.win at `0x00445a64/0x00445a73` without
  re-entering `0x004423d0`. So the save/load-side tool choreography is no longer one uniform wrapper
  path across world-entry, package-save, and `.smp` branches, and current local evidence does not
  show `0x00446d40` itself directly re-entering either the raw pair or the higher wrapper pair.
  `world_region_border_overlay_rebuild` `0x004882e0`. The transport/pricing side is tighter now
  too: `0x0044fb70` first routes one null-build path through the preview ensure wrapper
  `0x0044faf0`, whose deeper worker `0x0044f840` allocates a default target through
  `0x00534930`, seeds five palette entries through `0x0051de10`, maps each target pixel back into
  the live secondary raster through `0x00533970/0x00533980`, uses the low-3-bit class split plus a
  local `+/-4` neighborhood and `0x0051db80` to choose the preview color, and only then re-enters
  `0x0044e940` on the full rectangle. The later `322` side is tighter now too: the top owner
  `0x0044d410` rejects while generation counter `[world+0x2205]` is live or when `0x00449e90`
  cannot supply a surviving work rect, then forwards that rect into `0x005374d0`, `0x00533e70`,
  and `0x00537010`, notifies the shell owner at `0x0062be68`, and refreshes neighboring region or
  manager companions through `0x00421f50`, `0x00461770`, and `0x00415340`. `0x00421f50` itself is
  now bounded as the narrow class-0 side of that refresh: it scans the live region collection for
  class-0 records whose normalized coordinates fall inside the caller-supplied float rectangle and
  republishes each surviving region's current-position triplet through `0x00455a70(0)`. The local
  companion-float strip under that same owner is tighter now too: `0x0044d4e0` and `0x0044d6e0`
  are sibling five-pass cross-neighbor relaxers over `[world+0x1605]`; both clamp the caller
  rectangle, average the four cardinal neighbors, subtract the current sample, scale the delta by
  one fixed coefficient and caller gain, and then feed the surviving rectangle back into
  `0x0044d410`. The first helper only checks raster bit `0x01` in `[world+0x2135]`, while the
  second adds the tighter acceptance gate `0x004499c0` and can skip the final `0x0044d410` tail
  when its caller disables that refresh. Their center-biased sibling `0x0044d880` is now bounded
  too: it seeds one baseline from the current center sample when its caller gain is positive,
  expands one square neighborhood by radius, and raises surrounding cells toward that baseline
  through the same `0x0051dc00` falloff model before tailing into `0x0044d410`. The local
  peak-oriented sibling `0x0044da70` then raises one clamped square neighborhood by quantized
  local maxima and on its optional branch also consults `0x00534f00` before keeping the larger
  peak. So the `0x0044d4e0/0x0044d6e0/0x0044d880/0x0044da70` band now reads as the local
  companion-float refinement layer immediately beneath the shared `Calculating Heights...` owner
  rather than a set of unrelated scalar writes. The default-region side is tighter too:
  one earlier class-0-only helper `0x0041fb00` now sits directly under that same family too:
  it skips nonzero `[region+0x23e]` records, rounds the region center through
  `0x00455800/0x00455810/0x005a10d0`, stamps one orientation-dependent local secondary-overlay
  pattern through `0x00534e10` plus `0x004497a0`, and then runs one bounded scored refinement pass
  through `0x0051db80`, `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0`. The finalizer
  `0x00421730` then clears the per-cell region word at `[world+0x212d] + cell*4 + 1` across the
  full live world raster, seeds each live region's cached bounds fields, and repopulates that same
  raster by writing the nearest class-0 region id `[region+0x23a]` into empty or weaker cell slots
  from one bounded center-and-radius sweep. The region-profile side is tighter too: `0x0041f940`
  counts only the current subcollection entries whose backing
  candidates pass `0x0041f998`, and that smaller predicate now has one real content split instead
  of staying anonymous. Candidates whose subtype byte is not `2` pass immediately, while subtype-2
  candidates only pass when either availability word `[candidate+0xba]` or runtime recipe latch
  `[candidate+0x7ac]` is nonzero; `0x00412af0/0x00412b70` now ground the lookup step beneath both
  counters as a casefolded profile-label-to-candidate resolver over the global candidate pool
  `0x0062b268`; and the stricter year-filtered counter `0x0041f9b0` then stacks the subtype and
  `[candidate+0x26] <= max_year` gates on top of that same availability test. Two adjacent
  collection helpers are grounded now too. `0x0041fa30` linearly scans the same region profile
  collection `[region+0x37f]`, compares labels through `0x005a57cf`, and returns profile-weight
  float `[entry+0x1e]` from the first casefolded match or the shared zero float when none match;
  `0x0041fac0` resolves one 1-based ordinal out of that same collection and copies both the
  matched profile label and weight `[entry+0x1e]` to caller-owned outputs. Those reads line up with
  the editor copy-industry mutator `0x004206b0`, which already treats `[entry+0x1e]` as the live
  editable profile-weight lane. That border
  pass is now tighter too: the
  outer owner refreshes the companion region set `0x006cfc9c` through the reset-and-assign wrapper
  `0x00487650` above the heavier record initializer `0x00487540`, then re-enters `0x004881b0` to
  refresh the raw per-region cell-count band from the live world raster, and the inner emitter
  `0x00487de0` clears prior chunked segment queues through `0x00533cf0`, scans the live region
  raster, and appends fresh border-segment records through `0x00536ea0`. The lower presentation
  helper strip under the same owner is now explicit too: `0x00533970/0x00533980` query the cached
  world-grid X/Y maxima, `0x00533990` stores the secondary-overlay shift field `[world+0x15e1]`,
  `0x005339a0` builds one plane equation from three XYZ points, and `0x00533a30` uses the same
  three-point patch to solve one sampled height at caller-supplied `(x,z)`,
  `0x00533ae0/0x00533af0/0x00533b00` expose the secondary-raster and companion byte-raster roots,
  and `0x00533b20/0x00533b30/0x00533b70/0x00533b90` expose the normalized coordinate, strip-offset,
  and sample-triplet tables used by shell-side overlay staging. The adjacent queue side is tighter
  now too: `0x00533bc0/0x00533bd0/0x00533be0` are the direct append, remove, and root getters for
  shell queue `[this+0x166d]`; `0x00533bf0/0x00533c20` are the cell-addressed attach/detach
  helpers over nearby-presentation table `[this+0x1671]`; `0x00533c50/0x00533c70/0x00533ca0` do
  the same for the region-border overlay chunk table `[this+0x1679]`; and
  `0x00533dd0/0x00533e00` are the matching geographic-label cell-table attach/detach wrappers over
  `[this+0x1675]`. The downstream layout-state staging side is bounded now too:
  `0x005454c0` snapshots the current slot-triplet table into the history list `[layout+0x259f]`,
  `0x00545520` is the optional per-slot item-binding setter over `[layout+0x2593]`, normalizing
  mismatched item mode tokens through `0x005435d0` before publishing node property slot `+0xf4` on
  `[layout+0x25df]`, and `0x00548940` is the paired seeded-triplet applier that walks the
  temporary `0x18`-byte record list at `[layout+0x259b]` and forwards both triplet halves into
  `0x005455e0/0x005456d0` for the first `N` destination slots. The neighboring probe strip is
  bounded now too: `0x00548820` seeds every live slot to the fixed triplet pattern `(1,2,1)` in
  both triplet halves, `0x005488a0` snapshots the current slot-triplet table into that same seeded
  list and can immediately re-apply it, while `0x005489f0` uses literal `TextureForTests` to run
  one layout-side binding probe whose boolean result is later mirrored into shell capability bytes
  `[0x006d4024+0x114250/+0x114251]`. The setup-side owner over that same strip is bounded now too:
  `0x0055ddc0` chooses one small resolution tier from shell dimensions
  `[0x006d4024+0x11423b/+0x11423f]`, seeds a sequence of fixed slot-triplet patterns, snapshots the
  resulting tables into local probe handles, and then drives the same `TextureForTests` probe to
  populate shell capability bytes `[0x006d4024+0x114250/+0x114251]`. The broader lifecycle side is bounded too:
  `0x00547610` is the one-shot publisher for cached bound-node pair `[layout+0x2607/+0x260b]`,
  `0x00547640` clears that publish gate again, `0x00542c10` is the shell-side sweep that releases
  the active global layout-cache entries rooted at `0x00ccbb2c`, `0x0054be60` exports the live
  `0x72c`-byte preset table `[layout+0x840]` into the global default cache `0x00ccbb68` and refreshes
  the shell-side state, `0x00548c50` is the pre-release cleanup owner for history list `[layout+0x259f]`,
  seeded list `[layout+0x259b]`, and optional slot bindings `[layout+0x2593]`, `0x0054a190` is the
  broader bound-presentation release body that drops the same node and controller slot
  `[0x006d4024+0x08]`, `0x005463e0` and `0x005465c0` are the two adjacent notice-emitting handle-bank
  cleanup strips beneath it, with `0x005463e0` now grounded as the five-handle midband release set
  `[layout+0x260f/+0x2617/+0x261f/+0x2627/+0x262f]`, and `0x00547650` is the capability-gated property-strip owner over the
  bound node plus auxiliary handles `[layout+0x2623/+0x2633]`,
  while the small adjacent helper `0x00546390` now reads as the apply-or-reject bridge that asks
  shell helper `0x0051f0f0` to resolve one intermediate object from a caller resource plus bound-node
  pair `[layout+0x25df]` and then forwards that object into bound owner `[layout+0x25db]` through
  slot `+0x3c`, returning success when the owner accepts it,
  `0x005478a0` is the trig-derived alternate property strip over `[layout+0x261b/+0x262b]`,
  `0x00547c30` is the shared four-scalar publisher that stores local band
  `[layout+0x36df/+0x36e3/+0x36e7/+0x36eb]` and emits the derived property-`0x07` block,
  `0x00546d40` is the descriptor-publish helper fed by local scalar bands `[layout+0x2517..+0x25ff]`
  plus seeded handle `[layout+0x36fd]`, and the lower bind/publish strip is bounded now too:
  `0x005471f0` is the shared table-bind helper that chooses node property `0x112` or `0x142` by
  record size and can also publish one companion dword through property `0x154`;
  `0x005472a0/0x00547300` are the clear/publish helpers for property `0x1b`;
  `0x005472c0/0x005472f0` are the adjacent shell-flag-driven set/clear helpers for local byte
  `[layout+0x36f8]`;
  `0x00547320/0x00547380` are the capability-gated apply/clear helpers for the
  `0x0f/0x18/0x19` property strip;
  `0x00546760/0x00546780` are the two tiny caller-driven publishers for property `0x07` and
  property `0x09 = caller + 1`;
  `0x00548030/0x00548060` are the two adjacent fixed property-pair setters for
  `0x13/0x14 = 1/6` and `0x13/0x14 = 5/6`;
  `0x00544270` is the tiny scalar-pair store into `[layout+0x25ef/+0x25f3]`,
  `0x00544360` is the identity-reset publisher for local descriptor `[layout+0x34ef]`,
  `0x00544290` is the sibling descriptor publisher for `[layout+0x352f]` from one integer span
  pair, `0x005443b0` is the copy-side sibling that republishes one incoming descriptor payload from
  caller offset `+0xce`, and `0x00544450` is the tiny query-and-optional-clear helper for local
  flag byte `[layout+0x36f7]`. The next local recompose strip is bounded now too:
  `0x005443f0` exports the current `0x33ab` handle pair plus one auxiliary band into caller record
  payload offsets `+0xce/+0x10e/+0x14e`, `0x00544470` recomposes local blocks
  `[layout+0x356f/+0x362f/+0x35af/+0x33ef]` from the adjacent descriptor blocks through the shared
  matrix-style helpers `0x0056d3cd`, `0x0056d616`, and `0x0056d8d9`, `0x00544500` is the sibling
  recompose owner that writes the final result into `[layout+0x366f]`, `0x00544630` is the tiny
  scalar-triplet store into `[layout+0x2533/+0x2537/+0x253b]`, and `0x00544660` is the four-outparam
  query helper for local rect band `[layout+0x2523/+0x2527/+0x252b/+0x252f]`. The projection side
  beneath that strip is explicit now too: `0x005446b0` projects caller XYZ through local block
  `[layout+0x33ef..+0x342b]` into one XY pair, `0x00544750` is the visibility-gated sibling that
  projects through `[layout+0x33af..+0x33eb]` into XY plus optional depth, and `0x00544860`
  applies local descriptor `[layout+0x34ef..+0x352b]` to one vec3 with a projective divide, while
  `0x00544930` composes local blocks `[layout+0x34ef/+0x35ef/+0x352f]`, applies weighted caller
  XYZ through that stack, rejects the result on the same projective sign test, and otherwise emits
  XY plus one derived score,
  `0x00544a80` maps one local XY pair through cached rect band
  `[layout+0x2523/+0x2527/+0x252b/+0x252f]` and affine coefficient triplet
  `[layout+0x342f..+0x346b]` into XYZ, and `0x00544b80` is the relative-output sibling that
  subtracts that mapped XYZ from one caller-supplied vec3 reference block. The small property-pair
  strip is complete now too: `0x00544c80/0x00544cf0/0x00544d20` clear or arm the same `0x0d/0x0e`
  pair for selectors `4`, `2`, and `1`; the next rect-strip owner is bounded now too:
  `0x00548120` resets the identity block,
  ensures fallback handle `[layout+0x25e3]`, and refreshes the current span; `0x00548180` stores
  normalized local rect band `[layout+0x2523/+0x2527/+0x252b/+0x252f]`, publishes either a dynamic
  or fallback block, and then refreshes the same span; `0x0052d4d0` is the controller-side bridge
  that materializes one active-display rectangle from normalized scalar band
  `[controller+0x50..+0x5c]`; and `0x005482e0` is the join point that either feeds that rectangle
  into `0x00548180` or falls back to a direct width/height span refresh through `0x00544290`;
  `0x0054bb10` is the alternate segment-record bind over `[layout+0x263f]`;
  `0x0054bbd0` and `0x0054bbf0` are the two tiny wrappers that reuse `0x005471f0` for the
  `0x264f/+0x2653` and `0x2647/+0x264b` bind-and-publish pairs. The next owner layer is bounded too:
  `0x0054a500` is the wider branch that clears the visited-byte strip, pulses the surrounding
  property gates, derives two normalized shell scalars, and then either rescales rows from handle
  `[layout+0x2663]` through the local four-scalar band or publishes the local descriptor set rooted
  at `[layout+0x35af]` before committing the same variant-bank-backed batch ranges.
  `0x0054ab20`, `0x0054b030`, and `0x0054b4e0` are the three setup-side batch-refresh owners that
  all walk the `0x2d`-stride batch records rooted at `[layout+0x266f]`, but split cleanly into a
  three-slot candidate-binding variant, a two-slot candidate-binding variant, and a narrower
  `0x265f`-backed capability-switch branch. That last branch is tighter now: `0x0054b4e0` first
  tries a special descriptor bind by asking node slot `+0x128` whether handle `[layout+0x265f]`
  plus the caller pair can be accepted directly, and only on failure does it fall back to the
  capability-selected property path that either raises `0x2c4` and binds `[layout+0x265f]` on
  property `0x28`, or raises `0x1c4` and binds the same handle on property `0x20`, before walking
  the same variant-bank-backed batches with the narrower slot-`0` plus optional slot-`1` clear
  behavior.
  One layer above those batch owners, `0x0054bea0` is now bounded as the interpolated preset-row
  owner. It treats the preset table at `[layout+0x840]` as `0x33`-byte rows, blends two caller-
  selected rows into the local pose and color bands
  `[layout+0x24f0..+0x250c/+0x2510..+0x251f]`, applies extra amplitude terms from
  `[layout+0x25af/+0x25fb/+0x2603]`, reuses the same `0x265b/0x112` and `0x265f` bind decisions as
  the neighboring batch owners, packages one stack descriptor through node slot `+0xb0`, stores the
  packed RGB into `[layout+0x25a3]`, and then finishes through `0x0054a280` so the resulting pose
  and color state becomes live on the bound presentation node.
  One layer further up, `0x0054c420` is now bounded as a timed vertex24 batch-stream owner rather
  than another anonymous setup blob. It resets the same presentation node side, rebinds
  `[layout+0x2647]` onto property `0x142` when needed, reads one `0x2800`-byte block from that
  handle, materializes one fixed `0x28`-entry stack batch, and then spends about `1000` ms driving
  repeated `0xc80`-byte commits through node slot `+0x118`. The smaller helpers beneath it are now
  grounded too: `0x0054c880` refreshes local count field `[layout+0x19]` from base count
  `[layout+0x15]` plus scalar `[layout+0x36a0]`, clamped to `[[layout+0x15] >> 1, 0xff]`, while
  `0x0054c8f0` is the paired getter. The timed owner's tail computes one elapsed-work ratio,
  publishes bound pair `[layout+0x2607/+0x260b]` once through node slot `+0x7c`, re-raises property
  `0x89` from template byte `[layout+0x83c+0x22]`, forces property `0x07 = 1`, and returns that
  ratio in `st(0)`.
  The next body down, `0x0054c900`, is no longer just a raw internal branch. It services a
  `0x10`-entry local slot band rooted at `[layout+0x4ad]` with stride `0x31a`, gated by the same
  refreshed local count `[layout+0x19]` plus active-slot counter `[layout+0x22b57]`. It first
  resets subordinate layout-state `[layout+0x2d]` through `0x005467e0`, `0x00545080`, and
  `0x00547320(1)`, then uses the timer or RNG globals at `0x00d93828..0x00d93834` to seed new
  slots or advance live ones. Those slots can attach to caller-owned records from `[arg+0x40c]`
  through the `0x00554210/0x005545d0/0x005543a0/0x00554340/0x005542c0/0x005543f0` strip, and each
  active slot expands into repeated `0x18`-byte generated records while counters `[layout+0x71]`
  and `[layout+0x75]` advance. The tail commits or clears that generated strip back through the
  same subordinate layout-state using `0x00545520`, `0x00545c50`, `0x00544f30`, `0x005450a0`, and
  `0x005467a0`.
  Its sibling `0x0054d810` now reads as a second service owner over the same slot band, not just a
  hidden math tail. It has a detach-clear fast path when `[layout+0x19] < 0x80`, lazily seeds a
  distinct global jitter table at `0x00d8d830`, refreshes subordinate layout-state `[layout+0x2d]`
  through `0x0054bb70`, `0x00544360`, `0x005457c0(0)`, `0x00545000`, and `0x00546890`, and then
  builds another generated `0x18`-byte strip by combining those jitter values with local origin
  scalars `[layout+0x369c/+0x36a0/+0x36a4]`, one time-derived color band, and the live per-slot
  bytes and countdowns under `[slot+0x4b1..+0x4c3]`. Like `0x0054c900`, it advances counters
  `[layout+0x71/+0x75]` and commits the result back through subordinate layout-state using the same
  span and property-reset helpers.
  The adjacent `0x5de2a8` subobject family under the same owner is bounded now too. `0x0055e9f0`
  is the tiny family initializer that seeds fields around `[+0xa2..+0x106]`, while `0x0055ecb0`
  is the constructor-side owner that installs vtable `0x005de2a8`, loads resource `0x87`, and
  copies the resulting dimension band into `[subobject+0xa2/+0xa6/+0xaa/+0xae/+0xb2]`.
  `0x0055ec00` is the cached-surface ensure path: it allocates one `0xec`-byte surface owner
  through `0x00543980`, materializes a zeroed RGBA backing buffer through `0x00541970`, publishes
  it through `0x005438d0`, and then consults mode table `0x0062583b` from `[subobject+0xea] << 4`
  before optionally triggering global helper `0x0053f000`. `0x0055ea60` is the paired
  table-driven service body that fills that cached surface from payload root `[subobject+0xf2]`,
  and `0x0055ed40/0x0055ed90/0x0055ee60` are the matching cached-surface release, broader
  payload-release, and readiness-or-release guards.
  The next owner layer is grounded now too. `0x0055ee80` is the timed payload-cursor service owner:
  it gates on readiness and global latch `0x00d97970`, advances payload cursor
  `[payload+0x10] -> [payload+0x08]` from elapsed ticks `0x0051d890` and rate pair
  `[payload+0x14/+0x18]`, retries completion through import thunks `0x005c8370/74/78`, and, when
  the cursor is exhausted, consults mode-table bytes `0x00625836/0x0062583a` to restart or reseed
  the payload through `0x005c836c` and `0x005c837c` before flipping completion latches
  `[subobject+0xda/+0xae/+0x106]` or calling optional callback slot `[subobject+0xd6]`.
  `0x0055f0b0` is the setup-side owner above that path: it tears down prior state through
  `0x0055ed90(0)`, formats one mode-table-backed payload name from `0x00625830`, loads that
  payload through `0x005c8368`, derives capped power-of-two surface dimensions into
  `[subobject+0xb6/+0xba]`, optionally allocates staging slab `[subobject+0xbe]`, ensures cached
  surface `[subobject+0xe6]` through `0x0055ec00`, computes local aspect or scale floats
  `[subobject+0x13/+0x17]`, primes the timed service through `0x0055ee80(1)`, and then repopulates
  the cached surface through `0x0055ea60`. `0x0055f3f0` is the compact registered-message
  dispatcher above that setup path, while `0x0055f4e0` is the live service and render owner that
  refreshes the payload or cached surface when mode-table byte `0x00625837` is set and then draws
  either a fallback marker through `0x0054f710` or the cached-surface overlay through `0x0054f640`
  plus follow-on marker sprites through `0x0054f9f0`. The family is now closed on the teardown side
  too: `0x0055f9b0` is the destructor wrapper that re-enters `0x0055ed90(1)`, decrements live
  counter `0x00d9797c`, and optionally frees the object storage.
  The adjacent sibling family rooted at vtable `0x005de318` is bounded now too. `0x0055f9f0`
  is the family initializer: it zeroes the local field band `[+0xa2..+0x102]` and
  `[+0x172..+0x1e6]`, seeds selector word `[+0x06] = 0x08`, stores sentinel `-1` into
  `[+0x192/+0x1d6]`, and seeds active-state dword `[+0x172] = 1`. `0x0055fcc0` is the
  constructor-side owner that loads resource `0x12f`, then copies `0x34` dwords from resource
  offset `+0x5f` into `[subobject+0xa2..+0x16d]`, while `0x0055ff70` is the alternate constructor
  that copies the same `0x34`-dword band from a caller-supplied record instead of a resource.
  Below that, `0x0055faf0` is the small active-state refresh helper over local range or selector
  fields and optional handle `[subobject+0x19a]`; `0x0055fb80/0x0055fba0/0x0055fbc0/0x0055fc10`
  are the row-table accessors and chain-walk queries over the `0x20`-byte row band rooted at
  `[subobject+0x176]`; `0x0055fc50` is the paired optional-handle release that also clears control
  status tokens for child control id `[subobject+0x04]`; and `0x0055ffb0` is the small helper that
  rounds normalized scalar `[subobject+0xb6]` onto the current view-height grid.
  The next owner layer in the same sibling family is bounded too. `0x00560000` assembles one
  descriptor object from local bounds, owner-relative coordinate fields, optional payload root
  `[subobject+0xf2]`, and current owner or child ids, allocates a `0x1b9`-byte record through
  `0x0053b070`, initializes it through `0x0055ab50`, binds it back to owner `[subobject+0x86]`
  through `0x0053f9c0`, seeds fallback color `[subobject+0xf6] = 0xffffff00` when needed, and then
  re-enters `0x0055faf0` to refresh the local active-state latch. The adjacent helpers
  `0x005602c0` and `0x00560300` count or select the Nth nonterminal row chain by re-entering
  `0x0055fbc0`, and `0x00560350` is the family world-anchor query that combines owner origin with
  local offsets and normalized height scalar `[subobject+0xb6]` to produce an `(x, y)` pair.
  `0x005603e0` is the broader live owner above that strip. It either renders the already-bound
  descriptor object when `[subobject+0x126]` is live, or iterates the local row table for up to
  two passes, deriving per-row anchor and span data from owner origin, local float bands, selected
  row or chain helpers `0x005602c0/0x00560300`, and optional cached surface `[subobject+0xe6]`,
  then emitting the resulting overlays through `0x0054f710`, `0x005519f0`, and callback slot
  `[subobject+0x1ce]` when present. That closes the sibling family at a real owner boundary rather
  than leaving it split between constructor and table helpers only. The next callback and state
  band is grounded too: `0x00560e50` rebuilds the callback-row cache in `[subobject+0x18a/+0x18e]`
  and dispatches it through callback slots `[subobject+0x1c6/+0x1ca]`; `0x00561150` is the small
  refresh wrapper above that path that can also advance `[subobject+0x1e2]` from rollover dword
  `[subobject+0x1e6]`; `0x00561740` is the live render wrapper that forwards a derived view box
  into `0x005603e0` and then optionally emits extra marker sprites; `0x00561840` is the selected-row
  setter that clamps the incoming row, mirrors it through optional outputs and callbacks, and
  signals shell input with event `0xce`; `0x005618f0` appends one row record, grows table
  `[subobject+0x176]`, refreshes rollover counters, and re-enters both `0x560e50` and `0x55faf0`;
  and `0x005615f0` is the destructor-side owner that drains callbacks, row strings, the row-table
  slab, and the owner registration before falling back to base cleanup.
  The family now extends through its message and mutation owners as well. `0x00561c30` is the thin
  destructor wrapper over `0x005615f0`; `0x00561c50` removes one row, compacts the `0x20`-byte row
  slab, repairs selection and visible-window state, and refreshes both callbacks and family
  activity; `0x00561e40` updates one row flag at `+0x18`, recounts nonterminal rows, and repairs
  selection if the current choice no longer lands on a valid terminal chain; `0x00561f30` handles a
  narrow navigation-message strip and can synthesize a `0xca` event around the current selection;
  `0x00562540` is the timed auto-scroll owner driven by pointer proximity at the top or bottom of
  the visible band; `0x00562650` clears all rows by repeatedly re-entering the remove-row owner; and
  `0x005626a0` is the registered-message dispatcher that ties the whole family together by routing
  callback setters, row append/remove, clear-all, callback refresh, selection changes, and handle
  release through the now-grounded local owners.
  The next sibling family rooted at vtable `0x005de360` is bounded now too. `0x00562d30` is the
  family initializer: it seeds selector word `[this+0x06] = 0x10`, clears callback and timer dwords
  `[this+0xa2/+0xce/+0xd2/+0xd6]`, seeds delay or range dword `[this+0xa6] = 0x1f4`, and zeroes the
  four watched child-control words `[this+0xaa..+0xb8]`. `0x00563120` is the constructor-side owner
  that loads resource `0x8b` and copies the `+0x5f` payload band into `[this+0xa2..+0xb8]`, while
  `0x00563210` is the alternate constructor that copies the same `11`-dword band from a caller
  record. Below that, `0x00562e40` snapshots elapsed ticks into `[this+0xce/+0xd2]`, optionally
  invokes callback slot `[this+0x9e]` with owner-relative local coordinates, and then falls through
  the shared base update `0x00558760`; `0x00562da0` is the optional marker-pair render helper under
  controller mask `[0x006d401c+0xc79]`; and `0x00562ed0` is the registered-message dispatcher that
  validates readiness through vtable slots `+0x30` and `+0x20`, updates callback slot `[this+0xd6]`,
  compares incoming child ids against watched words `[this+0xb2/+0xb4/+0xb6/+0xb8]`, can synthesize
  `0xca` events, and can resolve a target shell window through `0x00538810` before forwarding the
  paired words `[this+0xae/+0xb0]`. The family closes cleanly on the teardown side too:
  `0x005631e0` is the thin destructor wrapper over base cleanup.
  The shared base child-control family under vtable `0x005ddcd0` is tighter now too. `0x00558580`
  is the real base constructor: it resets state through `0x00558080`, optionally copies one caller
  template block, rebuilds localized text handles `[this+0x63]` and `[this+0x92]`, normalizes
  selector byte `[this+0x37]` to default `3`, and snapshots the primary span bands into
  `[this+0x6c..+0x7c]`. `0x00558000` is the matching base release body that clears parent-window
  active-child links and drops localized or payload handles. On the interaction side,
  `0x005582f0` is the broader point-hit owner above the local shape helper `0x005581e0`, while
  `0x00558670/0x005586c0` are the primary and secondary readiness predicates over flag words
  `[this+0x68/+0x6a]`, owner latches `[owner+0x5c/+0x60]`, optional nested child `[this+0x4b]`,
  and shell controller byte `[0x006d4024+0x57]`. Just above those gates,
  `0x00558760/0x00558840` are the paired active and clear-side service helpers that drive cue
  callback `0x0045ea20`, optional callback slots `[this+0x9e/+0x96]`, and active caption publish
  through `0x00538c70`, while `0x005588b0/0x00558980` are the corresponding clear/set mutators for
  state word `[this+0x6a]` and the parent active-child slots `[parent+0xc6d/+0xc71]`. Above that,
  `0x00558a10` is now bounded as the common registered-message dispatcher for the base
  child-control family rather than an unnamed shared wndproc fragment. The preview-surface child
  subfamily above `0x00559520/0x005595d0` is tighter now too: `0x00559340` seeds its preview and
  aspect fields, `0x005593e0` refreshes current local spans and optional aspect scalars from the
  bound preview handle, `0x005594c0` stages the current local origin and requests the deferred
  refresh through vtable slot `+0x34`, `0x00559f50` stores one highlighted local rect band,
  `0x00559f90` and `0x0055a040` are the heap-template and inline-template constructors, and
  `0x0055a090` is the matching preview-surface destroy path. The render and message owners are
  tighter now too: `0x005595d0` switches over style field `[this+0xb0]`, uses `0x54f710` for flat
  overlay strips, binds preview surface `[this+0xaa]` through `0x54f640 -> 0x51f460` on style `8`,
  and uses `0x53de00 -> 0x552560` for the generic tagged-preview draw lane keyed by selector
  `[this+0xae]` and local rect `[this+0xd8..+0xf0]`; `0x00559c40` is the matching
  preview-surface-specific registered-message owner that updates selectors, colors, aspect scalar
  `[this+0x108]`, alpha byte `[this+0x10c]`, and optional callback slot `[this+0x10d]` before
  tailing into the shared child-control dispatcher `0x00558a10`.
  The adjacent sibling family under vtable `0x005ddd58` is bounded one step further now too:
  `0x0055a560` clears the local selector and metric band `[this+0x101..+0x1b5]`, `0x0055a640`
  stores the item-count field `[this+0x101]`, `0x0055a660` clamps the current index into
  `[this+0x185]`, optionally mirrors that index into one nested type-`8` child, and can fire cue
  selector `[this+0x11d]` through `0x0045ea20`, `0x0055a170` rebuilds a paired token-child strip
  from preview-handle selectors `[this+0x129/+0x131/+0x139/+0x13d]` plus local offsets,
  `0x0055a720` is the matching paired preview-selector render and outline pass,
  `0x0055a990/0x0055ab50` are the resource-backed and inline-payload constructors,
  `0x0055aba0` is the message-side gesture and selection dispatcher above `0x0055a660`, and
  `0x0055a0e0/0x0055ab30` are the paired-child destroy path and thin destructor wrapper above the
  shared base cleanup.
  The shared owner above that small family is bounded too. `0x00563250` and `0x00563260` now read
  as the clear and update helpers for global child-control filter dword `0x00625a94`, and
  `0x00563290` is the real shell-side owner that formats one anchored text or callout payload
  through `0x005519f0`, tries to resolve the target child through `0x0053f830`, and when no child
  exists builds one `0xda`-byte payload block, allocates a new child object through `0x0053b070`,
  initializes it through `0x00563210`, registers it through `0x0053f9c0`, and finally dispatches a
  kind-`0x7b` descriptor through `0x0053fe90` with callback `0x00563260`.
  The adjacent sibling family rooted at vtable `0x005de3b0` is bounded as well. `0x005634e0` is the
  family initializer: it seeds selector word `[this+0x06] = 0x20`, clears scalar and handle bands
  `[this+0xa2..+0xd8]`, zeroes optional text root `[this+0xb2]`, and resets state dword
  `[this+0xcc]`. `0x00563c00` is the constructor-side owner that loads resource `0xa1`, copies the
  payload band rooted at `+0x5f` into `[this+0xa2..+0xd8]`, and seeds fallback text root `[this+0xb2]`
  through `0x0053cb10(0xbc1)`, while `0x00563d70` is the alternate constructor that copies the same
  payload band from a caller record and duplicates the caller string root at `+0x6f`. The live side
  is bounded now too: `0x00563550` refreshes optional localized label id `[this+0xb6]` into text
  root `[this+0xb2]` and applies several mode- and control-id-specific vertical offset bumps to
  `[this+0x13]` and `[this+0xc0]`; `0x00563670` is the primary render owner that can emit an upper
  label through `0x0053de00 -> 0x00552560`, render the main body or callout through `0x005519f0`
  using text root `[this+0xb2]`, style bytes `[this+0x2b/+0x2c]`, optional color bands
  `[this+0xcc..+0xd8]`, and owner-relative float bands `[this+0xa2..+0xc4]`, and then emit one or
  two marker sprites through `0x0054f9f0`; and `0x00563950` is the registered-message dispatcher
  that updates local text root `[this+0xb2]`, toggles active state `[this+0xc8/+0xcc]`, restyles
  sibling control `0x93` through `0x00540120`, and can synthesize a `0xca` event carrying the
  current active value. The family closes on the teardown side through `0x00563d20`.
  The next adjacent helper strip is bounded too. `0x00563e30` is the lazy ensure path for a tiny
  callback-registration handle object: when live flag `[this+0x0c]` is still clear it releases any
  old imported handle at `[this+0x04]`, allocates or registers a new one through import
  `0x005c81c0` with callback `0x00563dd0`, stores the returned handle in `[this+0x04]`, and marks
  the object live. `0x00563e90` is the direct destructor-side release of that same imported handle.
  The neighboring owned-list strip is tighter now too: `0x00563ed0` releases every entry in owned
  list `[this+0x8d]` through `0x005544b0(-1, 1)`, and `0x00563f10` is the tiny remove-from-list
  helper on that same root. Above those leaves, `0x00563f20` is the broader cell-radius refresh
  owner: it clears the `0x1000`-byte visited band at `[world+0x47c]`, clamps one tile rect through
  `0x00533970/0x00533980`, repopulates owned list `[this+0x79]` from the nearby-presentation cell
  table via `0x00533ba0`, repopulates owned list `[this+0x8d]` from the border-overlay chunk table
  via `0x00533c50`, marks visited cells with bit `0x01`, and then deactivates or removes stale
  `[+0x8d]` entries whose cached owner marker no longer matches `[this+0x05]`.
  One small resource-bank seam beside that branch is bounded now as well. `0x005641f0` loads one
  heap-owned payload copy from the shared bank root `0x006d4020`: it hashes or canonicalizes the
  caller key through `0x0053b5c0`, falls back to the caller backup string when the canonical key is
  absent, resolves the payload length through `0x0053c9c0`, opens the row through `0x0053bd40`,
  allocates a buffer through `0x005a125d`, copies the bytes through `0x0053b7c0`, and optionally
  returns the length to the caller. `0x00564280` is the adjacent cache reset or destructor-side
  owner above that helper: it walks the table rooted at `[this+0x04]` with callback `0x005641d0`,
  releases and frees the owned descriptor, table root, and pool roots at `[this+0x00/+0x04/+0x08]`,
  and clears the local counters and live flag. The cache family itself is bounded now too.
  `0x00564570` is the constructor or reset owner: it allocates the three helper roots, builds the
  scored heap and hash table, allocates the `0x15e0`-byte pool behind the vector root, stores the
  caller byte budget in `[this+0x10]`, clears the hit or miss counters, and zeroes the optional
  prefix byte at `[this+0x24]`. `0x00564310` is the scored-eviction helper that pops the top entry
  from heap `[this+0x08]`, frees its payload buffer, removes it from hash root `[this+0x04]`,
  conditionally relinks or frees the entry record, and returns the freed payload size. Above that,
  `0x00564390` is the primary cache-backed load owner: it composes the lookup key from optional
  prefix `[this+0x24]` plus the caller stem, bypasses the cache when `[this+0x14]` is zero, and
  otherwise uses the hash root and scored heap to reuse or evict entries before returning a fresh
  heap-owned payload copy. The neighboring tiny helpers are explicit now too: `0x005641b0` copies a
  caller string into local field `[this+0x24]`, `0x00564150` clears one `0x100`-dword table,
  `0x00564180/0x00564190/0x005641a0` are the adjacent indexed-byte set or clear or query helpers,
  and `0x00564560` is the direct destructor thunk back into `0x00564280`. The next geometry seam
  beneath the same owner band is bounded now too: `0x00564660` builds one six-record `0x18`-byte
  primitive block from a compact record with two projected corners, one packed color, and one
  scalar multiplier, while `0x005648c0` is the sibling three-record builder that handles the
  larger record form with three independently scaled packed colors. Above both, `0x00564c70` is
  the queue-driven owner that walks the caller record list, keeps low-nibble mode byte
  `[this+0x374d]` synchronized through the `0x5472..` and `0x5474..` strip, chooses between
  direct subordinate-state calls and the two primitive builders, accumulates emitted primitive
  count in `[this+0x71]`, and re-enters `0x00523d30(1)` after each serviced record. The sibling
  `0x00564ee0` is the more general list-service owner on the same branch: it first reapplies the
  current optional item binding through `0x00545520`, then walks the caller intrusive list while
  keeping both mode nibbles in `[this+0x374d/+0x374e]` synchronized, dispatching records either
  into direct routed payload calls through `0x005669d0`, direct subordinate-state calls through
  `0x005473c0/0x005474a0`, or the two primitive builders, and finally restoring one trailing
  deferred direct-state tail before it returns. One shell-side layer above that branch is explicit
  now too: `0x00565110` is the broader owner that rebuilds subordinate layout state through
  `0x0055dd80` and `0x0055e2b0`, services one mode-selected record source through `0x00564c70` or
  repeated `0x00564ee0` calls, and only then commits the bound-node finalization strip through
  `0x00548940`, `0x005467a0`, `0x00545020`, and `0x00547fe0`.
  The adjacent small trace-helper seam is bounded now too. `0x00565370` allocates one
  power-of-two square-mask table and one pair buffer, `0x00565440` is the matching destructor,
  `0x00565470` marks one coordinate pair once and appends it to the live pair buffer, and
  `0x005654f0/0x00565500` are the tiny exponent and square-mask getters. Above those leaves,
  `0x00565510` is the broader owner that advances the helper generation, walks the square mask,
  collects two complementary boundary-run lists through globals `0x00d97a30` and `0x00d979b0`,
  and emits the resulting pair strip into the live pair buffer.
  The neighboring world-anchor marker config seam is explicit now too. `0x00565c40/0x00565c60`
  store and query the local marker pair plus selector byte used by the later indexed marker
  emitter `0x00565c90`, `0x00565d60/0x00565da0` replace or release the shared type-`6` image
  handle rooted at `0x00d97ab0`, and `0x00565dc0` loads one named payload triplet through the
  banked-resource strip before seeding the caller output with the default transform band from
  `0x00625ae8`.
  The adjacent sprite-billboard instance seam is bounded now too. `0x00565e30` is the default
  initializer, `0x00565e80` seeds one instance from caller basis, timing, flags, and scale, and
  `0x00565f40` is the per-step update helper that advances lifetime, updates position and basis,
  refreshes the dynamic scratch basis globals, and maintains the live fade scalar later consumed by
  `0x005662a0`; when that step needs to rebuild the scratch quad it re-enters `0x005661b0`, which
  applies one helper matrix to the four billboard basis points rooted at `0x00d97b98`.
  The neighboring routed-payload seam that the layout-state record owners use is explicit now too:
  `0x005669d0` scales one caller float quad by layout spans `[this+0x25c7/+0x25cb]`, rounds the
  results to integers, and forwards that integer quad into an optional sink object through the sink
  vtable strip.
  The next shell-side streamed-record seam is bounded structurally now too. `0x00566a80` loads one
  `0x24`-byte record plus a trailing `0x0c`-stride array, packs four leading floats into one RGBA
  dword, and swaps the second and third float lanes inside each loaded element, while `0x00566b80`
  is the broader sibling that loads one `0x45`-byte record, normalizes its source triples against
  the current global anchor, derives bounds and max-radius, and expands the result into one
  `0x4c`-stride table.
  That streamed-record seam is no longer floating without owners either. `0x00567400` is the
  keyed `3DPF` collection loader: it opens the current-or-selected banked stream, validates magic
  `33 44 50 46`, allocates one `0x18`-stride child-entry array, and then fills each child through
  `0x00567190`. That child loader reads one leading `0x08`-byte header, optionally copies one
  inline anchor triplet into `[out+0x00..+0x08]`, mirrors the same triplet into globals
  `0x00d97ba8..0x00d97bb4`, stores the entry count at `[out+0x14]`, and then chooses one of the
  two earlier payload formats from a trailing format byte: `L` allocates and fills the `0x24`
  inline-entry band at `[out+0x10]` through `0x00566a80`, while `I` allocates and fills the `0x45`
  expanded-entry band at `[out+0x0c]` through `0x00566b80`. The matching release side is explicit
  too: `0x005672e0` frees the nested inline or expanded payloads plus the optional shared helper at
  `0x00d97bb8`, `0x005674c0` releases the whole `3DPF` collection by walking its child-entry array,
  and the tiny wrappers `0x00567500/0x00567520` are now just the construct-and-release front doors
  used by the typed staging-row family.
  The next streamed-patch owner layer is bounded now too. `0x00567730` clamps one caller rectangle
  against grid dimensions `[this+0x15d5/+0x15d9]`, walks the patch-cell pointer table at
  `[this+0x1669]`, and for every live cell scans the surrounding neighborhood for other live cells
  while skipping the center. It uses `0x005675c0` to compare candidate four-corner patch pairs:
  that helper measures corner-to-corner distances from the triplets rooted at `+0x00/+0x08`,
  ignores corners already masked with state byte `+0x31 == 2`, updates the caller best-distance
  scalar when a closer match survives, and averages the paired blend bytes at `+0x39` back into
  output bytes `+0x35`, or marks both corners with state `1` when the distance only falls under
  the looser threshold at `0x005c85b8`. Once one best neighbor survives, `0x00567730` averages the
  winning patch positions into midpoint triplets, resolves a world-height scalar through
  `0x00534490`, and decrements the caller output budget before continuing.
  The actual streamed quad emission side is tighter now too. `0x005679b0` expands one streamed
  patch item into one `0x90`-byte six-vertex `vertex24` quad: it derives an 8-step brightness
  phase from `GetTickCount` plus item field `[this+0x3a]`, combines that phase with the four corner
  blend bytes at `+0x35..+0x38`, forces masked corners at `+0x31..+0x34` fully transparent, and
  writes six `0x18`-byte vertices from the corner positions rooted at `+0x00..+0x2c`. The two list
  streamers above it are explicit too: `0x00567c70` emits the primary intrusive list rooted at
  `[this+0x1c]`, `0x00567ce0` does the same for the alternate list at `[this+0x20]` with one extra
  selector value, and both advance the destination by `0x90` bytes per emitted quad. Their shared
  release side is `0x00567bf0`, which frees both intrusive lists and all queued quad items through
  `0x005570b0`, while `0x00567d50` is the immediate destructor-side sibling that drops the two
  list-root objects themselves and clears owner slots `[this+0x1c]` and `[this+0x20]`.
  The actual streamed-patch owner above those leaves is bounded now too. `0x00567da0` first clears
  any previously queued quads through `0x00567bf0`, then walks the live signed-byte sample grids at
  `[this+0x08]` and `[this+0x0c]` together with the `u16` type-word table at `[this+0x10]` across
  the current interior tile rectangle. For each admitted cell it allocates one `0x3e` patch record,
  derives corner positions and color or blend bytes from the surrounding signed-byte samples plus
  the low three type bits through table `0x00625c60`, and accumulates those records into the
  primary and alternate intrusive roots at `[this+0x1c]` and `[this+0x20]`. After that initial
  build it runs a second neighborhood-processing pass over the primary list, using local pair and
  radius gates before finalizing the generated blend-byte bands. The constructor side is explicit
  too: `0x005692e0` allocates and initializes the two intrusive list roots, copies the caller
  bounds and grid-owner accessors into `[this+0x00..+0x24]` through the neighboring world-grid
  query helpers, and immediately re-enters `0x00567da0` to build the live patch lists.
  The coarse secondary-overlay backend under `[world+0x1685]` is now explicit too. Each coarse
  chunk is one `0x54`-byte object initialized by `0x0056af70`, with quantized origin dwords at
  `[chunk+0x00/+0x04]`, world-space origin floats at `[chunk+0x08/+0x0c]`, total live-cell count
  `[chunk+0x10]`, and a `4x4` local-page table rooted at `[chunk+0x14]`; `0x0056afc0` is the
  matching full-page release walk. Each present local page is `0x8a` bytes loaded or saved by
  `0x0056b490` and `0x0056b510`, with a live-cell word at `[page+0x00]`, a shared state byte at
  `[page+cell*8+0x0a]`, one per-cell sample-slot side band at `[page+cell*8+0x02+i]`, and one
  auxiliary byte at `[page+cell*8+0x0b]`. The state byte split is bounded too:
  `0x0056b000/0x0056b070` toggle and query the low-nibble flag mask,
  `0x0056b180/0x0056b1f0` query and store the three-bit sample-slot count, and `0x0056b0e0`
  decrements that sample-slot count, decrements both the page and chunk live-cell counters, and
  frees the page when its live count reaches zero. The auxiliary byte side is separate:
  `0x0056b260` queries it and `0x0056b700` stores it while marking shell dirty byte
  `[0x006d4024+0x374a]`. The broader append owner above those leaves is now bounded too:
  `0x0056b580` ensures one local page, seeds its minmax height band through `0x0056b2c0` from a
  `5x5` world-sample lattice, writes the caller auxiliary byte, derives one quantized sample byte
  from the world-height path, and appends it into the per-cell sample-slot side band while
  incrementing both the page live-cell word and the cell's three-bit sample-slot count when that
  count is still below `6`. The
  earlier rectangle helper at `0x00533e70` is corrected now too: it does not release chunks. It
  walks the surviving coarse-chunk rect and re-enters `0x0056b770` on every live chunk so those
  per-count side bytes are refreshed from the current world callbacks across the whole rect.
  The adjacent bundle-codec seam is explicit now too. The shared callback context at `0x00d93984`
  is no longer just an anonymous transport scratch block: `0x00552f30` and `0x00552fa0` are the
  paired source and sink callbacks over that context, with progress publish through `0x00d93988`,
  and the two bundle-side wrappers `0x00553000/0x00553120` now read as the encode/decode owners
  for payload families `0x91` and `0x92`. Selector `0x91` routes into the older ring or
  backreference codec: `0x0056be10` decodes fixed header `0x10/0x91` through buffered byte helper
  `0x0056b8f0`, replays literals and packed backreferences through `0x0056b940`, and uses one
  `0x200`-byte ring cursor rooted at `0x1be`; `0x0056bfe0` is the matching encoder, with adaptive
  dictionary state initialized by `0x0056bca0`, updated through `0x0056b990` and `0x0056bb10`,
  and emitted through the pending-token strip `0x0056bc00 -> 0x0056bbb0`. Selector `0x92` routes
  into the simpler run or literal family: `0x0056c3e0` emits header `0x10/0x92` then packs either
  repeated-byte runs or literal spans through `0x0056c320`, while `0x0056c630` reverses that same
  `(high-bit-set => run, high-bit-clear => literal span)` control format through `0x0056c370` and
  `0x0056c320`. That closes the support-family gap beneath the companion-payload rewrite owners
  `0x004427c0/0x00442900`, the tagged-surface importer `0x00541c30`, and the tagged-surface
  exporter `0x005428c0`: they are all now reusing the same pair of explicit bundle codecs rather
  than separate anonymous transform bodies. The adjacent format-descriptor seam under the same
  surface path is explicit now too: `0x005700e2` looks one requested tag up in the live
  `0x24`-byte descriptor table rooted at `0x005de500` and falls back to the default entry,
  `0x00570106` scores one candidate descriptor against a reference through the compatibility matrix
  at `0x005deb38`, `0x0057017b` iterates the same table and optional target interface to select
  the best supported descriptor tag, `0x0057033f` is the broader validation owner that resolves or
  selects that descriptor, clamps width or height or depth or level counts against target limits,
  rounds `DXT1..DXT5` sizes up to four-pixel blocks, and forces power-of-two sizes when the
  selected descriptor and capability flags require it, `0x00570669` is the mode-`3` wrapper over
  that validator, `0x00570691` is the target-side owner that feeds the validated result into
  vtable slot `+0x50`, and `0x005706f7` is the next materialization owner that either takes one
  fast matching-descriptor transfer path through target slot `+0x70` or falls back into the
  broader decode owner `0x0057025d`. The Direct3D-side gate in that seam is explicit now too:
  `0x00571570` is not a generic lock, it lazily resolves `DebugSetMute` from `d3d8.dll` and
  `d3d8d.dll` and forwards the caller's mute on or off flag through whichever callbacks exist.
  The fallback decode stack is explicit now too: `0x00571600` and `0x0057160a` are the tiny
  two-handle decode-pair init or release helpers used by `0x0057025d`, `0x0057163e` is the
  broader weighted axis-map builder for the general resample branches, `0x005718fb` is the flagged
  release path for those temporary axis maps, `0x00573e02` is the lighter dual-tap axis-map
  builder used by the mode-`3` weighted resamplers, and `0x00574ed5`, `0x00574ee5`, and
  `0x00574f4e` are the same
  for the `0x10`-byte temporary source-view context, `0x00574f53` is the broader owner that resets
  that context, queries source bounds, validates or synthesizes the working rect, acquires one
  subordinate view when needed, and aligns the rect for block-compressed or packed-YUV tags such
  as `DXT1..DXT5`, `YUY2`, and `UYVY`, and `0x00574dbb` is the decode-branch dispatcher that links
  one handle pair and then tries the supported codec bodies in sequence. The concrete branches are
  tighter now too: `0x00572f1e` falls into a direct row copy when the linked source and destination
  layouts already match, `0x00573056` allocates one temporary `width*0x10` row buffer and
  transfers rows through the source and destination callback slots, `0x00573147` is the mode-`1`
  branch that allocates two temporary row buffers and zero-fills any destination rows or slices
  outside the shared minimum bands, `0x00573349` is the mode-`2` branch that rebuilds destination
  rows through fixed-point step ratios derived from the linked source and destination dimensions,
  `0x00571dbb` is the narrow direct compressed-block copy sibling for `DXT1..DXT5` when the source
  has no auxiliary descriptor payload, `0x0057354d` is the first mode-`5` half-resolution branch
  with subtype-gated specialized dispatch, `0x0057206f` and `0x00572305` are the two front doors
  into a CPU-selected packed-32 `2x2` reducer pair, `0x005722a1` and `0x005722d6` are the
  one-time initializers for those reducer slots, `0x00572188` is the MMX-or-scalar packed-32
  wrapper beneath them, `0x00571f49` and `0x005720a0` are the scalar packed-32 reducers,
  `0x00572336`, `0x00572486`, `0x005725aa`, and `0x005726f9` are the scalar `RGB565`, `RGB555`,
  `ARGB1555`, and `ARGB4444` `2x2` half-resolution reducers in the same jump-table family,
  `0x0057298b` is the generic packed-8 reducer reused for the type-`0x1c` and type-`0x32`
  entries, `0x00572a26` is the alpha-plus-`RGB332` sibling, `0x00572b72` is the scalar
  `X4R4G4B4` reducer, and `0x00572c93` plus `0x00572ddf` are the scalar `A8L8` and `A4L4`
  reducers, and `0x00573970` is the broader mode-`5` single-slice box-filter half-resolution
  fallback,
  `0x00573f02` and `0x005742e8` are the two weighted mode-`3` axis-map resamplers with two and
  four staged row sets built from `0x00573e02`, and `0x00574a19` plus `0x00571947` are the
  general 2D and 3D weighted resample branches that build refcounted row or slice contribution
  tables through `0x0057163e` and release them through `0x005718fb`, `0x00575b34` is the shared
  decoder-base constructor, `0x00575366` and `0x00575677` are the two release-side companions for
  the base and the larger nested-table families, `0x0057537f` is the auxiliary `vec4` staging-row
  builder behind the peer-mode bridge, `0x00575d9c` is the small peer-mode mismatch helper that
  allocates and caches one auxiliary `width*0x10` staging row, `0x00575e17` is the temporary
  single-sample local-color helper that runs the decoder's vtable pair against `[obj+0x1c..+0x28]`
  under a rewritten one-sample state, `0x00575ee3` zeroes decoded sample quads when all four float
  lanes exceed the descriptor clip thresholds, `0x0057909e` flushes live packed-YUV-422 auxiliary
  samples back into the payload window, and `0x00578eef` and
  `0x0057989d` are the shared packed-YUV-422 and `DXT1..DXT5` decoder bases. `0x00579325`
  refreshes the packed-YUV-422 cached window and builds the auxiliary sample band under that
  family, `0x00579727` and `0x005797f1` are the packed-YUV-422 row decode and output-copy
  siblings, and the actual packed-YUV-422 subtype wrappers are now the FourCC or custom-tag cases
  `0x0057a3c8` and `0x0057a3e0` over base `0x00578eef`. The earlier constructor band
  `0x00578ed3`, `0x00579008`, `0x00579045`, `0x00579082`, `0x005792ab`, `0x005792e8`,
  `0x005795f6`,
  `0x00579633`, `0x00579670`, `0x005796ad`, and `0x005796ea` are now tightened to factory tags
  `0x14..0x1e`, all still using aux mode `1` with sample strides `0x08`, `0x10`, `0x18`, or
  `0x20`;
  `0x0057a1ab`, `0x0057a1e8`, and `0x0057a225` are now also tightened to factory tags
  `0x36314c41`, `0x36315220`, and `0x36315241`, with sample strides `0x20`, `0x30`, and `0x40`;
  `0x0057a37f` is the
  packed-YUV-422 base release owner that flushes live auxiliary state before freeing it,
  `0x00575717` is the broader `DXT` tile-row decode owner above the cached cell table,
  `0x00579bdc` is the tag-dependent threshold-quantization helper in that same `DXT` neighborhood,
  and the subtype strip between `0x00579a8f` and `0x00579ee1` is now explicit as factory-tagged
  wrapper pairs over the shared base for tags `0x28`, `0x29`, `0x32..0x34`, `0x3c..0x41`, `0x43`,
  `0x46`, and `0x31545844`, with aux modes `1`, `2`, and `3`, sample strides `0x08`, `0x10`,
  and `0x20`, and one nested-table release case at `0x00579b62`.
  The factory tail is tighter too: `0x0057ab70` and `0x0057ab91` are the missing release wrappers
  for the custom packed-YUV-422 and `YUY2` subtype vtables `0x005def10` and `0x005def20`, and the
  adjacent `0x0057abb2/0x0057abc4/0x0057acd4/0x0057ad15` strip is now grounded as a small
  mapped-file view context with closed-handle initialization, read-only open or map, release, and
  conditional release helpers.
  `0x00579f02` is the next `DXT` owner above that strip: it allocates or refreshes the cached
  `0x10`-byte sample strip at `[obj+0x10b8]`, rebuilds it through the primary kernel when the
  aligned block origin changes, copies the requested region back out, and then optionally reuses
  the same threshold vec4 `[obj+0x1c..+0x28]` as a whole-vec4 zeroing gate on the copied output,
  `0x0057ecb3` is the shared `RGB565`-to-vec4 expander with unit alpha, `0x0057ecff` and
  `0x0057ed7d` are the shared vec4-block unpremultiply and premultiply helpers, `0x0057edd0` is
  the shared RGB565 quantizer that clamps one float RGB triplet, switches the x87 rounding mode
  through `0x0057edad`, and packs the rounded five-six-five lanes back into one endpoint word.
  The next owner layer is explicit now too: `0x0057eeca` is the shared
  `DXT4/5` alpha-endpoint fitter over sixteen scalar samples, `0x0057f1cf` is the shared
  `DXT1`-family color-endpoint fitter over sixteen vec3 samples, and `0x0057f73a` is the shared
  `DXT1`-family color-block encoder that chooses transparent-versus-opaque policy from the caller
  alpha lanes, fits float endpoints, quantizes them to `RGB565`, and writes the final selector
  bits. `0x0057ff3e` is the shared `DXT1` RGB565-endpoint-to-palette builder, `0x0058007c` and
  `0x005800ff` are the shared `DXT2/3` explicit-alpha and `DXT4/5` interpolated-alpha block
  decode cores, `0x0058023b`, `0x00580253`, and `0x00580367` are the secondary `DXT1`,
  `DXT2/3`, and `DXT4/5` block-write kernels, `0x005807b9` and `0x005807dc` are the dedicated
  `DXT2` and `DXT4` decode wrappers that re-enter the unpremultiply helper after the shared
  cores, and `0x005807ff` plus `0x00580833` are the matching `DXT2` and `DXT4` encode wrappers
  that premultiply one temporary vec4 block before entering the shared `DXT2/3` and `DXT4/5`
  encoder cores,
  `0x0057a262`, `0x0057a29b`, `0x0057a2d4`, `0x0057a30d`, and `0x0057a346` are the thin
  `DXT1..DXT5` wrappers above that `DXT` base, their release-side siblings now route through the
  broader `DXT` family teardown `0x00575677`, and `0x0057a3f8` is the broader
  format-tag decoder factory beneath the
  handle-pair dispatcher. Above all of those, `0x0057025d` is the owner that
  materializes one temporary source view, snapshots the caller descriptor band, dispatches the
  decode chain, and fills one intermediate materialization descriptor on success. That keeps the
  DXT and tagged-surface import path grounded as one explicit descriptor-selection and decode stack
  instead of a decode call hanging off anonymous table probes.
  The adjacent `0x005def5c` seam is tighter now too. `0x0057b4fd` and `0x0057b5d4` are no longer
  generic target-side wrappers: `0x0057b4fd` builds one temporary transform block from up to three
  optional anchor pairs plus caller angle and scale, then dispatches that block through target slot
  `+0x18`, while `0x0057b5d4` is the broader target-service draw owner that queries surface bounds,
  validates or synthesizes one caller rect, classifies the active format tag, converts that rect
  into normalized float bounds, builds either four `0x1c`-byte or four `0x18`-byte local vertex
  records, optionally projects them through `0x0056cdda`, applies the local `-0.5f` pixel-center
  bias, and dispatches the finished strip through slot `+0x120`. The family growing above those
  owners is now recognizable as a shader-assembly context rather than another generic target
  object: `0x0057b9a7` initializes seven embedded dword-vector bands plus the string-log vector at
  `[this+0x84]` and publishes the context through singleton `0x00db89d8`, `0x0057ba6e` is the
  reverse destructor, and the shared error helper starts one step earlier than the old row
  implied: `0x0057bafd` formats assembly-error lines like `%s(%d) : (Assembly Error) %s`,
  `statement incomplete`, `constant definition in shader body`, and `shader version expected`
  into that owned string log. `0x0057bc33` parses one opcode token plus grounded suffixes `sat`,
  `x2`, `x4`, `d2`, `d4`, and `d8` into context fields `[this+0x1c8/+0x1cc]`, `0x0057c34a`
  parses the destination write-mask token over `rgba` or `xyzw`, `0x0057c3f3` is the matching
  source-swizzle parser, and `0x0057c494` parses grounded register families
  `c/v/t/a/oPos/oFog/oPts` with optional source modifiers `_da`, `_dw`, `_db`, `_dz`, `_x2`,
  `_bx2`, and `_bias`, including the indexed forms reported by the local `invalid register`
  formatters. The output-side seam under the same context is now explicit too: `0x0057c835` emits
  one grounded constant-definition record from a parsed constant register plus a caller vec4
  payload, `0x0057c8de` flushes one pending `TEXT` comment chunk into the output dword stream, and
  `0x0057c9b4` emits `FILE` and `LINE` chunks only when the current source location changes. That
  extends cleanly into the owner layer too: `0x0057cb2b` is the shared lexer that skips comments,
  maintains line state, accepts `#line`, rejects other preprocessor directives, tokenizes
  identifiers and numeric spans into `[this+0xc8]`, and returns the grounded token/status codes;
  `0x0057d043` is the main statement compiler above it, dispatching version declarations,
  constant-definition statements, comment/file/line chunks, arithmetic and texture opcodes, and
  operand parsing through the helper bands we already grounded while enforcing the current
  version-specific rules like `constant modifiers not supported in ps.1.4`, `coissue not supported
  in vertex shaders`, `complement not supported in vertex shaders`, `negate and divide modifiers
  cannot be combined`, and the indexed-register restrictions around `a0.x`. One owner level above
  that, `0x0057d97a` is now bounded as the shift-reduce parser driver: it initializes the parser
  stacks and lookahead globals rooted at `0x00db85d0/0x00db89c0/0x00db89c4/0x00db89c8/0x00db89cc`,
  repeatedly asks `0x0057cb2b` for the next lookahead token, walks the grammar action and goto
  tables at `0x006265a0..0x00626a68`, invokes `0x0057d043` on reductions `0..0x32`, and handles
  error recovery through the same shared formatter with grounded strings like `statement expected`
  and `yacc stack overflow`. The wider API-side owner is bounded now too: `0x0057de38` records the
  caller source span and optional file name into the same context, emits the default
  `D3DX8 Shader Assembler Version 0.91` banner when needed, invokes `0x0057d97a`, and then
  conditionally materializes the assembled output stream, adjacent constant-table-style object, and
  joined error-log text while probing the grounded registry-side policy keys under
  `0x005df51c`, `0x005df530`, `0x005dec20`, and `0x005dec3c`. That closes the nearby
  shader-assembly parser and API seam enough to stop treating those rows as anonymous string
  switches. The next tiny seam after that is now
  grounded too: `0x0057e300` and `0x0057e410` are not anonymous literal tables but the two math
  function-table seeders immediately above the later packed and x87 helper families. The first
  writes the older scalar or x87 geometry, plane, quaternion, and matrix entrypoints like
  `0x00582c30`, `0x00582e40`, `0x00582eb0`, and `0x00582fd0` into one fixed slot layout, while
  the second writes the packed or vectorized successors like `0x005830a0`, `0x00583320`,
  `0x00583e80`, `0x00584010`, `0x005840f0`, and `0x00584210` into the same table shape. One owner
  layer above that is bounded now too: `0x0057e520` is the local CPUID feature-mask probe for MMX
  and AMD-extended SIMD paths, `0x0057e5f5` is the broader MMX or 3DNow table-seeding owner that
  populates the later `0x005895..`, `0x00589b..`, `0x0058a0..`, `0x00584b..`, and `0x005860..`
  families when those capability bits are present, and `0x0057ec77` is the compact x87-side table
  seeder for the nearby low-dimensional strip. That local strip is explicit now too:
  `0x0057e81b/0x0057e884` are the x87 2D basis-plus-translation and basis-only helpers,
  `0x0057e8b9/0x0057e944` are the corresponding 3D variants, `0x0057ea3c` is a fast table-assisted
  vec3 normalize-or-zero helper over lookup tables `0x00626c80/0x00626c84`, and
  `0x0057eb06/0x0057ebe9` are the two alias-safe `4x4` multiply siblings that differ mainly in
  whether they write results in contiguous row order or one `0x10`-byte column stride.
  The adjacent x87 math seam is explicit now too. `0x00571493` is the one-time dispatch-table
  initializer for the live function-pointer strip rooted at `0x00625c88`: it copies the default
  seed table from `0x00625d70`, optionally resets the whole strip, and on first live use patches
  selected slots in place after the local feature probes. The wrapper entries `0x0056c890`,
  `0x0056c948`, `0x0056ca21`, `0x0056cacd`, `0x0056cba5`, `0x0056cca0`, `0x0056cf7f`,
  `0x0056d07a`, and `0x0056d197` are not standalone subsystem owners; they are the dispatched x87
  or feature-gated front doors for the same curve and blend helpers we already grounded later in
  SSE and MMX form. The older bootstrap seam beneath that family is explicit now too: `0x005a1081`
  and `0x005a10b9` seed the five-slot legacy x87 dispatch table at `0x0062a360..0x0062a374`,
  probe `KERNEL32!IsProcessorFeaturePresent(0)` or fall back to the local arithmetic test at
  `0x005a63ca` through `0x005a640a`, store that result in `0x00dba008`, and then apply the local
  x87 control-state setup through `0x005a63b8`. The adjacent CRT-style support seam is explicit now
  too: `0x005a1a1c` is the unlocked buffered element-reader over the FILE-like band at
  `[stream+0x00/+0x04/+0x0c]`, `0x005a1b05` is the public lock-scoped wrapper already used by the
  companion-image import and rewrite paths, `0x005a1b60` is the older x87 `pow` owner with the
  clean-state fastpath probe and the full negative-base or NaN or infinity special-case ladder,
  `0x005a1dc2` classifies `st(0)` as non-integer, odd integer, or even integer for those `pow`
  special cases, `0x005a1e1d/0x005a1ea5` are the locale-aware signed-decimal core and wrapper,
  `0x005a2076` is the corresponding floating parser returning one `f64` in `st(0)`, and the
  neighboring string seam is explicit too: `0x005a1df0` is the reverse character search helper,
  `0x005a1eb0` is the bounded append helper, `0x005a1ff0` is the substring search helper,
  `0x005a2a06` is the single-character search helper beneath that fast path, `0x005a2abe` is the
  locale-aware lowercase-in-place normalizer already used by the hotkey modifier parser, and
  `0x005a20b0` remains the shared overlap-safe byte mover beneath both the parser and transport
  text families. The adjacent helper layer is explicit now too: `0x005ac3b0` is the unbounded
  append helper the lowercase normalizer uses for copyback, `0x005ac579` is the broader locale
  string-mapping owner that prefers `LCMapStringW + MultiByteToWideChar/WideCharToMultiByte` and
  falls back to `LCMapStringA` when the wide path is unavailable; the ANSI-side fallback helpers
  are grounded now too as `0x005b16ef` for `LCID -> default ANSI codepage` and `0x005b1738` for
  the source-or-destination multibyte transcode bridge beneath that ANSI path. `0x005ac935/0x005ac9bd` are
  the temporary stream-buffer prepare or restore pair beneath the locked formatter. The same CRT strip now also owns the formatted-stream and on-exit table side:
  The adjacent classification leaves are explicit too: `0x005b1a00` is the shared mbctype-mask
  predicate over `0x00dba541` and the secondary table at `0x005e6f12`, and `0x005b1a31` is its
  alpha-character wrapper. The neighboring locale-info bridge is explicit now too:
  `0x005b2828` is the wide-output `GetLocaleInfoW` wrapper with `GetLocaleInfoA +
  MultiByteToWideChar` fallback, and `0x005b2958` is the multibyte-output sibling that prefers
  `GetLocaleInfoW + WideCharToMultiByte` and falls back to direct `GetLocaleInfoA`. Above those
  two wrappers, `0x005b1a42` is now grounded as the shared locale-field materializer used by the
  broader locale-structure builders: it either allocates one exact-sized multibyte locale string
  for the caller or parses one short decimal locale-info field into a single output byte. The same
  locale-record owner strip is explicit now too: `0x005ad524` builds the primary `0xb8` locale
  text record from the current-thread and user-default locale words, `0x005ad88b` releases that
  record’s owned string fields, and `0x005ada1b` publishes either the dynamic record or the static
  fallback at `0x0062abe8` through globals `0x0062abe0/0x00dba2f8`. The adjacent narrower record
  families are grounded as well: `0x005ada7a` is the release helper for the active three-string
  record at `0x0062acd4`, `0x005adad9` refreshes that tri-string record and its digit-map side
  globals, `0x005adca6` releases the secondary `0x30`-byte text record band, and `0x005add7f`
  rebuilds that secondary record plus the multibyte lead-byte or classification side state. The
  older locale-selection layer is explicit now too: `0x005ae38c` is the static-locale-table or
  `GetLocaleInfoA` bridge over the fixed `0x005e7448` LCID rows, `0x005ae2d8` seeds the
  user-default LCID pair, `0x005ae8c3/0x005ae8fa/0x005ae980` are the three
  `EnumSystemLocalesA`-driven name-selection branches, `0x005ae278` binary-searches alias table
  `0x005e7a30` to rewrite incoming locale-name pointers in place, `0x005ae2f2` parses the final
  codepage selector from `ACP`, `OCP`, or locale-info text, and callbacks `0x005ae4c1`,
  `0x005ae5d2`, and `0x005ae7f2` are the concrete secondary-name, two-name, and primary-name
  `EnumSystemLocalesA` matchers that fill `0x00dba304/0x00dba308` and selector bits in
  `0x00dba300`. Above those, `0x005ae9d5` is the broader old `setlocale`-style owner that
  selects the LCID pair, validates it through `IsValidLocale` and `IsValidCodePage`, and exports
  the final `(primary LCID, secondary LCID, codepage)` triple plus canonical locale-name text. The same
  locale-text seam now includes the compare and environment side too: `0x005b2b6d` is the broader
  `CompareStringW/CompareStringA` owner with codepage-selection and transcode fallback,
  `0x005b2a98` is the smaller prefix-compare wrapper that turns `CompareString*` equality into
  `0`, `0x005b2ae6` is the wide-env to multibyte-env materializer that seeds `0x00dba030`
  from the wider backing vector at `0x00dba038`, `0x005b2ef7` is the search helper returning
  either a nonnegative env-slot index or the negated end slot, `0x005b315a` is the DBCS-aware
  character finder beneath the `'='` split path, and `0x005b2fa5` is the broader multibyte
  environment set-or-unset owner that also forwards updates into `SetEnvironmentVariableA`.
  The next CRT support strip is grounded now too: `0x005b1907` is the `user32.dll`-backed
  runtime-error message-box owner beneath `0x005acdb0`, `0x005b1ddd/0x005b1e23/0x005b1e36` are
  the top-level unhandled-exception filter callback plus its install and restore bridges,
  `0x005b1eab/0x005b1f2c` are the nolock and lock-scoped environment `name=value` lookup owners,
  `0x005b1b73/0x005b1bb1` are the unsigned and signed integer-to-ASCII helpers, and `0x005b1bdb`
  is the standard security-cookie initializer over time, pid, tid, tickcount, and QPC. The same
  neighborhood now also owns the older signal and decimal-record leaves: `0x005b23bd` is the
  per-thread signal-action lookup over `[thread_data+0x54]`, `0x005b23eb` is the higher
  signal-dispatch owner above that table and the global handler slots at `0x00dba480..0x00dba48c`,
  `0x005b1f6b` is the checked `u32` add helper, `0x005b1f8c` is the three-dword carry-propagating
  add helper, and `0x005b1fea/0x005b2018` are the left and right one-bit shifts on that same
  internal 96-bit decimal band. The neighboring fatal-report owner is bounded now too:
  `0x005b1c31` formats either the buffer-overrun or unknown-security-failure message body, adds the
  program path or `<program name unknown>`, and then routes the final text through
  `crt_report_runtime_error_via_user32_message_box_or_callback` before forced CRT termination.
  `0x005a2bd2` is the lock-scoped varargs stream formatter, while `0x005a2c30/0x005a2cb0/
  0x005a2cd8/0x005a2d10` append callbacks into the global on-exit table at `0x00dbb8dc/
  0x00dbb8d8`, initialize that table, and expose the narrow boolean registration wrapper just
  beneath `crt_init_exit_handlers` `0x005a2d64`; `0x005ac9e7` is the allocation-size query helper
  for that same dynamic table, and `0x005a6649` is the local CRT heap-region descriptor probe that
  lets `0x005ac9e7` avoid `HeapSize` on the small-block fast path. The shared rounding leaf under
  both the overlay
  and math families is explicit now too: `0x005a10d0` is the signed float-to-integer helper reused by the later
  quantized-origin, height-bias, and layout-state callers. Their default local fallbacks are now
  bounded too: `0x0056c8ba`,
  `0x0056caf7`, and `0x0056cfa9` sample the primary cubic basis over four vec2, vec3, and vec4
  control points; `0x0056c972`, `0x0056cbcf`, and `0x0056d0a4` do the same for the alternate
  cubic-basis family; and `0x0056ca50`, `0x0056cccf`, and `0x0056d1c6` are the lower-dimensional
  affine blend helpers computing `p0 + s*(p1-p0) + t*(p2-p0)` for vec2, vec3, and vec4. So the
  support-family boundary is tighter now: the older x87 seam is not another anonymous math island,
  it is the dispatch-layer predecessor of the later `0x00582320..0x005827c0` and
  `0x005897a2..0x0058a6c5` interpolation families. The same seam also owns the older scalar
  matrix-transform siblings: `0x0056ce53 -> 0x0056f496` is the x87 forward projective apply owner
  matching later `0x00589bb7`, `0x0056ce64 -> 0x0056f623` is the inverse-side x87 projective
  sibling matching later `0x00589d3f/0x00589f67`, and that inverse-side owner now has its own
  broader x87 inverse seam too: `0x0056d8d9 -> 0x0056d8df` is the second x87 4x4 inverse variant
  with optional determinant outparam, matching the later inverse helpers `0x00581db0`,
  `0x00588bd0`, and `0x005892aa`. The same strip still owns the earlier transform helpers too:
  `0x0056cd2f -> 0x0056cd42` is the x87 vec3-basis-plus-translation to vec4 helper matching later
  `0x00581830`, `0x0056cde0 -> 0x0056cded` is the translation-free vec3 basis helper matching
  `0x00581770`, `0x0056f0d7 -> 0x0056f0e4` is the x87 full-vec4 basis helper matching later
  packed helper `0x00583320`, `0x0056ce75 -> 0x0056ce82` is the x87 4D cross-product seam
  matching later `0x005821d0`, `0x0056d2f6` is the scalar x87 4x4 determinant helper matching later
  `0x005828e0`, `0x0056d23d -> 0x0056d24a` is the first x87 4x4 multiply predecessor of the later
  packed or MMX multiply families, and `0x0056d689 -> 0x0056d696` is the broader alias-safe x87
  4x4 multiply sibling paired with local copy helper `0x0056d61c`. The local constructor side is
  tighter now too: `0x0056dc6c -> 0x0056dca0` is the x87 4x4 scale-matrix seam matching later
  `0x00585e7c`, `0x0056dd2a` is the x87 translation-matrix constructor reused by the
  `0x00570e8e/0x00570f0a` composition owners, `0x0056dd8c -> 0x0056ddae` is the x87 single-angle
  `X`-axis rotation-matrix seam, `0x0056de28 -> 0x0056de4a` is the matching `Y`-axis seam, and
  `0x0056dee1` is the local `Z`-axis constructor in the same strip. The quaternion side is bounded now too: `0x0056e8c3 -> 0x0056e8d6` is the x87
  quaternion-product seam matching later `0x00582d10`, `0x0056e96c -> 0x0056e97f` is the x87
  vec4 normalize-or-zero seam matching later `0x00584379`, and `0x0056ea38 -> 0x0056ea4b` is the
  x87 quaternion-inverse seam matching later `0x00582e40/0x00584c41`. The earlier quaternion
  construction side is explicit now too: `0x0056e7b6 -> 0x0056e7ea` is the x87
  three-Euler-angle-to-quaternion seam matching later `0x00582fd0/0x005848ba`,
  `0x0056e092 -> 0x0056e098` is the x87 quaternion-to-4x4 rotation-matrix seam matching later
  `0x00582c30/0x00584010`, and `0x0056f882` is the direct x87 Euler-to-matrix owner that composes
  those two helpers. The nearby conversion bodies are bounded now too: `0x0056eb05`
  converts one quaternion into scaled-axis form, while `0x0056eb89` converts scaled-axis back into
  a quaternion and matches the later MMX helper `0x00584d4c`. The curve side is explicit now too:
  `0x0056ec24 -> 0x0056ec4e` is the x87 quaternion-slerp seam matching later `0x005849eb`,
  `0x0056ed5b` is the x87 quadratic nested-slerp helper matching later `0x00584baf`, and
  `0x0056edc3 -> 0x0056edf2` is the two-parameter nested-slerp seam matching later
  `0x00584b22`, and `0x0056fd08` is the broader four-quaternion owner that flips neighboring
  inputs into one hemisphere, converts the two relative quaternions around `q1` and `q2` into
  scaled-axis form, averages them with fixed scalar `-0.25f`, converts that average back into a
  quaternion, and produces the two inner quaternion spline-control outputs. The adjacent plane
  builders are bounded now too: `0x0056efe3 -> 0x0056ef41` is the x87 plane-versus-segment
  intersection seam matching later `0x00582820`, `0x0056eff0` copies one caller normal vec3 into
  plane output and derives the signed plane constant from one caller point vec3, and
  `0x0056f028 -> 0x0056f035` is the x87 three-point plane seam matching later `0x005829b0`. The
  older plane-matrix seam is explicit now too: `0x0056ee8a -> 0x0056ee90` is the shared x87 vec4
  normalize-or-zero seam used to normalize caller plane vec4s,
  `0x0056fb6f` is the x87 plane-driven projective-matrix helper matching later
  `0x00582aa0/0x00583e80/0x00585b9b`, and `0x0056fc49` is the x87 plane-reflection matrix helper
  matching later `0x00585c86`. The lower-dimensional transform side is explicit now too: `0x0056f183` and
  `0x0056f337` are the x87 vec2 and vec3 normalize-or-zero helpers, `0x0056f7c9` is the adjacent
  second x87 vec4 normalize-or-zero variant with the same near-unit fast path, `0x0056f210` is the
  x87 2D-basis-plus-translation-to-vec4 helper matching later `0x00581690/0x0058a0b8`,
  `0x0056f27b` is the x87 2D projective sibling matching `0x005816d0/0x0058a146`,
  `0x0056f2fb` is the translation-free x87 2D basis helper matching `0x00581730/0x0058a10d`, and
  the nearby scalar-trig seam is explicit now too: `0x005a2ee0` is the older x87 `exp` seam, and
  its clean-state branch now resolves concretely into the SSE2 pair `0x005acaf0/0x005acb08`,
  while `0x005a2f70` and `0x005a3040` are the sibling x87 `acos` and `tan` helpers that stay on
  the local x87 bodies instead of using that SSE fast path. The same support strip also now has
  the optimized power pair grounded: `0x005aad20/0x005aad39` are the x87-to-SSE bridge and SSE2
  core beneath `0x005a1b60`. These seams sit on the same older status-report path rooted at
  `0x005a76ee/0x005a77f7`, whose local helper strip is now explicit too:
  `0x005a7650` is the x87 `2^x` rebuild helper used after `fyl2x`,
  `0x005a7665` loads one masked-exception x87 control word while preserving rounding control,
  `0x005a7695/0x005a76d8` are the paired load-or-classify helpers for scalar `f64` inputs,
  `0x005a76ee` restores the saved control word on the clean exit, and
  `0x005a76fb/0x005a77e0/0x005a77f7` are the shared precision-check and math-error report owners.
  The older CRT report seam beneath them is grounded now too: `0x005acdb0` is the common
  runtime-error or math-error message emitter by code, `0x005acf27` is the banner-pair wrapper
  above it, and `0x005acf60` is the registered floating-point exception dispatcher that maps
  Windows exception codes like `0xc000008e` and `0xc0000093` into the local runtime math codes
  before falling back to `UnhandledExceptionFilter`. The adjacent startup-side helper `0x005ad0c4`
  is the shared program-name-tail extractor from the raw command line.
  The same older report family is tighter one layer deeper too: `0x005b08ba` is the common
  matherr-style report formatter and dispatcher under `0x005a77f7/0x005a790a`, while `0x005b09b8`
  is its default hook stub that simply returns zero before the path falls through to the default
  runtime-message emitter.
  The older `exp` fallback seam is explicit now too: `0x005a7480` and `0x005a74e7` are the unary
  and binary x87 special-case dispatchers driven by `fxam` and the state table at `0x0062a4bc`,
  `0x005a787e` and `0x005a7a51` are the unary fallback bodies that reach them from `st(0)` or one
  stack `f64`, `0x005a790a` is the shared finalize-or-report owner, and `0x005a7a84` is the
  stack-side `f64` loader or special promoter beneath that path. The SSE2 side now has its small
  exception tails grounded too: `0x005acd7e` is the moderate-input roundtrip tail under
  `0x005acb08`, while `0x005acd13` is the larger finite or non-finite ladder that returns the
  fixed overflow or underflow constants, pass-through infinities, or the shared report path.
  The next startup seam is tighter now too: `0x005ad1f4` is the shared argv parser and byte-count
  helper that honors the CRT multibyte lead-byte table, `0x005ad360` is the two-pass argv owner
  above it, `0x005ad402` is the multibyte environment-block materializer using the wide API when
  available, and `0x005ad12d` is the filtered envp-table builder that skips leading-`=` entries.
  The adjacent locale-conversion seam is explicit now too: `0x005b0b06/0x005b0bc6` are the core
  and current-thread-locale wrappers for one multibyte-to-wide character conversion,
  `0x005b0c1b/0x005b0c7b` are the matching wide-to-multibyte pair, and `0x005b0bf1` is the small
  CRT file-handle text-mode flag probe that sits immediately beside them.
  The neighboring older-CRT stream strip is tighter too: `0x005a16f4/0x005a1740` are the nolock
  and lock-scoped close owners for FILE-like streams, `0x005b09bb` is the broader stream-table
  cleanup sweep under CRT lock slot `1`, and `0x005b0a56/0x005b0a9a` are the pushback-buffer
  allocator and single-byte pushback helper.
  The next helper strip beside that is explicit now too: `0x005b0cb0` is the unsigned `u64`
  divide-with-remainder helper, `0x005b0d45` is the tiny x87 round-to-integral shim,
  `0x005b0d58` maps DBCS codepages to default LCIDs, and `0x005b0d87` resets the older CRT
  multibyte-locale tables before the broader bootstrap owner takes over. That owner is grounded
  now too: `0x005b0db0` rebuilds the active-codepage multibyte classification and case tables,
  `0x005b0f42` is the refcounted current-thread locinfo getter under CRT lock slot `13`,
  `0x005b0fb1` configures the global multibyte tables for one codepage, `0x005b1147` is the
  sentinel-aware public codepage-set owner above that, and `0x005b1297` is the one-shot ANSI
  codepage bootstrap wrapper. One older bootstrap layer is explicit now too: `0x005adfbe` builds
  the active codepage character-type tables or installs the ASCII fallback through globals
  `0x0062abd8`, `0x00dba760`, `0x00dba764`, and `0x0062acf0`, while `0x005aec88` is the shared
  `GetStringTypeW/A` bridge beneath both that owner and `0x005b0db0`. The adjacent leaf
  `0x005b16ef` directly queries the default ANSI
  codepage for one LCID through `GetLocaleInfoA(0x1004)`.
  The adjacent older locale-aware compare seam is explicit now too: `0x005a57cf` and
  `0x005a5f26` are the shared current-locale casefolded `strcmp` and bounded-compare siblings,
  `0x005a5838` is the per-byte or DBCS-pair casefold helper beneath both, and `0x005a5900` is
  the one-byte current-locale wrapper used by the nearby numeric text and string-hash helpers.
  When locinfo field `[+0x14]` is absent, the two compare owners fall back to plain ASCII
  casefolded comparators `0x005b0040` and `0x005b0100`; otherwise they route folding through
  `0x005ac579`, so this strip now reads as the older locale-aware compare family rather than
  anonymous text glue under the locale selectors and shell name lookups. The same local text seam
  now has the paired legacy numeric-text normalizers too: `0x005a5fa5` inserts the active decimal
  separator before the exponent marker in place, `0x005a5fe1` trims trailing zeros and an optional
  decimal separator before the exponent or terminating NUL, and `0x005a602c` is the adjacent fixed
  threshold predicate installed into the same five-slot legacy math dispatch table rooted at
  `0x0062a360`. The adjacent older decimal-conversion strip is bounded now too: `0x005b0485` and
  `0x005b04c8` parse ASCII numeric text through `0x005b12b5` and convert the resulting decimal
  record into two-dword or single-dword integer outputs through the fixed-table wrappers
  `0x005b0459/0x005b046f`, while `0x005b050b` materializes rounded significand digits into ASCII,
  `0x005b0582` normalizes one x87 extended value into the local compact float-record form, and
  `0x005b063c` bridges that normalized record into the shared digit-builder path used by the
  adjacent legacy numeric-format owners. That owner layer is explicit now too: `0x005a6046` is
  the small parse-to-single-or-pair-integer dispatch entry, `0x005a614f` is the scientific
  formatter over one x87 extended input, `0x005a625f` is the fixed-format sibling, `0x005a62c7`
  is the general-format owner that chooses between them, and `0x005a6367` is the style-dispatch
  wrapper over `e/E/f` and the remaining general-format lane.
  The neighboring x87 control-word strip is explicit now too: `0x005b06b7` maps one raw x87
  control word into the older CRT abstract control-mask space, `0x005b0749` rebuilds the raw x87
  word from that abstract mask, `0x005b07d7` is the merge-and-apply owner over current state plus
  caller `(value, mask)`, and `0x005b0809` remains the narrow wrapper that forces bit `0x80000`
  clear before applying the update.
  The next numeric seam is grounded structurally too: `0x005b12b5` is the shared ASCII floating
  literal parser into the older 12-byte decimal record, `0x005b2045` accumulates the digit string
  into that record, and `0x005b279c` scales it by a signed power-of-ten exponent.
  `0x0056f3d7` is the x87 3D projective sibling matching `0x005818f0/0x00589960`.
  `0x0055dd80` is the small direct release helper for subordinate layout-state field `[owner+0x2d]`,
  and `0x0055e060` is the wider owner teardown that releases the surrounding handle bands and the
  same subordinate layout-state object before the family falls back to the higher-level shell
  teardown path. The geographic-label text side is tighter now too: beneath
  `shell_emit_geographic_label_text_span` `0x0053a960`, the support strip `0x0053b090`,
  `0x0053b390`, `0x0053b590`, and `0x0053b5c0` now reads as one banked fixed-record loader and
  keyed lookup family with a small recent-query cache plus a string-hash helper. The static load
  loop at `0x0053ce09` seeds those banks from the pointer table rooted at `0x00624e48`, while the
  lookup core partitions rows by `key & 0x1f` into `32` per-bank buckets and keeps a `10`-entry
  recent-query cache rooted at `[this+0x4290c]`. The adjacent stream and staging side is bounded
  too: `0x0053b630/0x0053b690/0x0053b6f0/0x0053b7c0/0x0053b830` now read as the current-entry
  ordinal resolver, current-stream close/open helpers, and the shared byte-read strip, while
  `0x0053b850/0x0053b8d0/0x0053b920/0x0053b970` own the local `13`-byte staging-table growth,
  type-`7` service passes, and bucket-chain reset. The next owner layer is tighter now too:
  `0x0053b9e0` is the broader `Pack System Leak Count : %1` report-and-reset pass, releasing the
  four owned report-slot roots at `[this+0x429b0..+0x429bc]` plus sibling global `0x00ccba50`,
  formatting staging-row fields through `0x0051b700`, publishing them through callback slot
  `0x005c8078`, then tearing the staging slab and all per-bank handles back down. The keyed query
  side now extends cleanly beyond raw lookup: `0x0053bd40` seeks the selected-or-current payload
  stream and returns the handle, `0x0053be10` resolves or lazily opens one keyed typed auxiliary
  object including a descriptor rooted at `data\\Other\\AirplaneTypes.txt`, `0x0053c930` is the
  composite-string lookup wrapper, and `0x0053c9c0` is the matching payload-length resolver. The
  local row side is now first-class too: `0x0053bf60`, `0x0053c000`, and `0x0053c070` release,
  drop references on, and acquire-or-create refcounted staging rows with typed payload roots at
  `[row+0x09]`, while `0x0053c900` resets the adjacent stream-plus-recent-query-cache strip.
  `0x0053ca20/0x0053ca90` now bound the current-selection push/pop frame stack at `[this+0x20428]`,
  and `0x0053cb10` is the small two-`u32` plus optional heap-blob reader sitting directly on top
  of the shared byte-read helper. The broader bootstrap owner is tighter too: `0x0053cb60` zeroes
  the whole family, allocates the four owned report slots, walks the static root-pointer table
  `0x00624e14..0x00624e48`, loads banks through `0x0053b090`, and then routes selected keys such
  as `companyLogo`, `portrait`, and `trainSkin` back through the typed-object strip into those
  report slots. The nearby wrappers `0x0053d0f0/0x0053d110` are just the string-keyed type-`1`
  and type-`6` staging-row acquire helpers above `0x0053c070`. The adjacent `0x0053d130` is
  tighter now too: it strips one caller path to the final basename, derives a second stem copy
  through `0x0051d8a0`, gates on `support_query_path_is_openable_for_read` `0x0051e430`, and only
  then refreshes one type-`7` staging row through `0x0053c710` before resetting owner dword
  `[this+0x427b0] = -1`. Immediately after that, the local
  utility strip `0x0053d1d0..0x0053d470` now resolves as one scored binary-heap plus scored-node
  queue family: `0x0053d1d0/0x0053d240/0x0053d2e0/0x0053d300` are the heap reorder and top-score
  helpers, while `0x0053d320/0x0053d390/0x0053d440/0x0053d470` are the queue acquire, pop-highest,
  membership, and release-side helpers. The sibling heap-owner body now lands too:
  `0x0053d4c0/0x0053d540/0x0053d5d0/0x0053d630` are the pooled scored-heap insert, pop-top,
  release, and construct-with-capacity paths over the same score-at-`+0x04` node shape. The
  adjacent extended owner is now bounded too: `0x0053d6f0/0x0053d740` are the release and
  construct-with-capacity paths for the sibling scored-heap owner that carries one extra sentinel
  header at `[this+0x10]` plus best-score lane `[this+0x14]`, and current callers are the hotkey
  report iterator `0x0045f250` and the nearby shell/runtime owner around `0x00522c67`. The next
  support strip is tighter too: `0x0053d810/0x0053d870` are the CRC32-like NUL-string and fixed
  byte-span hash helpers over table `0x00624e48`, while `0x0053d8a0/0x0053d960/0x0053d9e0/
  0x0053daa0/0x0053dae0/0x0053db20/0x0053dbf0` now resolve as one intrusive `u32 -> ptr`
  hash-table family with optional pooled `0x10`-byte nodes: release, insert, remove-and-return,
  contains, lookup, callback iteration, and construct-with-bucket-count-and-node-capacity.
  That family is already grounded on real world owners too, not just support-side data-structure
  shape: connected-component and local bucket maps under `0x00416170/0x00419110`, selected owner
  hashes under `0x00531ef0`, and the shell-side cleanup owner around `0x00522e7e` all use the same
  pooled hash helpers. Beneath both the scored heaps and that hash family, `0x0053dcb0/
  0x0053dcf0` are now bounded as the shared fixed-stride pool-descriptor release and reset helpers,
  with freelist seeding over caller stride and count rather than one owner-family-specific allocator.
  The next typed payload branch in the same banked-record family is tighter now too: row type `6`
  is no longer just “some constructor under `0x0053c070`”. `0x0053ee70/0x0053e370` now read as the
  construct wrapper and full constructor for one shell image-marker payload that parses a grounded
  keyword set from the banked record text (`Image`, `ImageWH`, `ImageWHForceScale`,
  `ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`,
  `MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`,
  `TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`,
  `HorizontalScaleModifier`, `VerticalScaleModifier`), registers one shell helper token through
  `[0x006d401c+0xc69]`, and then hands off to `0x0053de60`. That heavier sibling is now bounded as
  the payload's screen-metrics and VRAM-policy variant-table refresh owner: it derives current
  screen-space scale from shell display state, resolves one selected TGA or DDS resource through
  `0x0053c1c0`, and rebuilds the live variant array `[this+0x24]` through `0x005520a0` for later
  consumers such as `shell_queue_world_anchor_marker` `0x00552560`. The rebuild and release side
  is explicit too: `0x0053e2b0` releases current variants and the loaded image handle before
  tail-jumping back into `0x0053de60`, while `0x0053e2e0/0x0053ee60` are the real destructor and
  release thunk for the same type-`6` payload family.
  The nearby overlay builders are tighter now too. `0x00478200` is no longer just a generic
  single-marker wrapper: it validates owner id `[this+0x11b]` against collection `0x0062bae0`,
  resolves that live city-database-style owner, samples normalized XY through `0x00455800` and
  `0x00455810`, derives one localized label through `0x0053de00([this+0xaf],2)`, measures
  projected half-height through `0x00477a10`, and then queues the finished marker through
  `0x005521a0/0x00552160/0x00552560`. The broader sibling `0x00478330` now reads as the real
  active-mode overlay-list owner: it derives the current world-space view box from
  `[this+0xc3/+0xc7/+0xcb/+0xcf]` plus live world dims, runs six category passes `0..5`, pulls one
  active-mode collection through `0x005130f0 -> 0x004b2b70` or `0x0050f600`, walks live placed
  structures in `0x006cec20` through `0x0047fd50`, `0x0047df30`, and `0x0047df50`, and emits one
  repeated label-marked overlay stream through `0x00477a10`, `0x004779c0`, and
  `0x00552560`. After those category passes it also walks `0x006cfcbc` and can add one final
  focused-region marker from `[this+0x113]` through `0x0048a170` with label id `0x3c`. The local
  overlay-state helper strip under those builders is tighter now too. `0x00477af0` is the actual
  default reset for the state band `[this+0xa3..+0x11f]`, seeding minimum span floor
  `[this+0x11f]`, default cell bounds `[this+0xbb/+0xbf/+0xcb/+0xcf]`, scale lanes
  `[this+0xd3/+0xd7/+0xdb]`, and normalized rect `[this+0xef/+0xf3/+0xf7/+0xfb]`. `0x00477a70`
  is the paired scaled-max-span helper over the rebuilt cell bounds, while `0x00478dc0` and
  `0x00479510` are now bounded as the two heavier owner passes above that strip: the first rebuilds
  world-cell bounds and normalized rect from mode flags, raster bit `0x02`, and optional
  placed-structure scans, while the second clamps and recenters those bounds and then refreshes the
  normalized rect again after drag- or zoom-side updates. One input-side owner is bounded now too:
  `0x00477c10` maps one screen-space point into a world-cell pair under the current overlay-state
  bounds, and the larger sibling `0x00478cb0` is the drag-side loop above it that repeatedly
  applies those deltas through `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0`
  before re-entering the same overlay-state rebuild or clamp family. The next query above that is
  tighter now too: `0x00479b50` is the nearest-target resolver for this overlay family, first
  searching placed structures in `0x006cec20` through `0x0047df30/0x0047df50` and `0x0051db80`,
  then optionally falling back to regions in `0x006cfca8` through `0x0048a170` when the shell-side
  metric flag bit `0x4` is set. The click-side owner above that is bounded now too: `0x00479d30`
  first maps the cursor through `0x00477c10`, resolves the nearest target through `0x00479b50`,
  then either publishes restriction notices `0x0c12/0x0c13`, forwards one compact selector-`0x384`
  request into the Multiplayer preview owner at `0x006cd8d8`, or dispatches that same local target
  through the active-mode handler pair `0x004b3160/0x004b2c10` before easing the shell scalar tail
  through `0x0045ea20`. The broader raster owner above this branch is bounded now too:
  `0x0047a120` first stages one visible overlay rect through `0x00534930/0x00534c50`, optionally
  allocates the target RGBA buffer, and then rasterizes the visible map window through the world
  classification helpers `0x00534e50`, `0x00534f00`, `0x00449bd0`, and `0x00448aa0`, mapping the
  result through palette table `0x005f2c34` and finally marking city-database owners from
  `0x0062bae0`. The small constructor strip under that raster owner is tighter now too:
  `0x0047b070` and `0x0047b0d0` are the two concrete constructors for vtable `0x005ce840`, both
  reusing `0x00477af0` for default state and then seeding the trailing template byte
  `[this+0xa2]`. The release and service strip under the same vtable is tighter now too:
  `0x0047b110` drops template handle `[this+0xaf]` and surface root `[this+0xab]` before tailing
  into the base release; `0x0047b170` is the main service body that refreshes bounds through
  `0x00479510`, draws the current overlay surface, and then queues either the repeated marker list
  `0x00478330`, the single city-database marker `0x00478200`, or the fallback quad path
  `0x00477d80`; and `0x0047b3d0` is the narrow wrapper that reruns `0x0047a120` into a temporary
  raster target and commits the result back into live surface handle `[this+0xab]`. The next local
  owner strip is tighter now too: `0x0047b470` ensures surface handle `[this+0xab]` by deriving
  zoom-scaled requested dimensions from the current shell zoom table at `[0x006d4024+0x11421e]`,
  growing them as powers of two under controller caps, allocating one `0xec`-byte surface owner
  through `0x00543980`, and immediately rerasterizing through `0x0047b3d0`; `0x0047b5e0` is the
  hover-update sibling that either tracks hovered classification id `[this+0x117]` under overlay
  flag `0x00400000` or refreshes nearest target ids `[this+0x10f/+0x113]` through `0x00479b50`
  before forwarding the live cursor band into `0x00558760`; and `0x0047b720` is now bounded as the
  main message dispatcher for the same family, with current grounded cases for id `6`, refresh pair
  `0xba/0xbb`, and scalar-update id `0xbc`, dispatching into the click owner `0x00479d30`, the
  drag owner `0x00478cb0`, the ensure-surface path `0x0047b470`, the reraster path `0x0047b3d0`,
  and the bounds rebuild owner `0x00478dc0`. The adjacent global marker strip is tighter now too:
  `0x0047ba60` clears the ten-entry global pointer-marker slot table at `0x006ceba4`,
  `0x0047bb90` is the matching release loop, and `0x0047ba80` rebuilds one indexed slot by
  constructing a `0x26e`-byte specialization-root object through `0x0045b680`, seeding it from
  literal roots `pointer`, `pointer2`, or `pointer3` through `0x0045b9b0`, publishing the caller
  world anchor through `0x004556f0`, applying scalar `0.8f` through `0x00455720`, and clearing bit
  `0x20` in the derived state byte. Current grounded callers are the clustered world-side branches
  at `0x0051677b`, `0x00516797`, `0x005167df`, and `0x005167fe`, so this now reads as a real
  shell-side global pointer-marker slot family rather than loose specialization constructors.
  The shared `0xec`-byte surface-owner seam beneath those overlay and layout callers is tighter now
  too. `0x00543080` is the per-owner row-budget refresh pass: unless constructor bytes
  `[owner+0x93/+0x94]` stay live or selector token `[owner+0x07]` already matches the current
  shell mode token, it revisits the eight row slots `[owner+0xa0..+0xbc]` through `0x00542fb0`,
  drops rows whose import now fails, marks readiness bytes `[owner+0x98..+0x9f]` against the
  caller-supplied byte-budget threshold, derives owner byte `[owner+0x06]` from the surviving
  ready rows, and can still re-enter the non-type-`2` postprocess owner `0x00542550`.
  `0x00543220` is the broader global service above that pass: it rate-limits itself through
  `0x0051d890`, samples the live shell view matrix from `[0x006d4024+0x28]`, derives one dynamic
  byte budget from summed camera-motion deltas cached in `0x00ccbb3c..0x00ccbb54`, retires stale
  owners from the intrusive list `0x00ccbb2c`, and then revisits the surviving active owners
  through `0x00543080` when the current budget crosses the local scaled row thresholds.
  The publish side is tighter now too: `0x005435d0` sits beneath both `0x005438d0` and the
  layout-slot binding strip at `0x00545520`, can lazily ensure selector handle `[owner+0x07]`,
  then asks the caller-supplied presentation handle to materialize a bound target through vtable
  slot `+0x50`, uploads the first ready row plus matching-dimension siblings as a mip-style chain
  through `[bound_handle]+0x3c`, frees the uploaded row buffers `[row+0x22/+0x26/+0x2a/+0x2e]`,
  stamps the current shell mode token back into `[owner+0x07]`, increments active-owner global
  `0x00ccbb34`, and refreshes cached byte totals through `0x00540fc0`.
  The lower cursor-capture strip beneath that input service is tighter now too. `0x00543ae0` and
  `0x00543b20` are the begin/end pair for the shell cursor-helper object returned by `0x0051f0b0`:
  the first sets active byte `[+0x08]`, dispatches vtable slot `+0x1c`, and snapshots the live
  shell cursor XY from `0x006d4018+0xa94/+0xa98`, while the second clears that active byte,
  dispatches slot `+0x20`, and restores one screen-space cursor position from the stored XY anchor
  through the current shell zoom table and import `0x005c8264`. The query side is explicit too:
  `0x00543ba0` returns the stored-or-live cursor triplet, `0x00543c10` returns the stored-or-live
  XY pair, and `0x00543c50` is the heavier relative-delta service used by
  `world_view_service_shell_input_pan_and_hover` `0x0043db00`. That heavier helper queries one
  current view metric bundle from the helper object, converts the returned deltas into floats,
  suppresses repeated zero-delta states through `0x00ccbb5c/0x00ccbb60`, accumulates the motion
  into stored XY and triplet bands, clamps the XY anchors to `[0.0, 1.0]`, derives one local
  edge-flag mask, and forwards the resulting state into `0x0054eb90` when live shell input is
  present. The owned-object seam is explicit now too: `0x00543a10` is the constructor-side
  initializer that seeds half-XY defaults and binds the two owned helper objects, while
  `0x00543e60` is the paired release helper that first ends capture and then drops both owned
  objects through their `+0x08` destructors. The tiny live-input gates beneath the same world-view
  predicates are explicit now too: `0x00543e00/0x00543e20/0x00543e40` are the three direct tests
  over shell input word `[0x006d4018+0xa8c]`, masking bits `0x400`, `0x2000`, and `0x800`
  respectively for the primary and secondary pan-channel branches. The adjacent layout-state bridge
  in the `0x52be..0x52c0` setup strip is bounded too: `0x00543e80` is the fixed node-slot-`+0x90`
  publish helper for selector `3` with unit scalar `1.0f`, `0x00543ee0` is the fixed selector-`2`
  sibling, and `0x00543ea0` is the optional RGB-plus-scalar helper that can reuse cached color
  `[layout+0x25a3]` before publishing the same selector-`3` block into bound node
  `[layout+0x25df]`.
  That keeps the label side grounded as a real support-family database strip rather than a loose
  collection of anonymous bootstrap helpers. If shell-state gate
  `[0x006cec74+0x174]` is set it then posts id `320` `Setting Up Buildings...` for
  `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`
  it then posts id `321` `Seeding Economy...` for `simulation_run_chunked_fast_forward_burst`
  `0x00437b20`; only after those setup-side gates does the code post id `319`
  `Setting up Players and Companies...`. That `319` lane is no longer just a shell-state placeholder: its
  earlier hidden prepass is tighter now too: `0x00437737` is the scenario-side named
  candidate-availability seeding pass over the live candidate pool `0x0062b268`, feeding the
  override collection at `[state+0x66b2]` through `0x00434f20` before any visible banner is posted.
  That grounded write path is narrower than the static file evidence, though: the startup reset
  helper `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0` explicitly clears
  `[state+0x66b2]` before the dispatch path begins, and the current exported write-side callers
  we can name after that reset are still just the live-pool preseed `0x00437737`, the sibling
  startup lane `0x00436ad7`, and the editor-side `Industry (Overall)` toggle handler
  `0x004cf430` through `0x00434f20`. So while the fixed `0x6a70..0x73c0` candidate-availability
  block is now well grounded as bundled map/save source data, a direct bulk-import path from that
  block into the live runtime collection `[state+0x66b2]` is still not grounded by the current
  disassembly notes.
  That candidate-side table now has a grounded fixed record layout too: each entry is a `0x22`-byte
  blob with a zero-terminated candidate-name slot at `[entry+0x00..+0x1d]` and one trailing
  availability dword at `[entry+0x1e]`, read through `0x00434ea0` and mirrored later into
  `[candidate+0x7ac]`. The candidate support strip around that latch is tighter now too:
  `0x00412c10` walks the live candidate pool, forces `[candidate+0x7ac] = 1` whenever availability
  bytes `[candidate+0xba/+0xbb]` are already set or subtype `[candidate+0x32]` is not `2`, and
  only for the remaining subtype-`2` cases does it consult `0x00434ea0` by candidate stem before
  tailing into `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`.
  The neighboring collection helpers now read cleanly too: `0x00412bd0` is the collection-wide
  `0x00411ee0` cargo-summary rebuild sweep over already-materialized `0xbc` descriptor strips, and
  `0x00412ba0` is the remove-and-release sibling that clears one candidate's dependent runtime
  descriptor and cargo-membership tables through `0x00411cb0` before erasing that id from the pool.
  The same pool now has an explicit destroy-side wrapper too: `0x00412a90` resets the collection
  vtable to `0x005c93cc`, releases the indexed live-entry storage through `0x00518600`, and tails
  into the common indexed-collection cleanup `0x00518bd0`. The global teardown branch at
  `0x00434480` uses that wrapper immediately before freeing the live candidate-pool object at
  `0x0062b268`, so the pool lifecycle is now bounded on both the rebuild and destroy sides instead
  of only on the rebuild path.
  The auxiliary-owner side is tighter now too: `0x00413dd0` resolves one auxiliary entry's owner
  candidate through dword `[entry+0x173]` and reuses the same current-year gate `0x00412510`,
  while `0x00413d80` only succeeds for subtype-`1` owners and copies candidate words
  `[candidate+0xcb]` and `[candidate+0xcd]` into the projected-footprint helper family.
  The same scenario state keeps a locomotive-side sibling collection at
  `[state+0x66b6]`, read through `0x00435030` and updated through `0x004350b0`, which is now the
  shared named locomotive-availability lane beneath the `Locomotives` editor page and the
  startup-side locomotive seeding branches. That locomotive-side table is the same pattern at a
  larger width: each entry is a `0x41`-byte blob with a zero-terminated locomotive-name slot at
  `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`, later mirrored into
  `[loco+0x7b]`. Both override dwords now read most safely as simple availability bits rather than
  wider mode enums. That `319` lane is no longer just a shell-state placeholder: its
  primary grounded work is still the chairman-profile pair
  `world_seed_default_chairman_profile_slots` `0x004377a0` plus
  `world_build_chairman_profile_slot_records` `0x00437220`, which seed the 16 selector bytes at
  `[0x006cec7c+0x87]`, materialize the per-slot chairman records from the scenario selectors,
  campaign override flag `[0x006cec7c+0xc5]`, and the static persona table at `0x005f2d28`, and then
  publish the selected chairman-profile and linked company summary pair through `[state+0x25]` and
  `[state+0x21]`. The local slot-record shape is tighter too because the shell editor panel around
  `0x004cc2d0` now surfaces it directly: `[slot+0x00]` is the staged chairman profile id,
  `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`,
  `[slot+0x02]` combines with the separate per-slot gate at `[world+0x0bc3+slot*9]` to surface
  `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and
  `[slot+0x04]` is the numeric tuning field. Both the selector seeder and the record materializer
  treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded
  writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction.
  That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat
  flag rather than a generic role byte. The summary fields are tighter too: current direct accessors
  now show `[state+0x25]` as the selected chairman profile id in `0x006ceb9c`, while `[state+0x21]`
  is the linked owning company id copied from `[profile+0x1dd]` through
  `scenario_state_set_selected_chairman_profile` `0x00434890`. The raw id strip under those record
  helpers is tighter now too: `0x004337a0` reads `[state+0x21]` directly as the selected company
  id, `0x004337b0` reads `[state+0x25]` directly as the selected chairman profile id, and
  `0x00433790` is the paired raw selected-company setter that the company and chairman reassignment
  flows use when the visible ownership summary changes without re-entering the full profile setter.
  The underlying profile constructor family is grounded now too. `0x00476140` is the broad
  named-profile constructor beneath both chairman seeding passes: it stores the caller id at
  `[profile+0x00]`, marks the record live through `[profile+0x04] = 1`, seeds byte and guard lanes
  across `[profile+0x291..+0x295]` and `[profile+0x1e1]`, zeroes the large per-company and tail
  bands `[profile+0x2ab..]` and `[profile+0xc66..]`, copies the caller byte into `[profile+0x15c]`,
  seeds `[profile+0x158]` to `7.763f`, formats localized fallback name `0x0b87` when the caller
  name is empty, copies the caller biography into `[profile+0x27]`, and picks one static persona
  row through `0x004760f0`. That helper is now bounded as the wrapped-unused-row allocator over the
  static persona table at `0x005f2d28`, marking one zero flag byte at stride `0x27` after a
  modulo-`0x29` search. The neighboring raw company-slot strip is explicit too: `0x004760a0`
  resolves indexed dword slot `[profile + company_index*4 + 0x2ab]` when the caller's generation
  stamp differs from `[profile+0xc43]`, and `0x004760c6` is the paired store-side helper for the
  same slot plus optional stamp write. The adjacent profile-metric strip used by the player-list
  page is tighter now too: `0x00476320` sums the per-company holding band `[profile+0x15d..]`
  against either cached company scalar `0x00423eb0` or the broader support-adjusted company scalar
  `0x00424fd0`, while `0x004763b0` folds those same per-company contributions through one extra
  thresholded transform before accumulating them. The active-profile collection helpers are direct
  now too: `0x004778c0` returns the live record id of the Nth active chairman profile, and
  `0x00477920` counts how many active chairman profiles precede one caller-selected live record id.
  The neighboring transaction and cached-metric strip is tighter now too. `0x00476780` is the
  direct-total-plus-cash query (`0x00476320 + [profile+0x154]`), while `0x00476c20` is the
  threshold-adjusted-total-plus-cash sibling (`0x004763b0 + [profile+0x154]`). `0x004767a0`
  selects between raw cash `[profile+0x154]`, the direct holding total, or their sum, and
  `0x00476810` caches selectors `0` and `1` into the local qword band rooted at `[profile+0x1e9]`.
  The trade-side helpers now split cleanly too: `0x00476460` is the sell-side mutator that reduces
  one company holding slot `[profile + company_id*4 + 0x15d]`, converts the resulting proceeds
  through `0x00424fd0(-units,1)`, and adds the scaled result back into `[profile+0x154]`; the buy
  companion is `0x00477110`, which first reuses the feasibility gate `0x00476ff0`, then increases
  that same holding slot and subtracts the scaled purchase cost from `[profile+0x154]`. Between
  them, `0x00476e50` computes the rounded `1000`-sized trade block by mode, and `0x00476ff0`
  performs the actual buy-affordability check against current cash plus an optional direct-holdings
  fallback; the reduction-side sibling `0x00476c40` uses the same threshold-adjusted-total-plus-cash
  lane from `0x00476c20` as its optional fallback when the direct holding slot is too small. One
  broader periodic scalar is grounded now too: `0x00476560` walks raw issue `0x39`
  through `scenario_state_sum_issue_opinion_terms_raw` plus the scenario baseline at `0x00433740`,
  clamps the resulting factor against several `[profile+0x154]` thresholds, and then adds the
  final scaled delta back into `[profile+0x154]`; current grounded caller `0x0040a760` applies
  that adjustment across every active chairman profile before the later trigger-kind-`2` pass.
  The adjacent start-new-company gate is explicit now too: `0x00476d10` first rejects through
  localized id `2952` `You're not able to start a new company.` when scenario gate `0x00476a60`
  is active; otherwise it treats `0x004763b0(1) + [profile+0x154]` as the relevant purchasing-power
  lane, succeeds only when that total reaches threshold `0x005c8830`, and on failure formats the
  richer localized warning `271` `You don't have enough money to start a new company!...` using the
  selected chairman profile's current purchasing-power figure from `0x004348c0`.
  The adjacent persona-row lookup strip is partly explicit now too: `0x00476bb0` returns the
  matched static persona row index for current profile stem `[profile+0xc47]`, while `0x00476b30`
  returns the same matched row's `+0x20` asset-stem pointer or falls back to `[profile+0x20]`,
  and `0x00476ab0` is the structural `+0x40` string-pointer sibling for that same row family.
  The adjacent chairman refresh owner is tighter now too: `0x00433850` uses the guard pair
  `0x0062be20/0x0062be1c` to walk the active-chairman collection through
  `0x00477820/0x00477860 -> 0x004771e0` until no nested mutation asks for another pass.
  The editor-side scenario setup surface beside that chairman panel is clearer now too.
  `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` republishes the scenario
  description from `[0x006cec78+0x672e]`, the start-year trio `[+0x66ca]`, `[+0x66d2]`, and
  `[+0x66ce]`, the direct campaign-designated bit `[+0x66de]` through control `0x5b6e`, and the
  inverse of the paired metadata byte `[+0x66f3]` through control `0x5b74`. The resource-side
  anchor is now explicit too: `editorDetail.win` carries localized ids `3160/3161` `Campaign
  Scenario` and `If checked, this map will be reserved as a campaign scenario.` inside the control
  record rooted at `0x5b6e`, so `[+0x66de]` is now the grounded campaign-scenario flag rather than
  an anonymous metadata boolean. `map_editor_scenario_metadata_panel_refresh_briefing_mode`
  `0x004ca670` now bounds the single-player versus multiplayer briefing switch by flipping selector
  `0x621f50`, publishing localized headings `1491` and `3586`, and refreshing the two briefing texts
  from `[state+0x4f30]` and `[+0x5ae9]`. The companion dispatcher
  `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0` makes the year semantics tighter
  too: it commits the description and both briefing texts from edit-control payloads, toggles the
  same two booleans, and clamps the three year fields to `1829..2100` while maintaining `minimum <=
  default <= maximum`, which now lines up directly with the editor strings `Description:` `Minimum
  Start Year:` `Default Start Year:` `Maximum Start Year:` `Briefing` and `Multi-Player Briefing`.
  The neighboring special-conditions page is clearer as well:
  `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0` now grounds the live owner
  for the `Setup_Options_Buttons.imb` list rooted at `0xa7fa`, walks the 49-entry static rule table
  at `0x005f3ab0`, counts enabled flags from `[0x006cec78+0x4a7f]`, and publishes the `Special
  Conditions In Effect` summary from localized id `1053`. The same page now has a bounded live
  dispatcher too: `map_editor_scenario_special_conditions_panel_handle_message` `0x004cb8e0` handles
  both bulk selection controls and direct row-state changes, commits them back into
  `[0x006cec78+0x4a7f]`, and then re-enters the panel constructor to refresh the summary. That table
  is no longer just a raw id run; it now clearly includes the finance and construction restrictions
  `2535..2563`, plus later editor toggles such as `Use Bio-Accelerator Cars`, `Disable Cargo
  Economy`, `Disable Train Crashes`, `Disable Train Crashes AND Breakdowns`, and `AI Ignore
  Territories At Startup`. The neighboring available-chairman page is tighter too.
  `map_editor_available_chairman_panel_construct` `0x004ca540` now bounds the shell-side owner for
  the 40-entry persona-availability surface under `0x5aa0..0x5b03`: it walks the same persona table
  family at `0x005f2d28`, publishes one localized chairman-name row per profile, counts enabled
  availability bytes from `[0x006cec78+0x6987..]`, and emits the summary `%1 out of %2 are
  selected.` from localized id `1035`. The live state owner beside it is now grounded as well:
  `map_editor_available_chairman_panel_handle_message` `0x004cb6f0` handles three bulk-selection
  controls `0x5aa1..0x5aa3` by rewriting that same availability-byte array from preset bytes
  embedded in the persona table, and it also commits direct per-row toggle changes from
  `0x5aaa..0x5b03` back into `[state+0x6987..]` before refreshing the page. So the editor lane now
  has three distinct scenario-setup slices rather than one chairman-only blob: chairman slots,
  scenario metadata and briefings, plus both a rule-toggle matrix and an available-chairman pool.
  There is now one adjacent company-side lane too: current neighboring setup flow conditionally
  enters `world_conditionally_seed_named_starting_railroad_companies` `0x0047d440` when the
  Multiplayer preview owner `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is
  set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is
  clear. That helper no longer looks like a generic company refresh. It seeds exactly three fixed
  named railroad-company records from `RT3.lng` ids `575..577`: `Missouri Pacific`, `New York
  Central`, and `Grand Trunk Railroad`. The first seeded company is tied back to the selected
  chairman-profile summary and becomes the selected company id. The second railroad is tighter now
  too: it only receives a chairman link when `profile_collection_count_active_chairman_records`
  finds at least two live chairman records, and the helper then binds the zero-based second active
  chairman through `profile_collection_get_nth_active_chairman_record` with ordinal `1`. The third
  railroad currently gets no matching chairman-link branch in the grounded setup flow and therefore
  remains an unchaired named company in the live roster. The shell UI above that setup lane is now
  tighter as well: `shell_company_list_window_construct` `0x004c7200` builds a live company-list
  window over the company collection at `0x0062be10`, `shell_company_list_window_refresh_rows`
  `0x004c6c30` formats the active companies with localized strings `267..270`, and only then
  conditionally appends one synthetic row id `0x7fff` through
  `shell_company_list_format_company_or_start_row` `0x004c6b40` so `<<Start New Company>>` appears
  as a separate affordance rather than as part of the seeded trio itself. Current shell paging
  around that same roster is tighter too because the live company collection now has a grounded
  active-only ordinal helper family: `company_collection_count_active_companies` `0x00429a50`,
  `company_collection_count_active_companies_before_company_id` `0x004299f0`, and
  `company_collection_get_nth_active_company_id` `0x00429990`. Those helpers now anchor the “current
  company among active companies” math used by shell-side detail and picker flows rather than
  leaving it as anonymous collection glue. `shell_company_list_window_handle_message` `0x004c6f30`
  then routes the synthetic row into `start_new_company_dialog_open` `0x0047d080`, whose commit path
  now grounds through `start_new_company_dialog_commit_create_company` `0x0047d120`. That lower
  helper unlinks any current chairman-owned company, allocates a fresh company id from the live
  collection at `0x0062be10`, initializes it through `0x00428420`, and only then publishes the new
  selected company. The neighboring compact request helper
  `start_new_company_request_create_company` `0x0047d320` does the same fresh-company path from a
  request block and is already reached from the startup-company branch at `0x00470e48`. The dialog
  side is tighter now too: `0x0047c070` and `0x0047bea0` rebuild the two funding-band globals from
  the selected chairman profile through `0x00476c20` and `0x00476950`, publish their range cards
  into controls `0x714f` and `0x7150`, `0x0047c190` republishes the current pair `0x006cec14` and
  `0x006cec10` into controls `0x7149` and `0x714a`, `0x0047c220` snaps those two current funding
  lanes back onto the active band steps, and `0x0047c360` is the small child-control callback gate
  over that same funding family. The immediate pre-open helper `0x0047d020` is now bounded too: it
  seeds the staged dialog name buffer and then runs the same clustered funding-band rebuild sequence
  before `start_new_company_dialog_open` continues into the constructor/callback modal path. The
  constructor and message side are bounded enough now too: `0x0047c590` constructs the modal dialog
  controls for `0x714f/0x7150/0x7149/0x714a/0x714b/0x714c/0x714d/0x714e`, installs callback
  `0x0047c360` on the funding-band pair, and publishes the live dialog root at `0x006cec18`,
  while `0x0047c3a0` is the main dialog message owner over shell messages `0xca/0xcb`, the staged
  name field `0x714b`, the two funding-step controls `0x714c/0x714d`, the companion summary lane
  `0x714e`, and the modal notice branch rooted at `0x03f2/0x03f4`. The
  immediate sibling shell branch below that roster is still station-oriented: current grounded
  resource names and handlers put one branch on `shell_station_detail_window_construct`
  `0x005068c0`, another on `shell_station_list_window_construct` `0x005074c0`, and the subordinate
  selector lane on `shell_station_pick_window_open_modal_and_return_selected_station_id`
  `0x005078c0` above `shell_station_pick_window_construct` `0x00507620`. But the broader
  company-detail ownership question is no longer open. There is now a separately grounded
  `CompanyDetail.win` family rooted at `shell_company_detail_window_construct` `0x004c5540`, with
  `shell_company_detail_window_handle_message` `0x004c56a0` as its main dispatcher and
  `shell_company_detail_window_refresh_controls` `0x004c2ca0` as the shared repopulation pass for
  the selected-company presentation and tabbed control bands around `0x9476..0x9490`. A grounded
  direct shell-command strip now sits cleanly above those two company panels too: `0x00433a40` is
  the shared availability gate for both the company-list and selected-company-detail lanes,
  rejecting only when scenario toggle `[0x006cec78+0x4aef]` is set. `0x004405a0` uses that gate to
  open detail-panel mode `7` as the direct company-list path, while `0x004405d0` first recovers
  the selected-company id through `0x004337a0`, optionally offers `Start New Company` through
  `0x0047d080` after warning `368` when no company is selected, and only then opens detail-panel
  mode `8` for the selected-company `CompanyDetail.win` lane. A grounded
  shell detail-manager caller reaches that constructor at `0x004dde24`, the first finance-action
  layer beneath it is now bounded through `shell_company_detail_issue_bond_offer_flow` `0x004c3890`,
  `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`,
  `shell_company_detail_buyback_stock_flow` `0x004c46d0`, and
  `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, and the first non-finance layer is
  now bounded too through `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`,
  `shell_company_detail_bankruptcy_flow` `0x004c5b99`, the territory-access family rooted at
  `shell_company_detail_refresh_selected_territory_access_summary` `0x004c1b60` plus
  `shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, backed by
  `company_clear_selected_chairman_if_current_profile` `0x00428a10`,
  `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90`,
  `company_has_territory_access_rights` `0x00424010`, `company_set_territory_access_rights_byte`
  `0x00424030`, and `company_can_purchase_territory_access_rights` `0x00426be0`, plus the two
  control-transfer lanes. `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0` now
  grounds the special chairman's election path: it checks the caller's current stock ownership in
  the target company, rejects insufficient holdings through localized id `623`, rejects recent
  failed attempts through id `624`, and then opens the confirmation under id `625` before seeding
  the local takeover-election state or packaging the same request through the multiplayer shell
  transport. The follow-on resolver `shell_resolve_chairmanship_takeover_vote_and_commit_outcome`
  `0x0050c940` now closes the single-player election loop too: it walks the active chairman profile
  collection, computes weighted votes for and against the takeover, compares the affirmative total
  against half the target-company value, presents the result through
  `shell_present_chairmanship_takeover_vote_outcome_dialog` `0x0050c500` in single-player or
  localized id `3082` in multiplayer, and then either transfers chairmanship through `0x00428a30` or
  stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.
  `shell_company_detail_attempt_merger_flow` `0x004ec640` now grounds the merger side too: it
  rejects empty worlds through id `727`, rejects recent failed attempts through id `728`, checks the
  proposed premium against company cash through localized id `3889`, and then commits into the
  resolver family. That merger resolver is now bounded too:
  `shell_resolve_merger_vote_and_commit_outcome` `0x004ebd10` walks the active chairman profile
  collection, computes weighted votes for and against the proposed merger, compares the affirmative
  total against half the target-company value, presents the result through
  `shell_present_merger_vote_outcome_dialog` `0x004eb890` in single-player or localized id `3059` in
  multiplayer, and then either commits the merger through `0x00427e20` or stamps the current year
  into `[company+0x15f]` as the grounded merger-cooldown field. The vote-bias side beneath that
  resolver is tighter now too: `scenario_state_compute_issue_opinion_multiplier` `0x00436590` is no
  longer just an abstract issue table lookup because its merger callsite uses issue id `0x3a`, which
  lines up directly with localized id `726` saying merger votes depend on public attitude toward the
  management of the two companies. By contrast the broader support-adjusted share-price helper
  `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` uses issue id `0x37`,
  and the shared setter under that lane is tighter now too: `0x004339b0` clamps one small
  scenario-side issue value into `[state+0x2d]` with range `0..4`, derives one companion scalar in
  `[state+0x29]`, and then forces a live-company sweep through `0x00424fd0` so the support-adjusted
  share-price family is recomputed immediately after the issue lane changes. The finance-side debt
  helpers now bound `0x38` and `0x39` separately as the explicit
  credit-rating and prime-rate lanes. That leaves `0x37` as the broader investor-confidence lane
  behind equity support, share price, and adjacent governance pressure, with the strongest current
  text anchors coming from the investor-attitude strings `1217` and `3048/3049` about company or
  chairman performance rather than from the merger-only management-attitude term. One older local lead is now ruled out too: the
  `0x460900..0x460cac` / `0x473620` setup block is the camera-view command family over localized ids
  `3474..3493` (`Select/Assign Camera View 1..9` and `0`), not issue-opinion infrastructure, so it
  should no longer be used as evidence for the player-facing meaning of issue `0x37`. The editor-side
  `Stock Prices` label is also no longer being used as direct evidence here: the `0x4ca980` /
  `0x4cadf0` panel owns a separate float-tuning block `[state+0x0bde..0x0bf6]`, with
  `[state+0x0bde]` merely mirroring `[state+0x0be2]`, so that label belongs to a different
  settings family than the issue table behind `0x37`. A direct shell-resource follow-up now narrows
  the remaining caption question too: the extracted `CompanyDetail.win` blob from `rt3_2WIN.PK4`
  contains no plain-English investor or finance caption for this lane, which matches the owner-side
  read that section-0 is a dynamic `0x947f` text widget fed by
  `shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a separate
  fixed label row. The supporting stat layer is bounded more cleanly now too: the
  surrounding `0x0b` setup in the merger and takeover offer builders is formatter mode rather than a
  player-facing issue number, while the company-side stat wrapper
  `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` now reads as a generic
  stat-family accessor over year-relative series or the bounded slot family in
  `company_read_control_transfer_metric_slot` `0x0042a2e0`. Its recurring family token `0x2329` is
  no longer treated as an issue id here either; it is the stat-family selector paired with localized
  company-stat label id `2329`. That means the paired raw and scaled helpers at `0x004241e0` and
  `0x00424200` now read as narrow control-transfer offer policy totals instead of direct
  issue-argument consumers, and the same broader support-and-governance metric family now also feeds
  the annual shareholder-revolt and creditor-liquidation lane surfaced by localized ids `300..304`.
  The editor-side help text cluster around ids `2433..2437` is no longer floating either: current
  grounded map-editor code now has a live economic tuning family beside the chairman-slot panel.
  `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` binds six slider controls through
  `map_editor_economic_cost_slider_dispatch` `0x004ca980`, which now grounds as the real writer for
  the scenario-state float block `[0x006cec78+0x0be2..0x0bf6]`: lane `0` uses one dedicated scale
  divisor, the trailing five lanes share the centered `(value-0xce)` path, and the helper mirrors
  lane `0` into `[state+0x0bde]`. The surrounding descriptor table at `0x00611c70..0x00612220`
  pairs that wider editor lane with localized fields `Prime Rate`, `Merger Premium`, and `Build
  Stations Cost` through `Steam Engine Cost` plus the comparison or help texts `2433..2437`. The
  broader shell-state master flag at `[0x006cec74+0x68]` still sits above the remaining post-load
  phases, plus two narrower per-phase gates: `[0x006cec74+0x174]` directly fronts id `320` `Setting
  Up Buildings...` and the later region-owned structure-demand and placement pass through
  `world_region_collection_run_building_population_pass` `0x00421c20` plus the deeper per-region
  worker `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, while
  `[0x006cec74+0x178]` directly fronts id `321` `Seeding Economy...` and the chunked burst helper
  `simulation_run_chunked_fast_forward_burst`, whose grounded tail now also sweeps the live region
  collection through `world_region_refresh_cached_category_totals_and_weight_slots` `0x00423d30`;
  id `322` then fronts `Calculating Heights...`. The
  master `+0x68` flag is no longer just structural: the shell load/save coordinators now use the
  same flag to force the editor-map `.gmp` family, so current evidence treats it as the broader
  editor-map mode above those later setup branches rather than an unnamed generic toggle. That
  worker is no longer one opaque building bucket: current grounded categories split into `House`, a
  weighted region-profile family surfaced through the `Industry Weightings` stats path, and a third
  branch whose low-level fallback token is `Commercial` but whose aligned stats label is `City
  Support`. The same placement-commit gate beneath it, `world_region_validate_and_commit_candidate_placement`
  `0x00422a70`, is also corroborated by the separate world-side randomized batch helper
  `world_try_place_random_structure_batch_from_compact_record` `0x00430270`, which retries
  placements around one compact center/radius record rather than the ordinary per-region demand
  deficits. That batch placer now sits under a wider compact runtime-effect dispatcher,
  `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, so the world-side
  branch is no longer just “another caller near `0x43051e`” but one real effect family alongside
  the ordinary region-demand worker. Above that, the live scenario event collection at `0x0062be18`
  now has a tighter runtime-effect lane too: `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects`
  `0x004323a0` services one live runtime-effect record, dispatches its linked compact effects
  through `0x00431b20`, and can synthesize follow-on records through
  `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets`
  `0x00430b50`, which in turn allocates new live records through
  `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`.
  Above that, `scenario_event_collection_service_runtime_effect_records_for_trigger_kind`
  `0x00432f40` now bounds the collection-wide loop that services those live runtime-effect records
  for one trigger kind. That trigger split is tighter now too: recurring simulation maintenance
  drives kinds `1`, `0`, `3`, and `2`; the neighboring route-style follow-on drives `5` and `4`;
  startup-company and named-railroad creation branches drive `7`; kind `6` is now bounded as a
  mixed post-change family spanning the placed-structure post-create tail, one build-version-gated
  company-startup or roster-refresh tail, and the route-entry post-change sweep on `0x006cfca8`;
  one world-entry-side one-shot gate drives `8` and then clears shell-profile latch
  `[0x006cec7c+0x97]`; the briefing-text query lane is kind `9`; and the collection dirty latch
  still forces the internal rerun at kind `0x0a`.
  That moves this branch out of the “isolated world-side placement oddity” bucket and into a real
  scenario-runtime effect pipeline with a mostly bounded trigger-kind family.
  The same lower helper also reappears later on a slower
  simulation-side cadence with
  scale `1/12`, so it no longer looks like one-time setup glue only. The actual game-speed control
  family remains separate, rooted at `world_set_game_speed_mode` `0x00434680`,
  `world_adjust_game_speed_mode_delta` `0x00434850`, and `world_toggle_pause_or_restore_game_speed`
  `0x00437a60`. The direct shell command stub above that family is now explicit too: `0x00440880`
  just re-enters the pause-or-resume toggle with flag `1` and then issues one indexed shell
  feedback nudge through `0x0045ea20` with selector `0x2c` and scalar `0.5f`. That feedback path
  is tighter now too: `0x0045ea20` is the reusable indexed audio-feedback helper over the
  table-driven pairs at `0x005f0828/0x005f082c`, and `0x00531e10` is the shell-audio-service sink
  that only dispatches those nudges when the live service gates are satisfied.
### Camera View Command Strip

The adjacent shell-command family at `0x004408f0..0x00440c30` is now
  grounded as the ten-slot `Assign/Select Camera View` owner rather than as a generic modal strip.
  `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0` snapshots one `0x30`-byte
  record inside the live world-view owner through `world_view_store_camera_view_slot_snapshot`
  `0x0043b2c0`, storing both the live view tuple `[view+0x04..+0x24]` and one saved focus-kind pair
  from `[0x006cec78+0x45/+0x49]`; `shell_select_camera_view_slot_or_publish_unassigned_warning`
  `0x004409c0` then re-enters `world_view_restore_camera_view_slot_snapshot_if_populated`
  `0x0043ca20`, which restores the same fields, optionally replays the saved focus through
  `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`, and returns silently on success.
  Only empty slots surface the shared shell modal path, using localized ids `371..373` after one
  label-format pass through `0x0051b700`. The wrapper strip `0x00440b00..0x00440c30` is now fully
  bounded too: `0x00440b00/10/20/30/40/50/60/70/80/90` are `Assign Camera View 1..9/0`, while
  `0x00440ba0/b0/c0/d0/e0/f0/c00/c10/c20/c30` are `Select Camera View 1..9/0`, and the
  registration block at `0x00460903..0x00460cac` ties those wrappers to localized command ids
  `3474..3493`.
### CompanyDetail Addendum

The shared helper `shell_company_detail_resolve_selected_company` at
  `0x004c16f0` now bounds the common current-company accessor beneath the whole pane, and the
  read-side owner also has a separate active-company navigation family through
  `shell_company_detail_step_selected_active_company_delta` at `0x004c3470` plus the next or
  previous wrappers at `0x004c3540` and `0x004c3550`. The section switch in
  `shell_company_detail_window_refresh_controls` is now grounded too: section index `0x006cfe60`
  selects a chairman/governance slice, a debt-and-capital slice, a per-share slice, or a
  territory-access slice, published through the tab band around `0x9472..0x9479`, with adjacent
  section-navigation controls around `0x947b..0x947c` and `0x948f..0x9490`.
### Key Dispatchers

`shell_controller_window_message_dispatch`,
  `shell_input_apply_window_key_transition`, `shell_input_snapshot_dispatch_state`,
  `shell_input_cursor_inside_active_view`, `world_load_saved_runtime_state_bundle`,
  `world_runtime_serialize_smp_bundle`, `simulation_frame_accumulate_and_step_world`,
  `game_message_window_service_if_present`, `game_message_window_service_frame`,
  `game_uppermost_window_handle_message`, `game_uppermost_window_service_world_hotspot_band`,
  `game_uppermost_window_refresh_controls`,
  `world_view_service_keyboard_turn_pan_and_zoom_bindings`, `world_view_step_heading_quadrant`,
  `world_view_step_zoom_bucket`, `world_seed_default_chairman_profile_slots`,
  `world_build_chairman_profile_slot_records`,
  `world_conditionally_seed_named_starting_railroad_companies`,
  `scenario_state_set_selected_chairman_profile`,
  `scenario_state_get_selected_chairman_profile_record`,
  `scenario_state_get_selected_chairman_company_record`, `shell_company_list_window_construct`,
  `shell_company_list_window_refresh_rows`, `shell_company_list_window_handle_message`,
  `start_new_company_dialog_open`, `start_new_company_dialog_commit_create_company`,
  `start_new_company_request_create_company`, `shell_station_detail_window_construct`,
  `shell_station_list_window_construct`, `shell_station_list_window_handle_message`,
  `shell_station_pick_window_construct`, `shell_station_pick_window_populate_station_rows`,
  `map_editor_chairman_slot_panel_construct`, `map_editor_chairman_slot_panel_handle_message`,
  `map_editor_chairman_slot_panel_refresh_selected_slot`,
  `map_editor_chairman_slot_panel_cycle_selected_slot_profile`,
  `map_editor_available_chairman_panel_construct`,
  `map_editor_available_chairman_panel_handle_message`,
  `map_editor_scenario_metadata_panel_refresh_briefing_mode`,
  `map_editor_scenario_metadata_panel_refresh_controls`,
  `map_editor_scenario_metadata_panel_handle_message`,
  `map_editor_scenario_special_conditions_panel_construct`,
  `map_editor_scenario_special_conditions_panel_handle_message`,
  `map_editor_economic_cost_slider_panel_construct`, `map_editor_economic_cost_slider_dispatch`,
  `station_place_world_surface_sync_and_dispatch`, `station_place_window_handle_message`,
  `track_lay_window_refresh_controls`, `track_lay_window_service_frame`,
  `track_lay_window_handle_message`, `simulation_advance_to_target_calendar_point`, the smaller
  single-step helper at `0x00409e80`, `0x0040a9c0`, `0x0040a910`, and
  `simulation_service_periodic_boundary_work`.
### State Anchors

Shell input object `0x006d4018`, per-key state table starting at `[input+0x100]`,
  packed shell input flags at `[input+0xa8c]` now grounded as Right Shift `0x1`, Left Shift `0x2`,
  Control `0x4`, and Alt `0x20`, nested dispatch counter `[input+0xa90]`, global shell controller
  `0x006d4024`, active world root `0x0062c120`, `GameMessage.win` object `0x006d081c`,
  `GameUppermost.win` overlay object `0x006d0820`, `StationPlace.win` tool object `0x006d1720`,
  `TrackLay.win` tool object `0x006d1a8c`, accumulated leftover simulation time at `[this+0x4c80]`,
  shell and mode globals at `0x006cec74`, `0x006cec78`, and `0x006cec7c`, world manager collections
  at `0x0062be10`, `0x006ceb9c`, `0x006cfcbc`, `0x006cec20`, `0x0062bae0`, and `0x006acd34`, plus
  the packed calendar-like tuple fields around `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and
  `[this+0x14]`.
### Subsystem Handoffs

The controller window dispatcher now looks like the first grounded input
  ingress. It translates keyboard and mouse `WM_*` traffic into shell controller state and the
  separate input object at `0x006d4018`; read-side cursor and camera helpers later snapshot that
  object through `shell_input_snapshot_dispatch_state` and gate world-relative interaction through
  `shell_input_cursor_inside_active_view`. Current grounded consumers around `0x00478cb0`,
  `0x004e0780`, `0x0053f450`, and `0x0053fe90` still sit on the shell controller path and consult
  `0x006d4024` or the world owner at `0x0062be68`, so there is still no evidence for a distinct
  gameplay-only input object after world entry. Instead, the first deeper world-mode interaction
  branch now looks like a shared world-view coordinator layered on top of the same shell-fed input
  state. Shell_transition_mode ensures the `GameUppermost.win` object at `0x006d0820`; its message
  dispatcher `game_uppermost_window_handle_message` owns the narrow action band `0x7918` through
  `0x7921`; and the recurring service helper `game_uppermost_window_service_world_hotspot_band`
  rate-limits those hotspot actions, rechecks `shell_input_cursor_inside_active_view`, and then pans
  the live world view through `world_view_pan_relative_offset_in_camera_plane` `0x0043d130`. The
  same lower setter family is also reached from the cursor-drag path through
  `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0`. Above both of those sits the
  larger recurring service `world_view_service_shell_input_pan_and_hover` `0x0043db00`, which now
  has one grounded keyboard branch beneath it:
  `world_view_service_keyboard_turn_pan_and_zoom_bindings` `0x0043d740`. That helper resolves four
  binding-pair families from the shell input table via `0x0054e7d0`, and the localized labels are
  now grounded from `Data/Language/RT3.lng`: `Camera Forward` and `Camera Backward` feed the first
  signed pan channel, `Camera Left` and `Camera Right` feed the second signed pan channel, `Camera
  Zoom In` and `Camera Zoom Out` feed the signed zoom-step channel that `0x0043db00` smooths into
  `world_view_step_zoom_bucket` `0x0043cc30`, and `Camera Rotate Left` plus `Camera Rotate Right`
  feed the continuous heading-turn branch through `0x0043c810`. The setup side is now better bounded
  too: `world_view_seed_keyboard_binding_slot_pairs` at `0x00439e40` seeds the eight slot pairs at
  `[this+0x0a6]` through `[this+0x0e2]` from the global action-binding registry through
  `shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id` `0x0045f370` using
  the distinct registry keys `0x0043d2a0` through `0x0043d310`, and the registration block at
  `0x00460769` through `0x004608e7` plus the shared installer
  `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` show those roots
  are defaulted to the expected Up Down Left and Right virtual keys before runtime polling begins.
  The adjacent lookup strip is tighter now too: `shell_input_binding_registry_resolve_entry_by_action_stem`
  `0x0045ede0` resolves one action stem into the live binding registry, while
  `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0` and
  `shell_input_binding_registry_query_primary_code_by_action_stem` `0x0045f400` are the small
  display-label and primary-code wrappers above that resolver. The camera-view modal family at
  `0x004408f0/0x004409c0` now uses that same strip directly when formatting the optional focus-label
  lines inside the assign/select camera-view confirmations. The lower label path is now bounded too:
  `shell_input_binding_format_display_label_from_registry_entry` `0x0045ea90` is the actual
  registry-entry formatter with the three localized prefix fragments `0xdef/0xdf0/0xdf1` plus the
  descriptor-table caption fallback at `0x005f0a34`, and
  `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular`
  `0x0045ed90` is the descriptor-side bucket-key helper used by the installer when the target mode
  mask is singular. The same local family now reaches one step further into the hotkeys sidecar:
  `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250` builds a
  temporary sorted report queue over the live registry, `shell_input_write_hotkeys_report_file`
  `0x0045f550` writes the resulting table to `hotkeys\hotkeys.txt`, and the hotkey reassignment path
  uses the smaller helpers `0x0045ec00`, `0x0045ec70`, `0x0045ecd0`, `0x0045ed70`, `0x0045ef00`,
  and `0x0045f8a0` to split imported `foo+bar` labels, recover one action id from the descriptor
  table, decode a compact modifier code, expand that code back into the live registry mask, and
  finally rebucket or replace the live binding entry. The surrounding registry lifecycle is tighter
  now too: `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0`
  seeds the fixed defaults from `0x005ecadc` and then appends the smaller manual shell-command
  strip; `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070` is the
  hard reset that also flushes `hotkeys\hotkeys.txt`; and
  `shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file`
  `0x00461120` rebuilds the pool roots, reseeds defaults, and tail-jumps into
  `shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels` `0x0045f420`
  when the caller requests saved-hotkey import.
  Beneath that camera stack, the enclosing frame
  path now has one grounded non-view sidecar: after `0x0043db00` it reads the active controller-view
  object pointer at `[0x006d4024+0x18]+0x366e`, compares it against the latched target at
  `[frame_owner+0x66a2]`, fires exit and enter-style vtable callbacks on pointer changes through
  slots `+0x64` and `+0x60`, and only latches the new object when the object passes its own slot
  `+0x1c` availability test and shell detail control id `0x07d6` on `0x006d0818` has flag bit `0x4`.
  That `0x07d6` gate is now more bounded than before: the dedicated `TrackLay.win` tool family
  rooted at `0x006d1a8c` special-cases the same control id in both `track_lay_window_service_frame`
  and `track_lay_window_handle_message`, uses world hit tests through `0x00448ac0` to arm and
  release a drag latch on that surface, and routes the resulting command work through the shared
  track-lay mode state at `0x00622b0c`. The surrounding `track_lay_window_refresh_controls` pass now
  shows that this is not just one isolated drag handler: the same tool family owns three mutually
  exclusive primary mode buttons at `0x985e` `0x985f` and `0x9860`, and current primary evidence now
  bounds those values as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40`
  from the localized strings 2054 2055 and 1721 plus the matching control-routing branches in
  `track_lay_window_handle_message`. The same family also owns the downstream route-entry policy
  bridge at `0x004955b0`: current caller evidence says that helper maps the live TrackLay primary
  mode into endpoint-synthesis policy `1` or `4` before the tool re-enters `0x00493cf0`, which is
  the strongest current bridge from the player-facing single-track versus double-track buttons into
  the lower route-builder policy bytes. The same family also owns a bridge-type preference selector
  rooted at `0x006cec74+0x138`, two wrapped `Never` through `Common` frequency settings at
  `0x006cec74+0x140` and `0x006cec74+0x13c`, two boolean track-lay preference toggles, and the
  electrify-all-track action path. Those last two toggles are now tighter than before: current
  evidence strongly aligns control `0x986e` and state `0x006cec74+0x144` with `Auto-Hide Trees
  During Track Lay` from strings 1838 and 1839, while control `0x986d` and state `0x006cec78+0x4c74`
  align with `Auto-Show Grade During Track Lay` from strings 3904 and 3905. That mapping is still
  evidence-backed rather than absolutely direct from a recovered resource table, but the state
  ownership and control order now make it the strongest current fit. That makes `0x07d6` look like
  the shared main-world interaction surface inside a broader TrackLay world-command subsystem, not
  an unrelated detail button. The neighboring `StationPlace.win` family is now grounded on that same
  surface too: the shell detail-panel constructor family allocates it through
  `station_place_window_construct` at `0x00509d80`, publishes it at `0x006d1720`, services it each
  frame through `station_place_window_service_frame` at `0x0050a530`, and routes player-facing
  commands through `station_place_window_handle_message` at `0x005091b0`. That dispatcher
  special-cases the same `0x07d6` control, and the shared helper
  `station_place_world_surface_sync_and_dispatch` at `0x00508bb0` either accepts that direct surface
  traffic or falls back to the same detail-panel control looked up through `0x006d0818`, rechecks
  flag bit `0x4`, hit-tests the world through `0x00448ac0`, stages world coordinates into
  `0x006d1738/0x006d173c`, refreshes the remaining preview metric field through
  `station_place_refresh_preview_metric_control_0x6983` `0x00508550`, and updates the live
  station-placement selection state at `0x00622af0`, `0x00622aec`, and `0x006d1740`. The tool-side
  save and restore choreography is tighter now too: `station_place_window_release_cached_selection_handles_and_world_followons`
  `0x005079c0` releases cached helper handles `[this+0x7c/+0x80/+0x88/+0x84]` through the matching
  global owners after re-entering world and placed-structure follow-ons, and the thin wrapper
  `0x00507a50` is the entry used by the broader save-load status-stack helpers. The category side
  of that state is now tighter too: the shared helper `0x0044bd10` quantizes the staged world coordinates into the
  current cell, resolves the mixed byte-or-word region id from `[world+0x212d]`, looks up the
  owning city-or-region entry through `0x0062bae0`, and returns `[entry+0x272]` with fallback
  `5`; the StationPlace world-surface branches at `0x00508b80`, `0x00508d59`, and `0x0050a4e6`
  use that result directly to refresh the current selection category latch at `0x00622af0`.
  Together with
  `station_place_select_category_and_refresh` `0x00508880`,
  `station_place_refresh_category_controls` `0x00507b90`, and `station_place_format_preview_panel`
  `0x00508730`, that makes StationPlace a second grounded consumer of the shared main-world
  interaction surface rather than only a sibling constructor plus frame hook. The StationPlace
  control semantics are now tighter too: the top category strip at `0x697c` through `0x6981` now
  grounds as small station, medium station, large station, service tower, maintenance facility, and
  non-station building from `RT3.lng` strings 2197 through 2202. For the three station categories
  only, the secondary strip at `0x6988` and `0x6989` plus display field `0x698c` no longer looks
  like another placement mode family; it is a building-style scroller. The click handlers on
  `0x6988` and `0x6989` cycle the style override in `0x00622aec`, and the display path builds the
  active style token from `StationSml`, `StationMed`, or `StationLrg` plus the localized
  architecture styles `Victorian`, `Tudor`, `Southwest`, `Persian`, `Kyoto`, and `Clapboard` from
  `RT3.lng` ids 2672 through 2667. One layer lower, the remaining opaque controls are now much
  tighter: `0x6985` and `0x6986` are no longer a generic assist toggle but the two station-rotation
  policy choices from strings 2207 and 2206, switching between auto-orienting the building to track
  or obstacles and strictly obeying the rotation specified by the circle above. The dedicated
  control at `0x6987` is the station-rotation circle itself, wired through
  `station_place_rotation_circle_callback_publish_current_heading_widget` `0x00507a90` and aligned
  with `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.`
  string 2208. The lower rotation strip is now grounded too:
  `station_place_set_rotation_and_refresh_live_selected_site_pose` `0x00507cf0` owns the write to
  `0x006d172c` and the live selected-site pose refresh, `station_place_window_drag_rotate_selected_site_toward_world_cursor`
  `0x00507d80` is the drag-update branch under the dispatcher, and
  `station_place_step_rotation_by_integer_notches` `0x005086c0` is the discrete notch helper used by
  the neighboring StationPlace rotation-step branches. That matches the lower behavior too: when the
  strict-rotation choice is off, both preview and commit paths route staged coordinates through
  `station_place_window_try_auto_orient_candidate_to_covering_route_entry_and_validate_placement`
  `0x00508040`, which performs the extra orientation search before validation by retrying a small
  orientation-mode set around the reusable covering-route-entry helper `0x00417b40`; when strict
  rotation is on, that pass is skipped and the current angle in `0x006d172c` is used directly. The
  preview strip is tighter now too: `station_place_format_preview_panel` `0x00508730` is the real
  owner for controls `0x6982/0x6983/0x6984`, and the middle field `0x6983` is no longer anonymous.
  The paired description side is explicit now too: `0x00413bc0` is the formatter behind preview
  control `0x6984`, starting from placement-record text at `[record+0x40]` and then appending
  rule-table driven explanatory lines after casefolded compares against `[record+0x7c]`.
  `station_place_refresh_preview_metric_control_0x6983` `0x00508550` resolves the staged world-cell
  category through `0x0044ad60`, reads the linked profile scalar at `[profile+0x22]`, chooses issue
  slot `0x3b` or `0x3c` from candidate subtype byte `[candidate+0x32]`, folds that scalar through
  `scenario_state_compute_issue_opinion_multiplier` `0x00436590`, and then passes it through the
  version-gated quantizer `0x005084a0` before formatting the visible text into control `0x6983`.
  The singleton-side entry above that strip is explicit now too:
  `station_place_format_preview_panel_if_live_singleton_and_valid_selection` `0x00508860` only
  forwards non-`-1` selection ids into that refresh path when `0x006d1720` is live.
  One layer below preview versus commit, the shared gate is also tighter now:
  `station_place_validate_current_selection_at_world_coords_and_optionally_format_status`
  `0x00507e80` is the common validation-and-status path beneath the preview and commit branches,
  publishing red, yellow, or green feedback through `0x0040cb10` around the same
  `placed_structure_validate_projected_candidate_placement` `0x004197e0` core. The
  direct shell UI also exposes the same discrete view-step family through
  `world_view_step_heading_quadrant` `0x0043cb00` and
  `world_view_step_zoom_bucket` `0x0043cc30`. The neighboring gating predicates
  `world_view_should_drive_primary_pan_channel` and `world_view_should_drive_secondary_pan_channel`
  test packed shell input bits `0x3`, and `shell_input_apply_window_key_transition` now grounds
  those bits as the left and right Shift modifiers from scan codes `0x2a` and `0x36`. That means
  cursor drag, overlay hotspots, held Shift state, direct keyboard turn/pan/zoom bindings, the
  TrackLay and StationPlace world-command surfaces, and at least one frame-owned hover or
  focus-target branch all converge under the same shell-fed world-mode input path rather than a
  separate gameplay-input stack. The ownership seam is therefore closed at the current local level:
  the unresolved pieces are the exact per-tool or per-mode actions beneath that path, not whether a
  later non-cursor gameplay branch bypasses the shell controller input roots.
### Evidence

Function-map rows for `shell_controller_window_message_dispatch`,
  `shell_drain_pending_window_messages`, `shell_input_state_init`,
  `shell_input_apply_window_key_transition`, `shell_input_snapshot_dispatch_state`,
  `shell_input_cursor_inside_active_view`, `world_load_saved_runtime_state_bundle`,
  `world_runtime_serialize_smp_bundle`, `world_entry_transition_and_runtime_bringup`,
  `simulation_frame_accumulate_and_step_world`, `game_message_window_service_if_present`,
  `game_message_window_service_frame`, `shell_ensure_game_uppermost_window`,
  `game_uppermost_window_construct`, `game_uppermost_window_handle_message`,
  `game_uppermost_window_service_world_hotspot_band`, `world_view_set_focus_position_xyz`,
  `world_view_apply_screen_delta_to_focus_position`,
  `world_view_pan_relative_offset_in_camera_plane`, `world_view_seed_keyboard_binding_slot_pairs`,
  `world_view_service_keyboard_turn_pan_and_zoom_bindings`, `world_view_step_heading_quadrant`,
  `world_view_step_zoom_bucket`, `world_view_should_drive_primary_pan_channel`,
  `world_view_should_drive_secondary_pan_channel`, `world_view_service_shell_input_pan_and_hover`,
  `world_seed_default_chairman_profile_slots`, `world_build_chairman_profile_slot_records`,
  `world_conditionally_seed_named_starting_railroad_companies`,
  `profile_collection_count_active_chairman_records`,
  `profile_collection_get_nth_active_chairman_record`,
  `scenario_state_set_selected_chairman_profile`,
  `scenario_state_get_selected_chairman_profile_record`,
  `scenario_state_get_selected_chairman_company_record`, `start_new_company_dialog_open`,
  `start_new_company_dialog_commit_create_company`, `start_new_company_request_create_company`,
  `shell_company_list_format_company_or_start_row`,
  `shell_company_list_activate_or_shift_center_company`, `shell_company_list_window_refresh_rows`,
  `shell_company_list_window_handle_message`, `shell_company_list_window_construct`,
  `shell_company_detail_window_refresh_controls`, `shell_company_detail_window_construct`,
  `shell_company_detail_window_handle_message`, `shell_station_detail_window_construct`,
  `shell_station_list_window_construct`, `shell_station_list_window_handle_message`,
  `shell_station_pick_window_construct`, `shell_station_pick_window_populate_station_rows`,
  `map_editor_chairman_slot_panel_construct`, `map_editor_chairman_slot_panel_refresh_slot_list`,
  `map_editor_chairman_slot_panel_refresh_selected_slot`,
  `map_editor_chairman_slot_panel_refresh_slot_counters`,
  `map_editor_chairman_slot_panel_cycle_selected_slot_profile`,
  `map_editor_chairman_slot_panel_handle_message`, `map_editor_available_chairman_panel_construct`,
  `map_editor_available_chairman_panel_handle_message`,
  `map_editor_scenario_metadata_panel_refresh_briefing_mode`,
  `map_editor_scenario_metadata_panel_refresh_controls`,
  `map_editor_scenario_metadata_panel_handle_message`,
  `map_editor_scenario_special_conditions_panel_construct`,
  `map_editor_scenario_special_conditions_panel_handle_message`,
  `map_editor_economic_cost_slider_panel_construct`, `map_editor_economic_cost_slider_dispatch`,
  `station_place_refresh_category_controls`, `station_place_format_selected_site_summary`,
  `station_place_format_preview_panel`, `station_place_select_category_and_refresh`,
  `station_place_world_surface_sync_and_dispatch`, `station_place_window_handle_message`,
  `station_place_window_construct`, `station_place_window_service_frame`,
  `track_lay_window_refresh_controls`, `track_lay_window_construct`,
  `track_lay_window_service_frame`, `track_lay_window_handle_message`, and
  `simulation_service_periodic_boundary_work`, plus the shell-input disassembly around `0x0054f290`,
  `0x0054e880`, `0x0054e9c0`, `0x0054ea20`, `0x0054eb10`, and `0x0054ee50`,
  the world-view setup and service branches around `0x00439e40`, `0x0043d740`, `0x0043db00`,
  `0x0043cb00`, and `0x0043cc30`, the `319` setup-side branches around `0x004377a0`, `0x00437220`,
  `0x00477820`, `0x00477860`, `0x0047d440`, `0x004c6c30`, `0x004c6f30`, `0x0047d080`, `0x0047d120`,
  `0x0047d320`, `0x004c2ca0`, `0x004c5540`, `0x004c56a0`, `0x005068c0`, `0x005071e0`, `0x005074c0`,
  and `0x005076c0`, the direct summary-field helpers around `0x00434870` `0x00434890` and
  `0x004348c0`, the company-link writers at `0x00427c70` and `0x00427d74`, the company constructor
  at `0x00428420`, the startup-company branch around `0x00470e48`, the shell company-list strings
  `266` `<<Start New Company>>`, `267` `You are the chairman of the %1!`, `268` `The %1 has no
  chairman at the moment.`, `269` `%1 is the chairman of the %2.`, `270` `Double-click for
  details.`, and `2992` `Shift-Click to center on this company's primary station.`, the
  `CompanyDetail.imb` and `CompanyDetail.win` resource strings in `.rdata`, the `StationDetail.imb`,
  `StationDetail.win`, `StationList.win`, and `StationPick.win` resource strings in `.rdata`, the
  shell editor window branches around `0x004c9da0`, `0x004ca010`, `0x004ca1c0`, `0x004ca540`,
  `0x004ca670`, `0x004ca790`, `0x004ca980`, `0x004cb2b0`, `0x004cb4a0`, `0x004cb6f0`, `0x004cb8e0`,
  `0x004cc250`, `0x004cc2d0`, `0x004ceb90`, and `0x004cecc0`, the localized chairman-slot strings
  `2997` through `3001` `Optional` `Mandatory` `Human or Computer` `Computer` and `Human`, the
  localized scenario-editor strings `1483..1492` `Description:` through `Type the briefing for this
  map.`, the localized summary strings `1035` `%1 out of %2 are selected.` and `1053` `Special
  Conditions In Effect`, the 40-entry persona availability page under `0x5aa0..0x5b03`, the 36-entry
  special-condition table at `0x005f3ab0` covering ids `2535..2563`, `2874`, `3722`, `3835`, `3850`,
  `3852`, and `3920`, the static persona table at `0x005f2d28`, the selector array at
  `0x006cec7c+0x87`, the persona collection at `0x006ceb9c`, the localized persona strings in
  `Data/Language/RT3.lng` including `2730` `Unassigned`, the named-chairman range `2731+`, and the
  neighboring biography range `2495+`, plus the seeded railroad-name strings `575` `Missouri
  Pacific`, `576` `New York Central`, and `577` `Grand Trunk Railroad`, the StationPlace.win
  constructor plus category, dispatcher, rotation-circle, shared-world-surface, preview-build, and
  recurring service branches around `0x00507a90`, `0x00507b90`, `0x00508550`, `0x00508730`,
  `0x00508880`, `0x00508bb0`, `0x005091b0`, `0x00509d80`, and `0x0050a530`, the StationPlace string
  cluster `Place a small station` 2197 `Place a medium station` 2198 `Place a large station` 2199
  `Place a service tower` 2200 `Place a maintenance facility` 2201 `Place a non-station building`
  2202 `Scroll through building styles.` 2203 `When placing the building, it will strictly adhere to
  the rotation specified by the circle above.` 2206 `When placing the building, it will rotate
  itself as needed to orient to track or avoid obstacles.` 2207 `Click to rotate the building. You
  can also use bracket keys [ and ] to rotate buildings.` 2208 and the architecture-style labels
  `Clapboard` 2667 `Kyoto` 2668 `Persian` 2669 `Southwest` 2670 `Tudor` 2671 and `Victorian` 2672,
  the TrackLay.win constructor and dispatcher family around `0x0050d2d0`, `0x0050e400`,
  `0x0050e070`, `0x0050e1e0`, and `0x0050e5c0`, the localized `Never` through `Common` strings 615 through 618,
  the track-lay strings `Bulldoze` 1721 `Lay single track.` 2054 `Lay double track.` 2055 and 3114,
  and the deeper shared bulldoze helper at `0x0044b160`. That helper is no longer just a vague
  proximity scan: it validates the active company unless editor mode is active, emits the exact
  RT3.lng bulldoze rejection ladder `419..424`, reads company cash through `0x0042a5d0`,
  debits approved bulldoze cost through `0x0042a080`, and then scans nearby route entries,
  linked structures, city-or-region records, route blockers, and placed structures before
  committing the mutation. The nested tool-side entry is tighter now too: `0x0050e070` increments
  the TrackLay reentry guard, snapshots several live route-owner fields from `0x006cfca8` into the
  tool object, refreshes tool-local state through `0x0050dab0`, and only then tails into the later
  restore or service branch `0x0050d1e0`. That tail is now tighter too: `0x0050d1e0` resets the
  route-owner search state through `0x0049ad90/0x00495540`, drops invalid cached route ids from the
  TrackLay tool or deletes non-admitted live entries when route latch `[route+0x118]` is set,
  clears `[tool+0x78]`, and then conditionally refreshes shell presenter slot `[presenter+0x3741]`
  through `0x00523e20`. The destructor side is tighter too: `0x0050db10` restores the TrackLay
  vtable, re-enters that same cleanup tail, runs the route-owner post-change sweep
  `0x004a3db0`, clears singleton `0x006d1a8c`, conditionally replays the shared world-side
  preview-mode clear owner
  `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`, and only then
  tails into the common shell destroy path `0x0053f7d0`. Two smaller
  TrackLay-side helpers are tighter now too: `0x0050dc00` refreshes the version-gated action rows
  `0x986a..0x986c` plus `0x9872` before re-entering the main control refresh, and `0x0050dc80`
  owns the active route-latch branch that either forwards into `0x004a00b0` or clears route latch
  `[0x006cfca8+0x118]` plus local byte `[tool+0x82]`. The broader shared route or hit-test owner
  under both message and recurring service is now tighter too: `0x0050dce0` first drops any cached
  tool route id, then either seeds or updates the current route-owner selection from a world-surface
  hit test through `0x00448ac0`, `0x00493600`, `0x0049ace0`, and `0x0049b180`, or refreshes the
  active route-owner path through `0x004955b0`, `0x00493cf0`, and `0x004a04c0`, with the cleanup
  side posting the fixed shell payload and optionally deleting route ids `[+0x125]` and `[+0x129]`.
  The smallest active-route companion is tighter now too: `0x0050dab0` only runs when latch
  `[0x006cfca8+0x118]` and route id `[+0x125]` are both live, then resolves that entry, re-enters
  `0x0049afe0`, `0x0048b660`, and `0x0049b070`, and returns.
  dispatching the selected delete branch through `0x004937f0`, `0x004941a0`, `0x0048abf0`, or the
  surrounding placed-structure virtual slot `+0x58`. That makes the TrackLay `Bulldoze` mode
  tighter than before: the tool-side mode latch at `0x00622b0c == 0x40` is only the front-end
  selector, while the actual world-side bulldoze choice and failure policy sits under `0x0044b160`
  and is reused by neighboring world-surface callers beyond TrackLay itself.
  the TrackLay preference strings `Auto-Hide Trees During Track Lay` 1838 `If 'Auto-Hide Trees
  During Track Lay' is checked, trees will automatically be reduced to small stumps whenever you are
  in track laying mode.` 1839 `Auto-Show Grade During Track Lay` 3904 and `If 'Auto-Show Grade
  During Track Lay' is checked, you'll see the grade number over the track while laying track -
  useful for trying to keep your slopes to a minimum.` 3905, the electrify-all confirmation and
  failure strings 3083 3084 3837 and 3900, the binding-registry lookup path at `0x0045f370`, the
  registration block at `0x00460769` through `0x004608e7`, and the localized labels in
  `Data/Language/RT3.lng` ids `3466` through `3473`.
### Current Boundary

Current evidence grounds the shell-controller-backed input and frame path as the
  only coordinator after world entry; no separate outer gameplay loop or gameplay-only input
  object is grounded yet. The new setup-pipeline evidence also points the same way: the
  currently grounded chunked burst path at `0x00437b20` now looks subordinate to
  `world_run_post_load_generation_pipeline` rather than to the ordinary speed controls, and even
  there it still reuses the same lower stepper and pumps shell work between chunks instead of
  revealing a detached gameplay loop owner. The player-facing speed-control family is now cleaner
  too: `world_set_game_speed_mode` owns the bounded `Paused` through `Very Fast` ladder plus the
  hidden `Ultra Fast 6..9` extension, `world_toggle_pause_or_restore_game_speed` uses `[this+0x1d]`
  as the resume slot, and the multiplayer host restriction now looks attached to that same setter
  family rather than to the setup-side burst helper. The frame-owned shell coupling is tighter now
  too: inside `simulation_frame_accumulate_and_step_world` itself, one direct branch opens or
  focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page`, and the post-step
  shell-window ladder also probes several sibling shell windows by the same presence-plus-dirty
  pattern, including the live `LoadScreen` singleton, the shared callback-driven custom modal, the
  shared file-options dialog, `SettingsWindow.win`, the now-grounded `Overview.win` and
  `BuildingDetail.win` singletons, the adjacent tool-window strip now grounded as
  `Bulldoze.win`, `ChangeHeight.win`, `ChangeTrees.win`, `PaintRegion.win`, `PaintSound.win`,
  `PaintTerrain.win`, `PaintTerritory.win`, and `StockBuy.win`, and now the shell-side
  `Trainbuy.win` singleton too. The `SettingsWindow.win` side is tighter now too:
  `shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report` `0x004fec60`
  rebuilds the hotkeys list control `0x757a` from the same sorted binding-report iterator
  `0x0045f250`, using the temporary `0x88`-stride list model at `0x006d1354` before restoring the
  previous selection. The message owner above it is bounded now too:
  `shell_settings_window_handle_message` `0x004fede0` is the actual dispatcher for the singleton,
  and its currently grounded hotkeys cases are the reset-to-defaults path
  `0x00500147 -> 0x00461120(0) -> 0x0045f550 -> 0x004fec60` and the selected-row reassignment path
  `0x00500186..0x0050022b`, which resolves one chosen hotkey row from control `0x757a`, validates
  the destination bucket through `0x0045ed90`, skips Enter and Escape, expands the compact modifier
  code through `0x0045ed70`, commits the rebucket through `0x0045ef00`, and then rewrites the same
  report file plus rebuilds the list. The page-refresh side is bounded now too:
  `shell_settings_window_refresh_selected_page_controls` `0x00500410` republishes the category
  strip `0x7533..0x7540`, uses the local in-refresh guard byte `0x006d135d`, and then dispatches
  the current page through the `0x005005e0` table; page `7` is now directly grounded as the
  hotkeys page because it dispatches into `0x004fec60`. The category table at `0x00622870` now
  grounds the whole page order as `Gameplay`, `Sound`, `Graphics`, `Model Detail`, `Draw Distance`,
  `Textures`, `Miscellaneous`, `Hot Keys`, `Scrolling`, `Camera Controls`, `Dialogs`,
  `Miscellaneous`, and `Sandbox Options`, with only the second dword in each table row still
  unresolved as a small subgroup or style flag. Several page bodies are now grounded too:
  `0x004fda20` is the `Gameplay` refresh owner, `0x004fdb90` the `Sound` refresh owner,
  `0x004fe770` the top-level `Graphics` refresh owner, `0x004fe960` the `Model Detail` refresh
  owner, `0x004feb20` the `Draw Distance` refresh owner, `0x004febd0` the `Textures` refresh
  owner, `0x004fdd70` the first `Miscellaneous` refresh owner, `0x004fdf20` the `Scrolling`
  refresh owner, `0x004fdfd0` the `Camera Controls` refresh owner, `0x004fd940` the `Dialogs`
  refresh owner, `0x004fd730` the later `Miscellaneous` refresh owner, and `0x004fd8d0` the
  `Sandbox Options` refresh owner. The neighboring companion helpers are tighter now too:
  `0x004fd550` refreshes the `Draw Distance` companion strip under controls
  `0x7566/0x7596/0x7560/0x7562/0x7564`, `0x004fd650` does the same for the `Textures` companion
  strip under `0x756e/0x756a/0x756c/0x7570`, `0x004fe4c0` rebuilds the graphics custom-resolution
  list on `0x7553` from the live display-mode table filtered to `640x480 .. 1600x1200` and
  formatted through `%1x%2`, and `0x004fe6f0/0x004fe730` are the small primary-selector mirror
  helpers for `Draw Distance` `0x755f` and `Textures` `0x7569`. The `Camera Controls` page is
  stronger now too: `0x7587` is the day-night cycling selector rooted at `Normal day/night
  cycling` through `Frozen at 11pm`, while `0x7588` is the weather-cycling selector rooted at
  `Normal weather cycling` through `Frozen at storms`. The callback strip under the dispatcher is
  tighter now as well: `0x004fefb0` is the sound-backend selection-change owner for
  `0x7551/0x7550`, `0x004ff070` is the custom-resolution selection owner, `0x004ff0d0` the
  top-level graphics selector-change owner, `0x004ff1b0` the main draw-distance selector-change
  owner, `0x004ff2e0` the textures selector-change owner, and `0x004ffbc0` the graphics
  custom-resolution or range-refresh branch that persists `engine.cfg`, rebuilds the custom list,
  and republishes `0x7555/0x7578`. The small wrapper `0x00500620` is the nonreentrant `if live,
  refresh page` gate above that body. The tiny helper strip beneath those branches is at least
  bounded now too: `0x00531640/0x005316d0` query the selected Miles 3D provider index and
  preferred-flag from the shell audio service, `0x0053ef60/0x0053ef70` read the graphics-backend status
  slots used by controls `0x757c/0x759a`, and `0x0051fd40/0x0051fd60` are the small graphics-range
  custom-mode flag and scalar queries behind `0x7555/0x7578`. The next apply-strip under the same
  family is tighter now too: `0x004fe270` applies a changed custom-resolution tuple and persists
  it, `0x004fe2d0` applies the top-level graphics selector then republishes `0x757c/0x759a`,
  `0x004fe3b0` applies the draw-distance selector then refreshes `0x004fd550`, `0x004fe400`
  applies the textures selector then refreshes `0x004fd650`, `0x004fe140` is the small composite
  backend-status predicate used by the timer-gated graphics service branch, and `0x004fe160` is
  the sound-backend follow-on refresh path. The graphics service tail is tighter now too:
  `0x004ffafb` is the timer-gated backend-service-plus-graphics-page repaint branch using
  `0x0051d890` against deadline `0x006d136c`, the follow-on calls `0x0053f170/0x0053f2c0`, and a
  shortened `60` ms rearm after it repaints `0x004fe770`, while `0x004ffb64` is the sibling
  backend-service branch that uses `0x0053f0f0/0x0053f210` and only raises the shell refresh latch
  without repainting the page directly. The same `MouseCursor.cpp` owner family is tighter now too:
  `0x0053f000` is the live cursor-shape selector that lazily loads native handles, updates the
  shell-side presentation payload, and toggles cursor visibility on the `0 <-> nonzero` boundary;
  `0x0053f0f0`, `0x0053f170`, and `0x0053f210` are the three local hidden or release-transition
  branches that mirror shell latches `[0x006d4024+0x11473a/+0x11473e]`; `0x0053f2f0/0x0053f310`
  are the nested hold-counter helpers; `0x0053f330` is the constructor-side reset and latch-sync
  owner; `0x0053f400` is the coarse global-latch service; and `0x0053f450` is the inside-view
  watcher paired with `shell_input_cursor_inside_active_view` `0x0054f540`. The same pair is now
  grounded on the heavier save/load paths too: `world_entry_transition_and_runtime_bringup`
  `0x00443a50` pushes the hold at `0x443b04` before the larger startup-dispatch and staged
  rehydrate work, then pops it at `0x444c03` after the late world or shell rebuild tail; the live
  `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240` does the same thing through
  `0x446271` and `0x446d09` around its bundle-write and fixed status-publish span. The exact
  save/load-side status stack under those spans is tighter now too: `0x004422d0/0x00442330` push
  and pop the low bytes of shell lanes `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte
  `[0x006cec78+0x4c74]` through `0x0062be90`, with the restore side sign-extending the first three
  shell bytes and zero-extending the fourth before rewriting the wider dwords; `0x004423a0/0x004423d0`
  layer the same band under active TrackLay.win and StationPlace.win service. The per-frame tail is
  tighter now too: `0x0054f5b0` queues one 12-dword shell-input event record into the rotating
  ring at `[input+0x128]`; `0x0054f6a0` and `0x0054f6b0` are the two neighboring fixed-value
  seeders for shared phase scalar `0x00d93850` used by shell-side branches `0x00538b72`,
  `0x0052819d`, and `0x0052b9f8`; and `0x0054f6c0`, `0x0054f6d0`, and `0x0054f6e0` are the tiny
  primary-motion scalar reset, snapshot, and restore leaves that `0x0053f4e0` uses around the
  later cursor-presentation pass. The graphics-range
  callback strip beneath that is bounded now too: `0x004ffd10` is the user-facing custom-mode
  toggle rooted at control `0x7555`, using
  `0x0051fd00`, `0x0051fd40`, `0x00520fd0`, and the localized dialog ids `0x0e16/0x0e17/0x0e93`;
  `0x004ffe72` flips the graphics-range scalar through `0x00521030`; and the adjacent
  display-runtime toggles `0x004ffea4`, `0x004ffeff`, `0x004fff2d`, `0x004fff59`, `0x004fff85`,
  `0x004fffde`, and `0x0050000a` now bound a compact persisted graphics or model-detail option
  strip over controller fields `[0x006d4024+0x1146eb]`, `[+0x114697]`, `[+0x1146e9]`, `[+0x1146b8]`,
  `[+0x1146af]`, `[+0x1146a8]`, and `[+0x1146e3]` rather than one anonymous tail blob. The lower
  setter layer is tighter too: `0x0051fd00` is the current `has live custom payload` predicate for
  the graphics-range family, `0x00520fd0` stores the custom-mode flag and re-applies the current
  range when possible, `0x00521030` stores the scalar and re-applies it when the graphics mode is
  live, and `0x0051d890` is the shared elapsed-tick helper over the bootstrap-seeded tick count.
  The same local support strip is broader now too: `0x0051e1d0` is the mode-`0` alternate sibling
  of the packed preview-color ramp at `0x0051dfc0`; `0x0051e430/0x0051e480` are the shared
  path-openability and file-size probes; `0x0051e4e0/0x0051e560` are the bounded ASCII clipboard
  export and import helpers; `0x0051e6e0` is the nonempty digits-only predicate used by nearby
  text-entry validation branches; `0x0051e720/0x0051e740` own the active debug-log filename
  (`rt3_debug.txt` / `language_debug.txt`) and the one-time `.\\data\\log\\%s` separator write;
  and `0x0051e810` is now grounded as the `MouseCursor.cpp` `ShowCursor` refcount and live-position
  sync helper that the warning-modal strip also reuses. The immediate shell-controller strip under
  that is tighter now too: `0x0051ea80` is the small core-state reset plus default seeding path
  rerun by `0x0051ff90`; `0x0051f000` registers the static `World` window class through wndproc
  `0x0054e3a0`; `0x0051f070/0x0051f080` and `0x0051f090/0x0051f0a0` are the paired controller
  accessors and setters for the live presentation owner and world-basis owner; `0x0051f0c0`,
  `0x0051f0d0`, and `0x0051f0e0` are the small indexed input-subobject flag write or query helpers
  beneath the shell window-message path; `0x0051f100` materializes the active display-mode tuple
  from `[controller+0x34]` and selector `[+0x11421e]`; `0x0051f1a0` is the current
  graphics-mode-byte accessor over `[controller+0x114226]`. The wndproc itself is tighter now too:
  beyond the already-grounded key, command, and mouse ingress, one broader branch prepares
  subordinate layout-state `[controller+0x2d]` through `0x00547300`, `0x0054bbf0`, and
  `0x00545c00(0x96, [controller+0x75], 0)`, dispatches the local slot-band service owner
  `0x0054c900`, re-enters `0x00545020`, and when mode byte `[controller+0x3692]` is clear refreshes
  the current external record through `0x005545d0`, `0x005543f0(0)`, and `0x00554450`. So the same
  world-window dispatcher now has one grounded live layout-state service branch, not just shell
  input ingress. The nearby shared shell-presenter
  helper `0x00527de0` is now bounded as the common scalar-caption publisher reused by several tool
  windows. It scales one caller float through `0x005dd158`, forwards that value into nested
  presenter field `[this+0x364d]` through `0x0052ea90`, scales a second caller float through
  `0x005c8568`, and stores that auxiliary caption-side weight in `[this+0x3728]`. Grounded callers
  now include `Bulldoze.win`, `ChangeTrees.win`, the world-surface brush ordinal setter,
  `PaintRegion.win`, `PaintSound.win`, `PaintTerrain.win`, and `PaintTerritory.win`, so this is the
  shared shell scalar-caption lane rather than a window-specific text formatter. The neighboring page-owned dispatcher
  leaves are tighter now too: `0x004ff58a`, `0x004ff5b6`,
  and `0x004ff5e6` are direct persisted toggles for the later `Miscellaneous` input page fields
  `[0x006d4024+0x1146d7]`, `[0x006cec74+0x28b]`, and `[0x006cec74+0x283]`, with the last one also
  republishing a `Game.win` affordance through `0x004dd8d0`; `0x004ff637`, `0x004ff667`,
  `0x004ff697`, `0x004ff6c7`, `0x004ff6f7`, and `0x004ff727` are the page-owned toggle leaves for
  the `Dialogs` page fields `[0x006cec74+0xf8]` and `[+0x26b/+0x26f/+0x273/+0x277/+0x27b]`; and
  `0x004ff757`, `0x004ff796`, `0x004ff7c6`, and `0x004ff84e` are the remaining compact `Gameplay`
  page toggle leaves over `[0x006d4024+0x114742]`, `[0x006cec74+0x0a8]`, `[+0x263]`, and
  `[+0x309]`, with the `+0x114742` path also nudging `BuildingDetail.win` and the `+0x263/+0x309`
  paths triggering narrow live-tool follow-ons. The next tiny leaves are bounded now too:
  `0x00500036` is the direct apply leaf for the graphics-misc option family mirrored through
  `0x00484af0(0x0c)` into control `0x7586`; `0x0050006c/0x0050009c/0x005000cc` are the shared
  setup-config toggles over `[0x006cec74+0x247/+0x24b/+0x243]` that persist the same three booleans
  later mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`; and `0x005000fc` is the direct
  scrolling-page boolean-companion setter for `[0x006cec74+0x120]` and control `0x7585`.
  neighboring stock-buy lane is tighter now too: `0x00433aa0` is the shared `StockBuy.win`
  availability gate, rejecting when scenario toggle `[0x006cec78+0x4aa7]` is set or when no
  selected-company id is present at `[scenario+0x21]`. The direct shell opener `0x00440660` and
  the page-side launcher `0x004de50f` both use that gate before entering detail-panel mode `0x0c`,
  whose same-mode refresh tail re-enters `0x00493150`. The shell-side control strip under that
  window is tighter now too: `0x0050a660` is the raw selected-chairman-row setter for global
  `0x006d19f4`, `0x0050a570` is the selected-company stock-data panel callback wired to control
  `0x3aa0` and feeding the shared stock formatter `0x004c0160`, `0x0050a6d0` publishes the current
  selected company id into `0x00622b00` and restyles control `0x3a9b`, `0x0050a670` is the shared
  live-window refresh wrapper hit by the buy/sell chairman mutators after they touch
  `[profile+0x154]` and the per-company holding band, `0x0050a5e0` is the constructor-wired
  invalidation callback for control `0x3a9a`, and `0x0050a6a0` is the unconditional invalidation
  sibling used by the local in-window trade branches after they commit the rounded block. One level
  higher, `0x0050a730` is now bounded as the broad row/card refresh owner: it walks the active
  chairman profiles through `0x00477820/0x00477860`, lays out the selected and unselected profile
  cards through the cached widget roots `0x006d19d8/0x006d19dc/0x006d19e8/0x006d19ec`, resolves
  persona/name labels through `0x00476bb0`, and pulls the same currently grounded metric lanes
  from `0x00476320`, `0x00476780`, and `0x00476c20`. The selected-company panel under control
  `0x3a9a` is separate and broader: `0x0050ae50` is now bounded as the main selected-company
  summary renderer, resolving the current company through `0x00518140`, the current chairman row
  through `0x00477860`, choosing one of panel roots `0x006d19e8/0x006d19ec`, and then formatting a
  mixed text-plus-metric surface through helpers such as `0x00423eb0`, `0x00426b10`, and
  `0x00426ef0`. The adjacent publish side is bounded too: `0x0050b910` formats the selected company
  ownership line through localized ids
  `0x0e10/0x0e11/0x0e12` plus the resolved company and owner labels, and `0x0050ba00` is the
  shared selected-company summary refresh tail over controls `0x3a9a/0x3a9b`; `0x0050c130` is the
  narrow mode-`0x0b` refresh wrapper that re-enters that tail only when the current detail-panel
  object is actually `StockBuy.win`; and `0x0050c470` is the selected-company clamp/setter sibling
  that republishes `0x00622b00` before re-entering the same summary tail. The payload-driven trade
  commits are explicit now too: `0x0050c150` resolves one chairman record from payload
  `[profile_id, company_id]`, derives the rounded buy block through `0x00476e50`, and commits it
  through `0x00477110`; `0x0050c1f0` is the same sibling for the rounded sell block and
  `0x00476460`. Both also emit the local selected-chairman shell cue before the shared
  `StockBuy.win` refresh tail when the payload chairman matches the currently selected chairman in
  `0x006cec78`. The message-owner and teardown side are bounded now too: `0x0050bbe0` is the real
  `StockBuy.win` dispatcher, with `0xcb` control bands for chairman-row selection
  `0x3afc..0x3b5f`, company-row selection `0x3d54..0x3db7`, company wrap/step controls
  `0x3aa1..0x3aa3`, and toggle-byte writes `0x3aad..0x3ab2`, while `0xca` owns the local buy row
  band `0x3c8c..0x3cef` and sell row band `0x3cf0..0x3d53`. The buy-side confirmation path now has
  one extra leaf too: `0x0050a600` is the callback-driven tutorial gate for the localized
  `0x0292` confirmation modal, opening the sibling tutorial modal `0x0e8c` only on `0xcb` control
  `0x03f4` while tutorial flag `0x006d3b4c` is live. The destructor counterpart `0x0050bac0`
  releases the cached roots `0x006d19d8..0x006d19ec`, frees the per-company cached stock-data
  handles in `0x006d1748`, invalidates controls `0x3b60` and `0x3e4e`, clears singleton
  `0x006d19f0`, and then tails into the common shell-object teardown. The
  remaining adjacent detail-panel gates are now bounded tightly enough to carry by family:
  `0x00434db0` is the scenario-toggle-gated company-detail mode-`0x0b` availability gate, while
  `0x00434e20` is the selected-company-or-editor detail mode-`0x06` availability gate that only
  hard-blocks when all three scenario toggles `[+0x4ab3/+0x4ab7/+0x4abf]` are set.
  The
  train-buy family is no longer just an unnamed probe pair either: the opener path is now grounded
  under the same shell-owned cadence through `shell_can_open_trainbuy_window_or_warn` and
  `shell_open_or_focus_trainbuy_window`, and its current family semantics already extend beyond a
  bare locomotive picker into selected-train upgrade summary and route-edit affordances. The direct
  shell opener `0x004406c0` now aligns with the page-side launcher `0x004de7d9`: both use
  `shell_can_open_trainbuy_window_or_warn` `0x00433b00` before calling
  `shell_open_or_focus_trainbuy_window` `0x00512c50`. The
  selected-train side is tighter now too: we have explicit query helpers for the selected train
  record, id, validity, and company ownership, plus one explicit ownership-mismatch warning modal.
  That same pass also clarified one boundary we should not conflate: the neighboring shell family
  rooted at `0x006d3b20` is now grounded separately as `TrainDetail.win`. It reuses the same
  selected-train context and some of the same helpers, but it is not the same `Trainbuy.win`
  singleton family. The `TrainDetail.win` side now has its own constructor, opener, refresh path,
  and message owner above the broader train-command strip. Its inner `0xcb` strip is tighter now
  too: one bounded branch is the selected-train engine-replacement or trainbuy handoff lane using
  warning ids `593/594`, and another is the selected-train retirement lane using `595/596/597`
  with either a local teardown path or multiplayer opcode `0x37`. The remaining train-command
  family is narrower too: the shared `0x33`-stride helper trio at `0x004b2f00`, `0x004b3000`, and
  `0x004b3160` now looks like a real train route-stop or waypoint list rather than a generic row
  buffer, and route-entry flag byte `+0x28` now has one grounded top-level split: sign bit clear
  entries are the live placed-structure-backed family, while sign bit set entries use the direct
  route-node payload side. The helper `train_route_list_count_live_site_reference_entries`
  `0x004b2b80` now counts the first family explicitly. One deeper lower-bit result is grounded too:
  both `train_route_list_insert_staged_entry_at_index` and the auxiliary finalize helper
  `train_finalize_aux_route_entry_buffer_preserving_subflags` `0x004a94b0` explicitly preserve
  bits `0x40`, `0x20`, and `0x10` in the same flag byte during route-entry rewrites. Those bits are
  also no longer copy-only: the neighboring shell helper
  `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20` now consumes them to
  restyle the `BuildingDetail.win` row bands `0x7d07..0x7d1c` and `0x7f58..0x801f`. The important
  boundary is tighter now too: the `0x7d07..0x7d1c` band is a style-only indicator family in current
  disassembly, not a hidden text-publishing row family with missing captions. The grounded
  player-facing text sits elsewhere: the fixed express-side triplet `0x7f58..0x7f5a` is table-fed
  from RT3.lng `494/497/498`, and the sibling special service rows still align to `Dining Car` and
  `Caboose`. So the subflags now have one real shell-side consumer instead of only preservation
  logic, and the old “missing label” seam on the indicator rows is gone. The broader
  `BuildingDetail.win` refresh family is
  tighter too: `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0` now
  clearly owns the selected subject rows around `0x7d06`, `0x7d96..`, and `0x7d0e`, resolving
  ordinary ids through the live candidate collection and the special express-side ids through the
  embedded `AnyCargo.imb`, `AnyFreight.imb`, and `PassMail.imb` paths. The first fixed triplet is
  now table-grounded instead of only inferred: `0x00621df8` seeds the short-label controls
  `0x7dc8..0x7dca` with RT3.lng `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while
  `0x00621e10` seeds the adjacent `0x7e90..0x7e92` icon-name triplet with `AnyCargo`,
  `AnyFreight`, and `PassMail` before `%1.imb` formatting. RT3.lng also tightens the longer popup
  side now: `0x00621e04` feeds the first clickable selector triplet `0x7f58..0x7f5a` with
  `494/497/498`, so the help text there is `Any Cargo`, `Any Freight\n(Freight is everything but
  Passengers, Mail, and Troops)`, and `Any Express\n(Express is Passengers, Mail, and Troops)`.
  The sibling special service rows still align to `Dining Car` and `Caboose`. The extracted
  `BuildingDetail.win` blob now sharpens the resource boundary too: its embedded text table is
  currently sparse rather than rich, exposing the help line for `0x7d01`, repeated
  `BuildingDetail.imb` asset strings, and one standalone caption entry `Cargo`. That makes
  `Cargo` the strongest current resource-side anchor for the row header around `0x7d06`. The
  ordinary deeper rows are tighter now too: they do not look like hidden caption-table entries,
  but like live candidate-derived rows. The current path validates each ordinary id through
  `indexed_collection_entry_id_is_live` `0x00517d40`, resolves the concrete candidate record
  through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then reuses candidate
  field `[record+0x04]` as one shared stem for both the row asset `%s.imb` path and the
  neighboring display-label lookup through
  `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. That lookup is now
  bounded too: it scans the static stem table at `0x006243c8`, already grounding entries such as
  `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng
  `3202..3220`, and only falls back to localized id `3866` when no table entry matches before the
  fixed `0x384..0x386` express-side triplet takes over. One neighboring candidate-side helper is
  tighter now too: `structure_candidate_query_route_style_or_local_availability_metric`
  `0x0041e650` shares the same route-style byte at `[candidate+0x46]`, returning the cached local
  float at `[candidate+0x5a]` for ordinary candidates but switching route-style rows to one
  normalized count over the world-side route-link collection `0x006ada90` keyed by candidate class
  `[candidate+0x3e]`. That collection is tighter now too: it is constructed during world bring-up
  by `placed_structure_route_link_collection_construct` `0x00468110`, and current grounded
  creation flow through `placed_structure_route_link_allocate_site_pair_for_candidate_class`
  `0x00467f50` seeds class byte `+0x10`, a masked initial state template, and the strongest
  current creation-side site-pair fields at `+0x0c` and `+0x0e` before
  `placed_structure_route_link_attach_site_owner` `0x00467eb0` links the new route-link record
  into the placed-structure-owned chain at `[site+0x272]`. The owner-side split is tighter now
  too: route-link field `+0x08` is the separate route-node-style owner anchor used by
  `placed_structure_route_link_attach_route_node_owner` `0x00467f20`, while `+0x0a/+0x0c/+0x0e`
  now read as the site-reference triple matched by
  `placed_structure_route_link_collection_remove_links_touching_site_id` `0x004681f0`. Creation
  flow now sharpens that further: `+0x0c` is the strongest current candidate for the stable
  first-site field seeded before owner attachment, `+0x0a` is the mutable owner-site anchor
  installed by the attach helper, and `+0x0e` is the stable second-site field. One more split is
  tighter now too: `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`
  currently uses `+0x0a` and `+0x0e` as the active endpoint site pair while recomputing state
  byte `+0x12`. The load/save boundary is tighter now too: package save currently persists only the
  direct indexed-collection header band of `0x006ada90` through `0x00517d90`, world-entry bring-up
  mirrors only that header refresh through `0x00518680`, and the live endpoint or grid state is
  then regenerated later through `placed_structure_route_link_collection_recompute_all_endpoint_pair_state`
  `0x004682c0` and `placed_structure_route_link_collection_rebuild_route_style_grid_counters_and_endpoint_state`
  `0x00468300` rather than through a separate tagged per-record payload lane.
  byte `+0x12`; `+0x0c` is still not directly read there. The family also has a clearer release
  and refresh side now: `placed_structure_route_link_release_and_detach` `0x004680b0` rolls back
  the class counters and then tails into `placed_structure_route_link_detach_current_owner_chain`
  `0x00467df0`, while
  `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0`
  explicitly reruns the per-record endpoint-pair reconciler across the whole live route-link
  collection. One layer above that,
  `placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state`
  `0x00468300` now looks like the full-family refresh owner: it clears three route-style class
  lanes in the world-grid tables rooted at `[0x0062c120+0x2129]`, then clears bit `0x2` across
  the live route-link records and reruns the endpoint-pair reconciler. That now lines up with the
  visible shell split: non-route candidates keep the richer local metric and price lane, while
  route-style candidates use one world-side route-link family instead. The emission side is
  tighter now too: `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class`
  `0x0040fef0` scans the live placed-structure collection for one best peer site by
  class-specific weight, distance window, and type gate, then only creates a new route-link
  through `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` when
  `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0` says the chosen site
  pair does not already share a route-entry key. One layer above that,
  `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` now reads
  as the broader per-site owner of this lane: it computes per-class route-style score scalars from
  local site state and scenario multipliers, drives the first three route-style emission attempts,
  and then continues into a larger descriptor-driven scoring phase. Inside that larger pass,
  `placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link` `0x0042cab0`
  now cleanly shows the split between ordinary candidates, which add directly into the local
  route-style grid lane at `[site+candidate*4+0x103]`, and remapped route-style candidates, which
  re-enter the peer-link emitter. One layer above that, the broader post-create or post-edit site
  rebuild `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`
  conditionally re-enters `0x004101e0` with stack flag `1` when its local latch at `[site+0x29e]`
  stays clear, so the route-style lane is no longer floating under an unnamed single-site caller.
  The placement side is tighter now too: the direct constructor
  `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` is the shared allocator
  immediately beneath the current placement-side callers before they hand the new site into
  `0x0040ef10`, and the lower constructor
  `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now bounds the
  actual field-seeding layer beneath that allocator. The old unresolved higher placement chooser is
  bounded more cleanly now too: the `0x00403ed5` and `0x0040446b` direct-placement commits sit
  inside one larger helper,
  `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`. That shared
  heavy builder is now the common target of the compact wrapper `0x00404640`, the peer-route
  candidate builder `0x004046a0`, the region-entry pair wrapper
  `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry
  paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news`
  `0x00404ce0`. Internally it now has three bounded lanes:
  an early route-entry search or synthesis attempt through
  `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`,
  a single-endpoint direct-placement lane that scans `Maintenance` and `ServiceTower` candidates
  and commits through `0x00403ed5 -> 0x004134d0 -> 0x0040ef10`,
  and a later paired-endpoint fallback lane that seeds two endpoint candidates from the same stem
  family, walks a temporary route-entry list, and commits through
  `0x0040446b -> 0x004134d0 -> 0x0040ef10`.
  That early lane can now be described more concretely: it can reuse supplied route-entry
  endpoints, synthesize a missing leading endpoint from the caller's coordinates, seed the
  route-store builder-state block, and then hand off to the deeper path-search core without
  placing a new site. The previously vague side family at `0x006cfcb4` is tighter too: current
  evidence now bounds it as a small auxiliary route-entry tracker collection with an allocator at
  `0x004a42b0`, a refcount or destroy path at `0x004a4340`, a direct route-entry group-id setter
  at `0x00489f80`, an endpoint-membership probe at `0x00494ed0`, a boolean-latch refresh or
  owner-notify path at `0x00494fb0`, and a two-endpoint merge or bind helper at `0x00494f00`.
  One smaller constructor-side ownership split is tighter now too: the cached `u16` chain fields
  `[site+0x26e]`, `[site+0x270]`, and `[site+0x383]` are no longer free-floating. Constructor-side
  helper `0x0041f7e0` prepends one new peer into that chain by storing the old head from
  `[this+0x383]` into `[peer+0x270]` and then replacing `[this+0x383]` with the peer's own
  placed-structure id `[peer+0x2a4]`; the direct resolver `0x0041f810` turns the cached head id
  back into one live record through `0x0062b26c`; and the removal-side companion `0x0041f850`
  removes one peer from the same chain before clearing `[peer+0x26e/+0x270]`. That caller split is
  now strong enough to treat this as one cached single-link or predecessor-chain family beneath
  placed-structure construction and rebuild rather than as unrelated scratch words.
  That bind side is tighter now too: the trackers group route entries only when a route-key-like
  value from `0x0048aa70`, the route-entry signature word `+0x22e`, and the boolean latch derived
  from byte `+0x44` all agree. The deeper handoff under that lane is no longer anonymous either:
  `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380` is now
  bounded as the internal search core that runs the first candidate sweep, quality gates, and the
  later route-extension fallbacks before returning one resolved route-entry id or `-1`. The first
  sweep now has a bounded owner at `0x0049bd40`, and the two later fallback helpers are bounded as
  the route-entry point-window coverage query `0x00494cb0` and the frontier-extension helper
  `0x0049c900`. The math side is bounded more cleanly now too: the family reuses
  `math_measure_float_xy_pair_distance` `0x0051db80` for its direct point-to-point scalar,
  `math_compute_quadrant_adjusted_heading_angle_from_xy_pair` `0x004952f0` for heading-angle
  construction, `math_normalize_subtracted_angle_delta_and_report_wrap` `0x004953c0` for wrapped
  angle deltas, and now one tighter visual-side strip too: `0x00539230` applies one local
  float-preset layout from state byte `[entry+0x218]`, `0x00539380` loads the matching
  table-driven profile bands and optional display latch `[entry+0x44]`, `0x005394b0` exports four
  consecutive `3*dword` triplet bands from the entry into caller buffers, and `0x005391b0`
  releases one optional world-space attachment before the entry's vtable slot `+0x00` teardown
  fires. The adjacent publish side is bounded too: `0x00539580` broadcasts one caller-supplied
  three-scalar packet across the optional attached-handle list at `[entry+0x08]`, and
  `0x005395d0` ensures that same list, adds one new handle, and immediately republishes one
  aggregate scalar derived from local bands `[+0x18/+0x24/+0x30/+0x3c]` together with head lanes
  `[+0x0c/+0x10]`. The next owner layer is tighter now too: `0x00539640` is the heavy derived-band
  rebuild that turns those four triplets plus profile weights `[entry+0x1f5/+0x1f9/+0x1fd]` into
  the larger scalar bands rooted at `[entry+0x63]` through `[entry+0x1d3]`, refreshes center
  scalars `[entry+0x0c/+0x10]`, re-enters root query `0x00534490` several times, and conditionally
  maintains the optional `0xc0`-byte display buffer at `[entry+0x1e3]` according to display-state
  byte `[entry+0x44]`. The surrounding wrappers are coherent with that same ownership split:
  `0x0053a740` copies caller triplets into `[entry+0x14/+0x20/+0x2c/+0x38]`, refreshes optional
  attachment id `[entry+0x55]` through `0x00533e00/0x00533dd0`, and republishes center lanes
  `[entry+0x1ed/+0x1f1]`; `0x0053a890` reprojects the stored triplets through `0x00534490` and
  rebuilds; `0x0053a920` fills all four triplets from one uniform scalar before rebuilding;
  `0x0053ac40` rebinds the root pointer, clears attachment state, and optionally rebuilds from the
  current triplets; `0x0053aca0` is the concrete default constructor for the same route-entry
  object family; and `0x0053ae10` is the construction-time root-bind plus state-profile-and-triplet
  initializer. The attachment manager beneath that strip is tighter too: `0x0053a5b0` is the tiny
  broadcast wrapper over current head lanes, `0x0053a5d0` is the heavier ensure-and-clone path
  that seeds one new attached handle from the first live entry when a list already exists, and
  `0x0053a6d0` tears that attached-handle list back down. The collection side is tighter too:
  `0x00491af0` constructs the indexed
  `0x006cfca8` owner beneath the world bundle-load path, and the later post-load `319` lane now
  uses `0x00491c20` as a dedicated collection-wide refresh pass that re-enters `0x00539640` on
  every live route entry. That keeps the route-entry visual or presentation side grounded as a real
  sibling strip to the search and regrouping code, not loose per-caller scratch fields.
  angle-delta checks, and `math_abs_double_with_crt_special_case_handling` `0x005a152e` for the
  absolute-value side of the quality gates. Current evidence also bounds the threshold shape a
  little more tightly: the initial sweep and later extension path both reuse one signed angle-bias
  term `+/-0.181000038854627`, and the first sweep switches between a looser `1.4` and stricter
  `1.8` quality multiplier depending on route-policy byte `4` or the broader display-runtime
  preference `[0x006cec78+0x4c74]`, already grounded elsewhere as `Auto-Show Grade During Track
  Lay`.
  The small policy-byte semantics are still not fully closed, but current evidence is tighter than
  before. Literal byte `1` is now the strongest current match for direct linked-site
  endpoint-anchor creation or replacement, because the linked-site constructor and neighboring
  repair branches around `0x00480463`, `0x00480a77`, and `0x00480b69` all feed that byte into
  `0x00493cf0` before rebinding one chosen route-entry anchor through `0x0048abc0`. Literal byte
  `2` now looks broader: the later world-side caller at `0x00480cd0` and the linked-site refresh
  helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` both
  reach `0x004a01a0` with both optional endpoint-entry ids unset and that byte, so the strongest
  current read is a full linked-site route-anchor rebuild between optional endpoint entries rather
  than the narrower direct creation lane. The TrackLay side now gives one tighter user-facing
  anchor too: the live mode field `0x00622b0c` is already grounded as `Lay single track.` `0x1`
  versus `Lay double track.` `0x4`, and the small mapper `0x004955b0` collapses that state into
  the endpoint-policy bytes later passed to `0x00493cf0`, so the strongest current read is
  `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`.
  Bytes `1/2` are still the ones that enable the
  auxiliary tracker lane in `0x004a01a0`, while byte `4` now reads more narrowly as the larger
  company-side endpoint-synthesis charge inside `0x00493cf0`, because that helper feeds `-1`
  versus `-2` into the saturating company counter helper `0x00423ec0` on `[company+0x7680]`
  rather than skipping the company branch entirely. That counter is tighter now too: nearby
  company initialization seeds it to `50` when scenario byte `0x4aaf` is enabled and to sentinel
  `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed
  fallback `29999`. Current language-table correlation also gives `0x4aaf` a stronger
  player-facing meaning: it is the live gate behind `Company track laying is limited...` and the
  event variable label `Company Track Pieces Buildable`. So the current strongest read is
  available track-laying capacity, not an abstract company route-budget. That site-side helper
  also closes one adjacent ownership gap: beneath
  `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, it rebuilds
  one linked site's route-entry anchor and display-name buffer. That path is tighter now than just
  “bind anchor then touch `0x006cfcb4`”: after the literal-policy-`2` rebuild succeeds it
  re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`,
  which can now be described more concretely. Its early prepass at `0x004a4380` can split one
  mismatching adjacent subchain into a fresh tracker group; its later helper at `0x004a4ce0` can
  transfer one compatible adjacent chain between neighboring groups; and the repair-side helper at
  `0x004a4ff0` can reseed a whole route-entry component into a fresh tracker when the old group id
  is missing or invalid. The regrouping pass also still rewrites compatible endpoint slots through
  `0x004950f0` and refreshes one nearby cached-match payload band through `0x00495020` before the
  helper resumes the name-buffer work. The remaining display-name side still matches the earlier
  grounded text family: copy the resolved city name when available, append civic suffixes
  `Township`, `New`, `Modern`, or `Renaissance`, append `Service Tower` or `Maintenance Facility`
  on the linked-instance class branches, and otherwise fall back through the older
  `Junction`..`Center` and `Anytown` text families.
  The higher owner-refresh side of that same tracker family is tighter now too. The reusable gate
  at `0x004a4c00` no longer looks like a stray predicate: it explicitly requires both route-entry
  trackers to keep matching cached fields `+0x18/+0x1c/+0x1d/+0x1e` and both route entries to keep
  their special side fields `+0x20e/+0x222` unset before adjacent-chain transfer is allowed. The
  collection-wide traversal sweep at `0x004a5fc0` is bounded now as the connected-component refresh
  owner over tracker field `+0x0c`, with a temporary queue at `[this+0x94]` and direct fallback
  into the reseed helper `0x004a4ff0` whenever one neighboring route entry has lost valid tracker
  ownership. Above both of those sits `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links`
  `0x004a6360`, which now reads as the owner-side latch-change refresher invoked from
  `0x00494fb0`: it starts from one owner route-entry id, confirms both bound endpoint entries agree
  on the boolean class state implied by route-entry byte `+0x44`, and then probes both endpoint
  sides for adjacent route-entry groups that can be absorbed through the `0x004a4c00 -> 0x004a4ce0`
  gate-and-transfer pair. The sibling query side is bounded now too:
  `aux_route_entry_tracker_collection_query_component_label_by_tracker_id` `0x004a6320` is the
  dirty-aware accessor for tracker field `+0x0c`, while
  `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` is the remaining
  mode-switched lower metric dispatcher beneath the heavier chooser at `0x004a6630`, forwarding
  fixed route-entry-pair candidate sets into either `0x004a5280` or `0x004a5900` depending on the
  shared hundredths-scaled build-version query
  `runtime_query_hundredths_scaled_build_version` `0x00482e00` over `0x006cec74`. The current
  caller thresholds `>= 0x67`, `>= 0x68`, `>= 0x69`, and `>= 0x6a` now line up with executable
  build values `1.03`, `1.04`, `1.05`, and `1.06`, and the version source itself can come from
  the multiplayer companion path as well as the local executable, so this split is no longer
  best-read as a time- or era-side cutover at all. It now reads more cleanly as a pre-`1.03`
  versus `1.03+` route-metric compatibility dispatcher. That lower split is tighter now too:
  `0x004a5280` is the weighted recursive branch with heuristic ordering, per-tracker best-cost
  cache `0x006cfcac`, and prune threshold `0x006cfcb0`, while `0x004a5900` is the alternate
  recursive neighbor-walk branch that stays within compatible component labels through
  `0x004a62c0` and accumulates step and mismatch penalties over route-entry links
  `+0x206/+0x20a/+0x20e`. Above both of them,
  `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks`
  `0x004a6630` is now bounded as the real chooser: direct fixed-pair query when both entries pass
  `0x0048b870`, otherwise endpoint-pair fallback across the two tracker groups.
  The adjacent route-style rebuild side is tighter now too: the same build-version family reaches
  `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0`, where build
  `1.04+` keeps one `Recycling Plant` stem-specific compatibility branch alive and build `1.05+`
  skips one older descriptor-side attenuation fallback. There is also one neighboring world-side
  compatibility lane now bounded below the same family: `placed_structure_collect_connected_component_tile_bounds_with_version_gate`
  `0x004160c0` skips one older recursive component-bounds walk through `0x00415f20` on build
  `1.03+` when scenario field `[0x006cec78+0x46c38]` is already active. The wrapper above that
  path is bounded now too: `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh`
  `0x00416170` walks the caller rectangle, maps tile keys into the component table rooted at
  `0x0062ba7c`, and only re-enters `0x004160c0` when the current owner still has no cached bounds
  and the local world or scenario suppressors stay clear. The higher neighboring raster side is
  tighter too. `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610` is the
  shared projected-rectangle helper above `world_grid_refresh_flagged_region_float_extrema_and_mean`
  `0x00415020`: it refreshes the temporary sample band at `0x0062b7d0`, publishes the surviving
  rectangle through `0x0044d410`, and on the single-sample path re-enters
  `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` to flip mask bit
  `0x01` for the corresponding non-sentinel cells. Current grounded callers for `0x00418610` are
  the neighboring placed-structure local-runtime helper `0x00418be0` and the heavier placement
  validator `0x004197e0`, so this adjacent family now reads more like projected placement or local
  raster prep than an unowned generic world-grid scan. One neighboring caller into the same
  height-support band is tighter now too: the world-side branch at `0x00419070..0x004190f0`
  walks one admitted local window, dispatches the acceptance-gated relaxer `0x0044d6e0` once per
  cell with a one-cell radius and no immediate tail refresh, and only after that outer loop
  completes re-enters `0x0044d410` on the full surviving rectangle. The higher owner split is
  tighter now too.
  `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch`
  `0x00418be0` is the broader construction or rebuild lane: resolve one candidate id from a stem,
  build projected scratch through `0x00416ec0`, then publish the projected rectangle and validate
  its side windows through `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows`
  `0x00416620`. That publish pass is bounded now too: it stages `0x0062b308/0x0062b30c/0x0062b310`,
  validates the rectangle against route-entry coverage through
  `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, can branch into
  the special projected-slot picker `placed_structure_try_select_projected_rect_profile_slot`
  `0x00415570`, and refreshes the compact per-cell side tables through
  `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` before the
  finished scratch is copied into one queued runtime record and the new record re-enters
  `0x00416170` when its rectangle is valid. The smaller sibling
  strip under that projected-slot family is tighter now too. The shared probe
  `projected_rect_profile_slot_probe_template_cells_and_height_span` `0x004153f0` tests one
  fixed `8x8` template from `0x005edd30` against the current projected rectangle, rejecting on
  out-of-bounds cells, occupied cells already marked in `0x0062b300`, or the paired world-grid
  gates `0x00448af0(mode 0)` and `0x004499c0`, then sampling `0x00448aa0` and requiring enough
  local height span. The selector `0x00415570` now reads as a three-path owner over that probe:
  reuse cached slot `0x005ee030`, try the localized-id-`11` default, then scan slots `0..11`
  until one passes. Once a slot is live, `placed_structure_build_projected_rect_profile_mask_bands_from_selected_slot`
  `0x004156b0` expands the same template family into the four mask bands
  `[record+0xcf/+0xd3/+0xd7/+0xdb]`, setting per-plane presence flags at
  `[record+0x177/+0x17b/+0x17f/+0x183]` and freeing any empty plane buffer.
  The packed-cell and bounds side beneath the same family is tighter too:
  `projected_rect_packed_cell_list_try_append_unique_xy_with_optional_highbit_flag_and_expand_quarter_bounds`
  `0x00413df0` appends unique packed cells into `0x0062b318` while expanding the quarter-scale
  bounds at `0x0062b7a8..0x0062b7b4`, and the adjacent helper strip
  `0x00414270/0x004142c0/0x004142d0/0x004142e0` now reads as replaying those packed cells into
  compact-grid mode `2` plus the shared bounds extractor for the same sentinel-terminated list.
  The smaller sibling
  `0x00419200` is now bounded beneath that same projected-rectangle family too: it is the tiny
  getter over the temporary dword cell-value bank at `0x0062b300`, flattening one caller cell
  through live world width `[0x0062c120+0x2155]` and returning the corresponding dword when the
  bank exists, else `0`. Current grounded caller is the later world-side branch at `0x0048af99`.
  The smaller sibling
  `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds`
  `0x00418a60` now reads as the current-subject clone path above the same connected-component and
  mask-refresh helpers, returning the cloned local runtime record later stored into `[site+0x24e]`
  by `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem`
  `0x0040e450`. The higher wrapper above that clone path is bounded now too:
  `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`
  first drains the temporary site-id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` through
  `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and
  `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`, rebuilding one cloned
  local-runtime record per queued placed structure through `0x0040e450`, and only then sweeps all
  live placed structures through the side refresh helper
  `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10`.
  The constructor or ownership split beneath that family is tighter now too. The shared allocator
  `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` no longer just reaches
  an anonymous `0x3e1`-byte scratch object: it first constructs one concrete placed-structure
  specialization through `placed_structure_construct_concrete_specialization_vtable_5c8c50`
  `0x0040c950`, which calls `0x0045b680` to seed the common base table `0x005cb4c0`, clear the
  derived field band `[this+0x23a..+0x26a]`, and re-enter the older base initializer
  `0x00455610`, then installs the specialization table `0x005c8c50`. The paired cleanup path at
  `0x0040c970` now reads like the matching teardown thunk: it briefly reinstalls `0x005c8c50`,
  then immediately demotes the record back to the base table through `0x0045b040 ->
  0x00455650` before the stack object is freed or unwound. The corresponding serializer entry
  `0x0040c980` is equally tight now: it simply tails into `0x0045b560`, which first re-enters the
  base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1` and
  `0x5dc2` over `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`.
  One nearby string clue is useful but narrower than it first looked. The specialization table at
  `0x005c8c50` is immediately followed by `RadioStation` and `Radio Station`, but the local member
  method `0x0040ce60` now shows why: it compares site stem `[this+0x3ae]` against `Radio Station`,
  canonicalizes that stem to `RadioStation` on match, and then re-enters `0x0040cd70` plus
  `0x0045c150`. So those adjacent strings ground one stem-normalization lane inside the
  specialization, not the specialization name by themselves. The small virtual-slot and cached-id
  side is tighter now too. The same `0x005c8c50` table carries three literal-false stubs
  `0x0040cc10/0x0040cc20/0x0040cc30`, one literal-true stub `0x0040ccc0`, and the narrower
  linked-site-id presence predicate `0x0040ccb0`, which simply returns whether `[this+0x2a8]` is
  nonzero. Beneath the stem-normalization path, `0x0040cd70` is now bounded as the common cached
  source/candidate resolver: it clears `[this+0x3cc]` and `[this+0x3d0]`, scans source collection
  `0x0062b2fc` for a stem match against `[this+0x3ae]`, stores the matched source id into
  `[this+0x3cc]` plus the linked candidate/profile id from `[source+0x173]` into `[this+0x3d0]`,
  and when no match exists formats localized id `0x00ad` through `0x0051e980` with the current
  stem buffer. That warning path is tighter now too: `0x0051e980` is the guarded warning-modal
  publisher that forces cursor visibility through `MouseCursor.cpp` before showing the shared
  warning box. The two tiny followers `0x0040cec0` and `0x0040cee0` then resolve those cached ids
  back into concrete source and candidate records through `0x0062b2fc` and `0x0062b268`
  respectively. The derived payload and transient family under that same table is tighter now too.
  `0x0045c150` is the clear payload-loader
  counterpart to `0x0045b560`: it reinitializes the derived field band, opens the `0x5dc1/0x5dc2`
  payload bracket, restores the two payload strings into `[this+0x23e]` and `[this+0x242]`, clears
  the transient roots `[this+0x24e]`, `[this+0x256]`, `[this+0x25a]`, and `[this+0x25e]`, and then
  rebuilds follow-on specialization state through `0x0045b5f0` and `0x0045b6f0`. The neighboring
  builder pair is coherent too: `0x0045b210` formats `amb_%1_01.wav`, allocates a `0x141`-byte
  transient object, stores it at `[this+0x24a]`, and registers it through `0x0052da00`, while
  `0x0045c310` allocates the separate primary transient handle at `[this+0x246]` from payload
  strings `[this+0x23e]` and `[this+0x242]`, then publishes it through `0x00530720` and
  `0x0052d8a0`. The next rebuild layer is tighter now too. `0x0045b5f0` resolves one current
  world-position tuple through `0x0052e720 -> 0x0051f090 -> 0x00534490`, then uses that derived
  scalar to refresh the ambient-side transient again through `0x0045b210`. Above that,
  `0x0045b6f0` clears the optional handles at `[this+0x25a]` and `[this+0x25e]`, then probes and
  materializes a larger named variant family rooted in `[this+0x23e]` through strings such as
  `%1_`, `%1_Upgrade1`, `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and
  `%1_Upgrade1Light%2.3dp`, looping across numbered variants and publishing surviving records
  through `0x0052d8a0`. One higher timed branch is bounded now too: `0x0045baf0` advances the two
  timer-like fields `[this+0x26a]` and `[this+0x266]`, gates on nearby world-distance and
  candidate-side checks, and then formats one output around `rnd_%1_%2.wav` plus the same anim or
  light string family before dispatching through `0x00531e50` under owner `0x006d402c`. Their
  release-side companions `0x0045b160` and `0x0045c3c0` tear down those same transient roots and
  payload strings again, and the recurring service slice `0x0045be50` updates the derived scalar
  triplet `[this+0x22e]`, `[this+0x232]`, and `[this+0x236]` before republishing it through
  `0x00530720`. The string literals `amb_%1_01.wav`, `%1_Anim%2.3dp`,
  `%1_Upgrade1Anim%2.3dp`, `%1_Upgrade1Light%2.3dp`, and `rnd_%1_%2.wav` therefore ground the
  derived band `[this+0x23e..+0x26a]` as one payload-plus-transient owner family with ambient,
  animation, light, and random-sound components, rather than more linked-site or route-entry ids.
  One broader specialization-side build pass under that same family is bounded now too.
  `0x0045b760` first scans one base-or-upgrade descriptor family rooted in `[this+0x23e]`
  through `%1_` or `%1_Upgrade1`, probing each numbered hit through `0x0053c930` and dispatching
  every accepted one through vtable slot `+0x7c`. It then builds the matching attached-emitter list
  through `0x0045e940`, ensures the shared `%1_Anim.3dp` payload root exists through `0x0045ae80`,
  and finally scans the paired animation family through `%1_Anim%2.3dp` or
  `%1_Upgrade1Anim%2.3dp`, materializing each accepted hit into a `0x206` record through
  `0x00530640`, publishing that record through `0x0052d8a0`, hashing the generated name through
  `0x0053d810`, and forwarding the result into `[this+0x256]` through `0x0045a7f0`. So that
  specialization side now has one explicit base-or-upgrade descriptor and animation-record build
  pass above the later timed anim/light/random-sound service slice, not just the narrower
  `%1_Anim` and `%1_Upgrade1Light` helpers.
  The shared `%1_Anim.3dp` collection under that build pass is tighter now too. `0x0045ae80`
  formats literal `%1_Anim.3dp`, probes the named-bank owner `0x006d4020`, reads the matched
  payload bytes, and lazily allocates the intrusive shared list root `0x006acd5c`, so this is the
  bootstrap for the specialization-side shared animation payload family rather than just another
  bank-read leaf. `0x0045a7f0` then acts as the keyed replace-or-publish helper over that same
  family: it rewrites matching keys across the current `0x006acd50/0x006acd4c` row collection,
  mirrors the replacement into the per-row four-lane pointer bands, inserts newly active rows into
  the intrusive list rooted at `0x006acd5c`, and when selector table `0x006acd44` is live it
  allocates one selector-`0` effect slot through `0x00475ed0` before forwarding it into
  `0x00475240(-1,0)`. The smaller helper `0x0045a700` is the keyed three-float accumulator beneath
  that same path: it scans the live `0x168`-byte rows in `0x006acd50`, filters on one key dword
  plus row flag bit `0x400`, and accumulates one output anchor delta from the shared basis bands in
  `0x006acd4c+0x04/+0x34` or `+0x40/+0x70`. The service side above the collection is also bounded:
  `0x0045af50` clears globals `0x006acd44/48/54`, publishes the current row collection into
  `0x006acd50/0x006acd4c`, releases oversize selector roots through `0x00475100`, and prunes every
  intrusive active record in `0x006acd5c` whose owner pointer at `[record+0xf0]` matches the
  current collection owner. The heavier per-record body is `0x0045a9c0`: it honors the current
  controller gates in `0x006acd48/58`, clears and re-arms the selected effect-slot band in
  `0x006acd44`, optionally mirrors one caller dword into row field `[row+0x80]`, updates timing and
  mode fields across every matching shared row, derives local scalar deltas through `0x0045a280`,
  optionally subtracts keyed anchor deltas through `0x0045a700`, and republishes the finished two
  owner triplets through `0x0052e8b0` and `0x00530720`.
  `0x0045ade0` seeds cursor `0x006acd60` from `[0x006cec78+0x15]`, then services the intrusive
  list in `0x0f`-tick windows by dispatching the heavier per-record body at `0x0045a9c0(owner,
  cursor, 0)` for every linked record whose owner pointer at `[record+0xf0]` is live. So the
  specialization transient family now includes a concrete shared `%1_Anim.3dp` payload root,
  keyed record replacement, keyed anchor accumulation, and a bounded 15-tick shared service loop,
  not just the base builder at `0x0045b760`.
  The low-side leaves under that same family are tighter now too. `0x0045b050` is the explicit
  field reset for payload roots `[this+0x23e/+0x242]`, transient handles `[this+0x246/+0x24a/+0x24e]`,
  selector slot `[this+0x262] = -1`, timer fields `[this+0x266/+0x26a]`, and the packed flag band
  `[this+0x23a..+0x23d]`, with an optional tail into `0x00455610` when the caller requests a
  broader base clear. `0x0045b0b0` is the paired integer-triplet publish leaf: it forwards one
  caller triplet through `0x0052e680` on the specialization owner and, when present, repeats that
  same publish into the primary transient `[this+0x246]`. `0x0045b0f0` is the neighboring packed
  RGB-triplet forwarder into vtable slot `+0x58`. The two tiny wrappers around them are now
  explicit too: `0x0045b040` demotes the specialization straight back to base vtable `0x005cb4c0`
  before tailing into the common cleanup body `0x00455650`, while `0x0045b110` is just the direct
  wrapper into the shared world-anchor triplet publisher `0x00455660`.
  One intermediate transient build layer is bounded now too. `0x0040cf00` first requires
  creation-mode byte `[this+0x3d4] == 1` and live seed handle `[this+0x24e]`, re-enters
  `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`,
  `[this+0x21]`, `[this+0x3a]`, and `0x005c8cf4`, and then allocates a second transient handle
  into `[this+0x25a]` through `0x00475ed0`. It follows that with one current world-position
  resolve through `0x00414450` and `0x0052e720`, several local offset-triplet writes through
  `0x00475010`, and four numbered channel updates through `0x00475030` with selector ids `1..4`.
  That is enough to bound it as another specialization-side transient-handle builder beneath the
  same payload family as `0x0045c310` and `0x0045b210`, without yet over-naming the user-facing
  subtype or effect semantics of the built handle. The adjacent data-loading strip under that same
  transient family is tighter now too. `0x00474700` reloads `particles.dat` into global root
  `0x006cea5c` and then registers literal `ParticlesTexture` through owner `0x006d4030`;
  `0x00474790` reloads `emitters.dat` into global root `0x006cea60`; `0x00474820` hashes one
  caller-supplied emitter name and resolves the first matching entry out of that `emitters.dat`
  table; `0x00474860` is the adjacent formatted-variant iterator that walks the same table through
  `%s%s%i.3dp`, saving the selected row root into `0x006cea90` and the generated variant name into
  `0x006cea94`; `0x00474970` is the small handle-array release helper used by the same
  emitter-template teardown side; and `0x004749a0` is the tiny exact-compare predicate for literal
  `steam`. The lower definition-to-handle materialization body is bounded now too: `0x004749d0`
  copies scaled float and packed dword bands from one emitter-definition row into the attached
  emitter handle, resolves the named particle row from `particles.dat` through `0x0053d810`, and
  mirrors that particle row into `[handle+0x10c..]` before returning the live handle. The
  higher creator above that materializer is tighter now too: `0x00474e20` first strips special
  high bits for `CargoMoney_DollarSign`, clears incoming flag `0x400` when definition gate
  `[def+0xb8]` is zero, and then either hashes the definition name plus owner token and clones one
  owner-side template through `0x00556ce0`, or allocates a fresh `0x1fd` runtime emitter through
  `0x00556920` before re-entering `0x004749d0`. On success it publishes that emitter through
  `0x0052d950`, stores the definition owner pointer into `[emitter+0x60]`, and when final flags
  carry `0x02000000` it forces persistent flag dword `[emitter+0xbc] = 1`. One larger owner-stem
  branch above that iterator is bounded now too: `0x0045e940` rejects `Stadium`, clears caller flag
  bit `0x10` for `ParticleCar`, repeatedly pulls formatted variants through `0x00474860`,
  instantiates each accepted variant through `0x00474e20`, sets emitter flag `0x02` for
  `Nuclear`, and optionally returns the created emitter list through the caller array. So the
  `0x00474e20/0x00475010/0x00475030` emitter builders are now sitting on top of a grounded pair
  of particle and emitter data tables plus one concrete owner-stem-driven variant-list builder,
  not just anonymous global payload roots. The small shared slot utilities
  under those builders are tighter now too: `0x00474fe0` is the shared per-slot flag broadcast
  into `[emitter+0xbc]`; `0x00475010` caches one shared anchor
  triplet into globals `0x006cea68/0x006cea6c/0x006cea70`, `0x00475030` republishes that cached
  triplet into either all emitters in one slot container or one selected emitter index at
  `[emitter+0x1b0..+0x1b8]`, `0x00475240` toggles the per-emitter enable byte `[emitter+0x1d8]`
  for either all or one selected emitter, and `0x004752b0` is the paired boolean query that
  reports true only when that same byte is zero. The update side is explicit too: `0x00474f70`
  runs `0x00555e50(0)` across either one supplied slot container or every slot in the global linked
  list rooted at `0x006cea74`. The release side is explicit too: `0x00475100`
  tears emitter slots down, optionally unlinks them from the global active list
  `0x006cea74/0x006cea78/0x006cea7c`, and then either recycles or frees the slot depending on
  whether it falls inside the pooled descriptor rooted at `0x006cea58`. Two named bundle builders
  are grounded now too: `0x004752d0` builds the three-emitter `BrokenDown_Steam` +
  `FlamespoutB` + `Crash_SmokeA` bundle, while `0x00475550` builds the two-emitter
  `BrokenDown_Steam` + `BrokenDown_Smoke` bundle. The next owner layer above those helpers is
  grounded now too. `0x00474ce0` is the global particle/emitter bootstrap: it reloads
  `emitters.dat`, reloads `particles.dat`, publishes the mode-`1` ratio labels through
  `0x00474690`, lazily allocates pooled slot root `0x006cea58`, allocates backing slab
  `0x006cea54`, seeds that slab into the pooled descriptor through `0x0053dcf0(0x38, 0x2710, 1)`,
  clears the global linked-slot heads and shared anchor globals, rebuilds the flagged templates
  through `0x00474c60`, and finally publishes enable-state `1` through owner `0x006d4030`.
  `0x00474db0` is the teardown-side companion that frees `0x006cea54`, `0x006cea5c`,
  `0x006cea60`, and then resets and frees the pooled slot root `0x006cea58`. That makes the
  effect-slot builders a real subsystem rooted at `0x006cea54..0x006cea98`, not just a loose
  string-and-handle utility strip. The named bundle surface is broader now too: `0x00475420`
  selects one `Volcano_BlackSmoke*` + `Volcano_Lava*` pair from the caller float tier
  `0.5/0.75/1.0/1.5/2.0` and builds the two-emitter volcano bundle; `0x00475650` builds the
  three-emitter `ServiceTower_Water2` + `ServiceTower_Water` + `ServiceTower_Water3` water bundle
  from the paired `ServiceTower_Anim2#water.3dp`, `ServiceTower_Anim3#water.3dp`, and
  `ServiceTower_Anim4#water.3dp` definitions; `0x004757b0` builds the three-emitter
  `Rocket_Flame` + `Rocket_Smoke` + `Rocket_Sparkle` fireworks bundle from the paired
  `Fireworks_Anim2/3/4#water.3dp` definitions; `0x00475910` is the adjacent randomized
  one-emitter fireworks builder that rotates among `Fireworks1/2/3`, uses
  `Fireworks_Anim5#water.3dp`, and writes fixed dword `0x3c` into `[emitter+0xbc]`;
  `0x004759f0` and `0x00475b30` build the one-emitter `CargoMoney_DollarSign` and
  `SpendMoney_DollarSign` bundles; `0x00475a90` builds the one-emitter `SelectObject` bundle;
  `0x00475bd0` builds the five-emitter directional construction bundle from `Construct_Pos`,
  `Construct_Left`, `Construct_Right`, `Construct_Back`, and `Construct_Forward`; `0x00475dc0`
  selects between one-emitter `Mist` and `MistSmall`; and `0x00475e30` builds the one-emitter
  `Vent` bundle. The next local owner above that catalog is grounded too: `0x00475ed0` is the
  selector-driven named-bundle dispatcher that chooses one of those builders from the caller
  selector, mirrors the first emitter's attachment token into `[slot+0x04]`, stores caller mode
  into `[slot+0x34]`, and when that mode equals `1` links the finished slot into the global active
  list `0x006cea74/0x006cea78/0x006cea7c`. So that specialization-side transient path now has a
  much broader data-backed effect catalog and a concrete selector-driven bundle owner above it, not
  just the earlier broken-down bundles.
  One adjacent train-side effect strip is bounded now too, and it should stay separate from the
  concrete placed-structure specialization family. `0x0045d130` resolves one owner profile
  through `0x006ada84`, allocates a `0x141`-byte handle, initializes it through `0x00554830`
  using one mode-selected train sound stem from the tiny selector at `0x0045d22e`, applies two
  fixed parameter writes through `0x00554340` and `0x00554450`, stores the result at `[this+0x336]`,
  and registers it through `0x0052da00`. `0x0045d260` is the paired live-handle updater: it clamps
  one caller-scaled rate into `0x1f40..0xac44`, forwards that through `0x005542c0`, pushes the
  caller gain through `0x00554450`, and when the current handle mode at `[handle+0x138]` equals
  `1` also forwards zero through `0x005543f0`. The broader owner above both helpers is
  `0x0045d2e0`: it republishes the current world anchor through `0x0052e720`, updates an existing
  live sound handle at `[this+0x346]` when one exists, or otherwise selects one new sound stem from
  fixed `Train_Burning.wav`, fixed `Train_Breakdown_loop.wav`, or one dynamic table-driven name
  after the `0x0041b8f0 -> 0x004a8840` branch, then creates the fresh sound handle through
  `0x00531e50`, stores it at `[this+0x346]`, sets fixed flag bits `0x18`, seeds two scale fields
  from the chosen mode factor, and clears the three train-state latches `[this+0x33a/+0x33e/+0x342]`
  again. So the neighboring `0x0045d130/0x0045d260/0x0045d2e0` family is now bounded as a
  train breakdown-or-burning sound/effect handle strip rather than more placed-structure emitter
  state.
  The larger owner above that train-side strip is bounded now too. `0x0045d4b0` optionally clears
  prior state through `0x00455610`, copies the caller primary and secondary stems into
  `[this+0x32e]` and `[this+0x332]`, probes the named-bank owner `0x006d4020` for the secondary
  stem, then falls back through the primary stem and the suffixed `_C.tga` form. It resolves one
  `ServicePoint.3dp` payload into `[this+0x23e/+0x23a]`, one `Body.3dp` payload into
  `[this+0x242/+0x246]`, counts existing `%1_Truck%2.3dp` variants into `[this+0x31a]`, allocates
  the larger per-variant table at `[this+0x316]`, and then enters the later subloops that fill the
  cargo-icon, bogie, drivewheel, piston, connecting-rod, coupling-bar, body, and track-point
  bands. That keeps the `0x0045d130/0x0045d260/0x0045d2e0` sound helpers nested under a broader
  train visual/profile preload owner rather than floating as an isolated sound-only strip.
  The release and load sides of that same train family are bounded now too. `0x0045e390` drops the
  optional sound handle `[this+0x346]` through `0x00531ef0` plus the mode-gated `0x005317b0` path,
  clears the live train-effect handle root `[this+0x336]` by re-entering `0x0045cc90(0)` and
  `0x0045cf40(0)`, iterates the variant table at `[this+0x316]` to free per-row pointer arrays,
  two heap buffers, and any nested owned list rooted at `[row+0x0c]->[+0x75]`, then frees the main
  table and the two payload strings `[this+0x32e]` and `[this+0x332]`. `0x0045e530` is the
  load-side owner: it opens tags `0x61a9` and `0x61aa`, reads two heap strings, optionally rewrites
  the first string by scanning the live collection at `[0x006d4020+0x429b8]`, rebuilds the train
  visual family through `0x0045d4b0` with unit scale, republishes the early per-row handles through
  `0x005548d0`, and under scenario latch `[0x006cec78+0x46c34] > 0x2585` also enters the optional
  child-record branch under tag `0x61b2` before closing `0x61ab`. That makes the train-side strip a
  real payload-owned family with explicit preload, service, load, and teardown phases rather than a
  one-off visual helper.
  Two shared selector-slot toggles under that same family are bounded now too. `0x0045cc90` owns
  the three selector-driven effect slots at `[table+0x34]`, `[table+0x38]`, and `[table+0x3c]`:
  in build mode it allocates selectors `1`, `2`, and `3` through `0x00475ed0`, reseeds their
  shared anchors through `0x00475010/0x00475030`, and then enables every live emitter in the main
  row-object list by writing byte `1` into `[emitter+0x1d8]`; in release mode it tears those same
  three slots down through `0x00475100`, clears the table fields again, and disables the same
  emitter list by writing byte `0`. `0x0045cf40` is the same pattern for selector `5` into
  `[table+0x40]`. So the train visual family now has one explicit selector-slot toggle layer above
  the named `0x00475ed0` bundle catalog, rather than touching those effect slots only through the
  broader load and teardown owners.
  One smaller service leaf under that same family is grounded now too. `0x0045e8c0` walks the
  fixed 32-entry row-object strip rooted at `[this+0x277]` and dispatches vtable slot `+0x10` on
  every live row object. When the caller supplies a valid selected row index instead of `-1`, it
  re-enters that selected row through vtable slot `+0x0c`, and when the paired per-row flag byte in
  the neighboring strip is nonzero it also pushes `0,0,1.0f,1.0f` through `0x0052eab0` on that
  selected row object. The current grounded callers at `0x0041c680` and `0x0041c69a` derive the
  selected row from byte `[cargo+0x20]`, so this is best read as the row-object service plus
  selected-entry refresh leaf under the train visual family, not a generic object-list sweep.
  One adjacent helper block is tighter now too, and it should stay separate from the concrete
  `0x005c8c50` vtable rather than being folded into it. The small predicates
  `0x0040cc40/0x0040cc60/0x0040cc80` all follow the same `[this+0x173] -> 0x0062b268` chain into
  one linked candidate/profile record. `0x0040cc40` returns whether candidate subtype byte
  `[candidate+0x32]` equals `1`, `0x0040cc60` returns raw candidate byte `[candidate+0xba]`, and
  `0x0040cc80` returns the stricter conjunction `subtype == 1 && class == 3` using class byte
  `[candidate+0x8c]`. The current grounded caller for all three is
  `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where they derive
  the two boolean mode inputs for `0x00415020`; that makes them a shared candidate-profile helper
  cluster adjacent to the specialization family, not direct overrides in the `0x005c8c50` table.
  The neighboring `0x0040ccf0` stays on the same “adjacent but not the same vtable” side of the
  boundary: it resolves one linked instance through `0x0047de00`, follows that instance's vtable
  `+0x80` owner chain, and returns candidate class byte `[candidate+0x8c]`. Current grounded
  callers at `0x00480fb5` and `0x004b03ce` compare that returned class against `3` and `4`, so the
  current safest note is simply “linked-instance candidate-class reader.” One gated collection-side
  scan in the same neighborhood is bounded now too. `0x0040cd10` first requires shell latch
  `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current
  subject's center world-grid cell through `0x00455f60`, reads the local site roster count and id
  list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through
  `0x006cec20`. Its current grounded caller is the broader collection sweep at `0x00413860`, so
  the strongest current read is a gated center-cell site-roster scan rather than one more direct
  specialization override.
  One small neighboring world-grid helper is grounded cleanly enough to keep too. `0x0040ccd0`
  takes one live world root, one X-like index, and one Y-like index, multiplies the Y-like term by
  world width `[world+0x2145]`, adds the X-like term, scales the resulting slot by fixed cell
  stride `0x1d7`, and returns the corresponding cell pointer under base `[world+0x2129]`. Current
  grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386` and
  several world-grid overlay passes in the `0x004525bc..0x00452bb2` range, so that helper is now
  best read as the shared `(x,y) -> world-cell*` resolver rather than another object-specific
  method.
  The next sibling table at `0x005c9750` is tighter now too, though still not fully decoded. The
  structural anchor is `city_database_entry_collection_refresh_records_from_tagged_bundle`
  `0x00474540`: that load-side owner stages bundle tags `0x61a9..0x61ab`, iterates one
  collection, and dispatches each entry through vtable slot `+0x40`.
  In `0x005c9750`, that same slot resolves into the sibling record family beside
  `0x0041ab70/0x0041ab80`, which is enough to treat the table as the city-database entry family
  rather than a generic unresolved runtime object. The small load-side slot `0x0041ab70` simply
  jumps into `0x0045c6f0`, which restores two strings into `[this+0x32e]` and `[this+0x332]`,
  stages the same `0x61a9/0x61aa/0x61ab` tag family, and iterates the child runtime band rooted at
  `[this+0x316]`. The one real behavioral slot we recovered there is `0x0041ab80`: it refreshes
  one named handle through owner `0x006d4020`, writes the resulting handle into `[this+0x1c]`,
  queries three base floats through `0x0045c480`, and returns one scaled float derived from the
  first queried component. That method is currently called from later world-side branches at
  `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantic of the handle still
  is not grounded, but the leftover rows in the same table are now bounded as low-value
  constant-return stubs rather than a meaningful unresolved behavior seam. The family boundary is
  therefore no longer arbitrary: this is now the current city-database entry vtable cluster, not
  another placed-structure specialization. One correction matters here too: the lower
  `0x00455660/0x00455800/0x00455810/0x00455930` helpers are no longer city-only. Local `.rdata`
  now shows the same shared slots under both the city-entry table `0x005c9750` and the sibling
  `Infrastructure` table `0x005cfd00`, whose constructors at `0x0048a240/0x0048a2dc/0x00490a3c`
  all re-enter `0x00455b20`, install `0x005cfd00`, and seed the same scalar-band family through
  `0x00455b70` with the literal stem `Infrastructure`. So the safest current family name for those
  low helpers is the broader `0x23a` runtime-object band rather than city-entry-only. `0x00455800`
  and `0x00455810` are simply the paired normalized coordinate getters over `[this+0x1e2]` and
  `[this+0x1ea]`, which explains why they recur all over the city-side, route-link, and
  placed-structure placement code. The narrower helper `0x00455660` sits above those getters: it
  scales the caller-supplied normalized coordinate pair, converts it through
  `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds a caller-supplied integer height bias, optionally
  rounds that height through `0x005a10d0` when the auxiliary-preview gate `0x00434050` is active,
  and finally publishes the resulting world-anchor triplet through `0x00530720`. One
  serializer-side sibling is bounded too. `0x00455930` queries two triplet-like scalar bands
  through `0x0052e720` and `0x0052e880` and writes the resulting six dwords through `0x00531030`;
  its load-side stream counterpart `0x00455870` reads the same six four-byte lanes back through
  `0x00531150`, republishes the first triplet through `0x00530720`, republishes the second through
  `0x0052e8b0`, and returns the summed byte count. The neighboring tagged string-triplet serializer
  `0x004559d0` is now no longer reversed either: it writes bracket tags `0x55f1/0x55f2/0x55f3`
  through `0x00531340`, emits the three string lanes `[this+0x206/+0x20a/+0x20e]` through
  `0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before the closing
  tag.

### Shared Runtime-Object and Support Families

The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` is the
  common local-state reset that clears the list and handle roots, resets the string/scalar side
  bands, preserves only selected low bits of `[this+0x20]`, and reseeds the recurring default
  `1.0f` lanes; `0x0052ebd0/0x0052ec50` are the load/save companions for the two flag bits stored
  in that same byte; `0x0052eb90` releases every entry hanging from list root `[this+0x79]`
  through `0x00554d50`; and `0x0052eca0` is the grouped-table cursor over `[this+0x14]`,
  `[this+0x21]`, and `[this+0x3a]` that returns the next `0x45`-byte subrecord in the current
  group when one exists. The next shared initializer `0x0052edf0` then binds caller
  pointer `[this+0x04]`, resolves optional handles into `[this+0x10]` and `[this+0x1c]`, copies
  one anchor triplet into `[this+0x1e2/+0x1e6/+0x1ea]`, sets bit `0x08`, and seeds packed color
  `[this+0x43] = 0x007f7f7f`; its release-side siblings `0x0052eeb0` and `0x0052ef10` clear the
  two owned list roots `[this+0x79]` and `[this+0x7d]` through distinct per-entry destructors
  before freeing the list roots themselves. The broader release body `0x0052ef70` sits above that
  strip: it clears the active shell preview-owner latch when it still points at `this`, drops the
  dependent handle at `[this+0x0c]`, recursively tears down the nested object list `[this+0x75]`,
  clears sibling owned list `[this+0x81]`, detaches any world binding rooted at `[this+0x04/+0x08]`,
  and finally frees the optional handles at `[this+0x10]` and `[this+0x1c]`. The next shared
  dirty-bit helper `0x0052f120` is now bounded too: when byte `[this+0x20]` still carries bit
  `0x02`, it rebuilds the cached 16-dword transform-style block at `[this+0x14e]` from scale
  `[this+0x36]`, anchor triplet `[this+0x1e2/+0x1e6/+0x1ea]`, and either the live local vector
  lanes `[this+0x4b/+0x4f/+0x53]` or the stored fallback block at `[this+0x18e]`, then flips the
  dirty bit over to the cached-ready bit `0x04`. The next two adjacent helpers are bounded too:
  `0x0052f1e0` is a pure five-vec3 boolean geometry predicate built from signed-volume or
  separating-plane style tests, and `0x0052f370` is the quantized selector that rounds world
  coordinates, folds them through table `0x006d9098`, samples one grouped metric through owner
  `[this+0x04]`, updates byte `[this+0x5c]`, and then chooses the active `0x45`-byte subrecord by
  storing index `[this+0x21]` and pointer `[this+0x18]`. The adjacent emission owner `0x0052f500`
  is tighter now too: it starts from that selected grouped subrecord, snapshots the global packet
  write pointer and remaining count at `0x00cc3b64/0x00cc3b5c`, optionally refreshes the cached
  transform block and applies the five-vec3 predicate when state bit `0x01` is active, and then
  hands off to the concrete emitters `0x0052dd00` and `0x0052e060`. Those two helpers are no
  longer best read as shell-only batch expanders. `0x0052dd00` emits the materialized group packet
  rows as one `0x20`-byte segment-record window for the layout-state presentation owner
  `0x005490b0`, while `0x0052e060` emits the same row family as one `0x18`-byte vertex24 window
  for the shell-side presentation branch `0x00528821`. The next shared helpers under that emission
  band are now
  bounded too: `0x0052d8a0/0x0052d950/0x0052d9a0` are the three owned-list registration helpers for
  child objects and copied-anchor records on `[this+0x75]`, `[this+0x79]`, and `[this+0x7d]`;
  `0x0052daa0` is the explicit grouped-subrecord selector; `0x0052db10` materializes the current
  group's packet rows after storing scalar `[this+0x69]`; and `0x0052dc00` then buckets those
  materialized rows by four float thresholds. A concrete owner above that strip is grounded now
  too: `vehicle_visual_build_exhaust_running_gear_track_and_mantlet_attachment_children`
  `0x004858e0` uses those same registration and grouped-row helpers while building
  `%1_ExhaustSmoke.3dp`, `%1_MuzzleFlash.3dp`, `%1_RoadWheelL%2.3dp`,
  `%1_RoadWheelR%2.3dp`, `%1_IdlerWheelL.3dp`, `%1_IdlerWheelR.3dp`,
  `%1_DriveWheelL.3dp`, `%1_DriveWheelR.3dp`, `%1_TrackL.3dp`, `%1_TrackR.3dp`, and
  `%1_MantletLight1.3dp` child records under the broader vehicle-visual owner `0x00485760`.
  The next shared helpers under that emission band are now
  bounded too. `0x0052fb70` is the packed-color propagation helper over `[this+0x43/+0x47]`: when
  shell gate `[0x006d4024+0x114742]` is live it combines stored high-byte state with either dim
  RGB `0x003c3c3c` or full-bright RGB `0x00ffffff`, pushes the same dim-or-bright triplet into the
  child list `[this+0x75]` through `0x0052e680`, and optionally recurses that update over the whole
  child tree; when the shell gate is absent it instead stores the raw byte into `[this+0x47]` and
  only recurses that byte state. `0x0052fd60` then republishes current anchor triplet
  `[this+0x1e2/+0x1e6/+0x1ea]` into every attached entry hanging from list root `[this+0x81]`
  through `0x005545d0`. The heavier relocation sibling `0x0052fdc0` marks the object dirty, adds a
  caller-supplied triplet delta to the same anchor, quantizes old and new X/Z lanes against the
  live world grid, rebinds world handle `[this+0x08]` through `0x00533c20/0x00533bf0` when the
  quantized cell changes, and on success re-enters `0x0052fd60`; out-of-bounds moves restore the
  prior anchor and fail. One more adjacent rotation-side helper is now bounded too: `0x0052ffb0`
  converts the current local 4-dword orientation block at `[this+0x1ce..+0x1da]` into a temporary
  axis-angle representation, scales the recovered angle by the caller float, and rebuilds the
  stored orientation block by re-entering `0x0052e9f0`. The immediate anchor-publish sibling
  `0x00530720` is now explicit too: it is the absolute-triplet form of the same relocation family,
  storing one caller-supplied anchor directly into `[this+0x1e2/+0x1e6/+0x1ea]`, optionally
  rebinding world handle `[this+0x08]` when the quantized X/Z cell changes, and then re-entering
  `0x0052fd60`. The adjacent packet-side query `0x00530030` is bounded as well: it starts from the
  currently selected grouped `0x45`-byte subrecord, snapshots the same global packet source span as
  `0x0052f500`, lazily refreshes cached basis lanes when needed, transforms one caller-supplied
  input triplet through that basis, and then walks the remaining packet span until
  `0x0052f1e0` reports one overlap or the span is exhausted. One sibling-table strip is now
  explicit too. Table `0x005dd1f0` has the tiny wrappers `0x00530640`, `0x00530670`, and
  `0x00530680` as its shared seeded-constructor, reset, and release thunks over `0x0052edf0`,
  `0x0052ecd0`, and `0x0052ef70`, while `0x005305c0` is the small list-bit propagator that sets or
  clears bit `0` in `[entry+0xb0]` across owned list `[this+0x79]`. The first heavier body under
  that same table is now bounded too: `0x00530690` copies one pair of 16-dword cached blocks from a
  source object into `[this+0x10e]` and `[this+0xce]`, refreshes local cached transform
  `[this+0x14e]`, and recurses the same copy into child list `[this+0x75]`. The `Infrastructure`
  side is tighter now too. The optional child
  The next adjacent field-accessor strip is explicit too: `0x00533100/0x00533120` are the indexed
  float set/get helpers for `[this+0x14e4 + index*4]`; `0x00533130/40`, `0x00533150/60`,
  `0x00533170/80`, and `0x00533190/a0` are four direct dword set/get pairs over
  `[this+0x1534]`, `[this+0x1540]`, `[this+0x153c]`, and `[this+0x1544]`; `0x005331b0/c0` are the
  float set/get pair for `[this+0x14e0]`; and `0x005331d0` is the direct getter for `[this+0x1548]`.
  The important caller-side grounding is narrow but real: `0x0052f370` samples one indexed float
  through `0x00533120` while choosing the active grouped subrecord, and `shell_emit_ranked_overlay_cell_items`
  `0x00524780` reads the current threshold pair through `0x00533160` and `0x00533180`. So this
  strip is now bounded as a genuine shared field-accessor family under the same runtime-object
  owner, even though the exact high-level meanings of those fields remain open.
  attach helper `0x0048a1e0` allocates and seeds one fresh `Infrastructure` child and, when the
  owner already has more than one child, clones the first child's two triplet bands into that new
  child before attaching it. The looped rebuild `0x0048dd50` then rebuilds the owner-visible
  `Infrastructure` children one ordinal at a time, tears down the higher extras above ordinal `5`,
  refreshes cached primary-child slot `[this+0x248]` when needed, and finishes with the same
  world-cell and route-side follow-on family around `0x00448a70`, `0x00493660`, and `0x0048b660`.
  The outer owner above that loop is bounded now too: `0x0048dcf0` reads a child count plus one
  optional primary-child ordinal from the tagged stream through `0x00531150`, zeroes `[this+0x08]`,
  dispatches each fresh child through `0x00455a50 -> vtable slot +0x40`, culls ordinals above `5`,
  and restores cached primary-child slot `[this+0x248]` from the saved ordinal. So the rebuild
  strip is consuming an already-materialized child stream rather than parsing the compact side
  buffer directly.
  The upstream handoff is explicit now too: `0x00493be0` is the tagged collection load owner over
  `0x38a5/0x38a6/0x38a7`, and it feeds each live infrastructure record straight into
  `0x0048dcf0` after restoring one shared owner-local dword into the `0x90/0x94` lane. That means
  the `0x38a5` side-buffer seam is now a proven direct upstream feed into the child-stream restore
  owner rather than only a candidate cache or serializer-side neighbor.
  The collection helpers above that handoff are bounded now too: `0x00518140` resolves a non-direct
  live entry through the tombstone bitset and returns the first dword of a `12`-byte row from
  `[collection+0x3c]`, while `0x00518680` loads the non-direct collection header, tombstone bitset,
  and live-id-bound-scaled `12`-byte tables before `0x00493be0` starts iterating. So the remaining
  infrastructure mapping problem is no longer “which generic collection helper is involved?” but
  how those helpers compose in the actual load loop: `0x00493be0` now reads as an
  ordinal-to-live-id-to-payload-pointer walk through `0x00518380(ordinal, 0)` then
  `0x00518140(live_id)`. That narrows the remaining infrastructure mapping problem further:
  the first dword of each `12`-byte live-entry row is already spoken for as the per-entry payload
  pointer, and `0x005181f0/0x00518260` now also read as the live-entry unlink/link owners that use
  the same rows as `(payload pointer, previous live id, next live id)` directory triplets. So the
  next unknowns are no longer inside that row layout itself; they are in the payload streams those
  rows point at, and how those streams align with the save-side `0x55f1` name-pair groups and
  compact prefix regimes.
  The shared child payload callback is tighter now too: `0x00455fc0` zeroes the route-entry and
  cached bridge bands, opens `0x55f1`, parses three len-prefixed strings through `0x00531380`,
  opens `0x55f2`, seeds the child through `0x00455b70`, dispatches slot `+0x48`, runs the local
  follow-on `0x0052ebd0`, and then opens `0x55f3`. The widened save-side probe currently still
  sees only two embedded `0x55f1` strings on grounded `q.gms`, but `0x00455b70` now makes that
  result much less mysterious: it stores the three payload strings into `[this+0x206/+0x20a/+0x20e]`,
  defaulting the second lane through a fixed literal when absent and defaulting the third lane back
  to the first string when absent. So the remaining payload question is no longer “where is the
  third string hiding?”; it is how the current dual-name save-side rows align with the full
  payload-stream grouping and the later tagged value roles.
  That trailing-value strip is tighter now too: direct disassembly of the post-`+0x48` helper pair
  `0x0052ebd0/0x0052ec50` shows two serialized single-byte lanes folded into bits `0x20` and
  `0x40` of `[this+0x20]`. Grounded `q.gms` side-buffer probes now show that all embedded rows sit
  inside complete `0x55f1 -> 0x55f2 -> 0x55f3` envelopes, every embedded `0x55f2` chunk is the
  fixed `0x1a` bytes that `0x00455870` expects, and the dominant short trailing `0x55f3` span is
  the `0x06`-byte form with flag pair `0x00/0x00` across `72` rows. So the next remaining
  infrastructure question is no longer whether a short trailing lane exists; it is how those
  compact-prefix regimes and short flag-byte pairs feed the child-count / primary-child restore
  state above `0x0048dcf0`.
  The fixed policy lane is tighter now too: direct disassembly of
  `0x00455870/0x00455930` shows the `+0x48/+0x4c` strip loading and serializing six `u32` lanes
  from the fixed `0x55f2` chunk, forwarding them through `0x00530720` and `0x0052e8b0`. Grounded
  `q.gms` save-side probes now show every embedded `0x55f2` row using the same trailing word
  `0x0101` while the six dword lanes vary by asset row. So the remaining infrastructure question
  is no longer whether `0x55f2` is a fixed-format child lane; it is which of those two dword
  triplets correspond to the later child-count / primary-child restore state and which only seed
  published anchor or position bands.
  That split is now explicit too: direct disassembly of `0x00530720/0x0052e8b0` shows the first
  restored triplet landing in `[this+0x1e2/+0x1e6/+0x1ea]` while the second lands in
  `[this+0x4b/+0x4f/+0x53]`, with the companion setter forcing bit `0x02`. So the remaining
  infrastructure question is no longer whether the fixed `0x55f2` row hides the child count or
  saved primary-child ordinal at all. Those values now have to live outside the fixed row, most
  likely in the surrounding payload-stream header or compact-prefix regime above `0x0048dcf0`.
  The outer prelude is explicit now too: direct disassembly of `0x0048dcf0` shows it reading one
  `u16` child count through `0x00531150`, zeroing `[this+0x08]`, and conditionally reading one
  saved primary-child byte before the per-child callback loop begins. Grounded `q.gms` bytes now
  also show the first `0x38a6` record starting immediately after the shared owner-local dword with
  `child_count = 1`, `saved_primary_child_byte = 0xff`, and the first child `0x55f1` opening at
  offset `+0x3`. So the remaining infrastructure question is no longer “what kind of value should
  the save-side probe be looking for above the fixed rows?”; it is the narrower partitioning
  problem of how the observed `0x55f3`-to-next-`0x55f1` gaps divide between the two `0x52ebd0`
  flag bytes and the next record’s `u16 + byte` prelude.
  The widened prelude correlation narrows that again on grounded `q.gms`: the `0x03` post-profile
  gap class now collapses cleanly to the next-record prelude `0x0001 / 0xff` across `17/17` rows,
  while the zero-length class is a separate `0x0055 / 0x00` outlier across `18/18` rows and the
  `0x06` class is the only large mixed frontier left. So the next infrastructure pass should focus
  on classifying the mixed `0x06` rows instead of re-proving the pure-prelude `0x03` class.
  The child loader family is explicit now too: local `.rdata` at `0x005cfd00` proves the
  `Infrastructure` child vtable uses the shared tagged callback strip directly, with
  `+0x40 = 0x00455fc0`, `+0x48 = 0x00455870`, and `+0x4c = 0x00455930`. So the remaining
  infrastructure problem is row-to-record mapping inside the `0x38a5` stream, not identifying the
  per-child loader family.
  The smaller attach helper `0x00490a3c` is now bounded too: it conditionally allocates one
  `Infrastructure` child from a caller-supplied payload stem, attaches it to the current owner, and
  then seeds three caller-supplied position lanes through `0x00539530` and `0x0053a5b0`. The
  direct disassembly now makes that strip more concrete than the earlier structural note alone:
  `0x0048a1e0` really does clone the first child through paired triplet readers
  `0x0052e880/0x0052e720`, destroys the prior child through vtable slot `+0x18(0)`, allocates the
  new `0x23a` object, seeds it through `0x00455b70` with literal payload seed `0x005c87a8`, and
  then republishes the two sampled triplet bands through `0x0052e8b0` and `0x00530720` after
  attaching through `0x005395d0`. The non-clone branch still seeds the same literal
  `Infrastructure` child but attaches through `0x0053a5d0` instead. That means the next unknown is
  no longer whether this strip owns the child/rebuild seam at all, but which exact `0x38a5` rows
  or compact-prefix regimes map to the child count, saved primary-child ordinal, and per-child
  `+0x40` payload callbacks inside that direct load path, and which restored child fields still
  retain those embedded name-pair semantics before the later route/local-runtime family runs.
  The
  remaining closure target above the grounded `0x38a5` side-buffer seam is therefore narrower now:
  the next safe static pass should start at this exact attach/rebuild strip, not at the whole
  placed-structure family. The key open questions are whether the compact-prefix/name-pair groups
  feed the first-child triplet clone lane, the caller-supplied payload-stem lane, or only the
  later route/local-runtime follow-on family; whether cached primary-child slot `[this+0x248]`
  becomes the first owner-visible bridge between those side-buffer groups and route-entry rebuild;
  and which child fields or grouped rows absorb the side-buffer payload before
  `0x00448a70/0x00493660/0x0048b660` become relevant. That keeps the top-ranked next mapping target
  explicit as `0x0048a1e0`, `0x0048dd50`, and `0x00490a3c`, with the serializer/load companions and
  route/local-runtime follow-ons staying secondary until one concrete child-consumer bridge is
  grounded.
  The
  direct route-entry side of the same family is no longer anonymous either: `0x0048e140`,
  `0x0048e160`, and `0x0048e180` are the three direct resolvers over owner fields
  `[this+0x206/+0x20a/+0x20e]` into the live route-entry collection `0x006cfca8`. Another shared
  sibling family is tight enough now too: the real
  packed-byte-triplet owner is `0x0052e680`, and the two local
  wrappers `0x00455820` and `0x00455840` both force its recursion flag on. `0x00455820` forwards
  three explicit byte arguments, while `0x00455840` unpacks one packed `u24`-style dword into
  three byte lanes first. The downstream setter writes packed byte-triplet lane `[this+0x43]`,
  defaults that lane to `0x007f7f7f` when all three bytes are zero, and when recursion is enabled
  it walks child list `[this+0x75]` through `0x00556ef0/0x00556f00` and re-applies the same packed
  update recursively to every child. The shared formatter thunk `0x00455860` is no longer a blind
  jump target either: `0x00530820` now reads as the common group-selection status-label formatter
  over the same `0x23a` family. It only answers when shell gate `[0x006d4024+0x1146be]` is live,
  state bit `0x10` is clear, vtable slot `+0x14` says the current object should answer, and the
  owned-entry bit propagator `0x005305c0` succeeds. Under that gate it formats one caller-owned
  text buffer from either a fixed fallback block, a simple mode-`1` `X` or index form, or a
  grouped-table form built from the current `0x45`-byte subrecord's float lane plus current index
  `[this+0x21]`. The sibling `Infrastructure` table `0x005cfd00` also still carries three tiny
  fixed-return slots after that shared formatter path: two return literal `0x46`, and one returns
  fixed float `1.25f`, so those slots are now bounded as small table constants rather than as
  missing behavior. One nearby global helper family is bounded enough too: `0x005309d0` lazily
  clears and arms the indexed table rooted at `0x00ccb880`, `0x00530a00` services or releases one
  slot in that table according to its local state dword, `0x00530b70/0x00530b90/0x00530c10` query
  one slot's primary handle metric, primary handle, and payload-length lanes, and `0x00530ba0`
  performs the release-side cleanup for one slot's owned buffers. Current callers are broad
  enough that the table's exact resource type still stays open, but the init/service/query/cleanup
  split is now grounded. The broader bundle or stream slot layer under that same table is bounded
  now too: `0x00530c80` is the common open-or-reuse entry for named slots, `0x00531030` and
  `0x00531150` are the shared write and read byte pumps, `0x00531340` and `0x00531360` are the
  four-byte tagged-header wrappers used all over map, setup, world, and runtime bundle code, and
  `0x00531380/0x00531410` are the shared variable-length heap-string load/save helpers built on
  top of those byte pumps. The immediate neighbors are bounded too: `0x00531490` writes one raw
  NUL-terminated string without the length prefix, `0x005314b0` is a callback-driven selector over
  global `0x00ccba08`, and `0x00531500` is the small override-active gate for the neighboring audio
  owner family: it only returns true when `[this+0x04] == 1` and global `0x00ccb9f4` is nonzero.
  That gate is no longer owner-unknown either, because `0x00531a10` raises it before the shutdown
  or fade loop and clears it again on exit, while most of the adjacent wrappers require the inverse
  state `0x00ccb9f4 == 0`. The next adjacent strip is now bounded
  as one audio-service gate strip rather than anonymous wrappers: `0x00531520..0x005317b0`
  mostly share the inverse gate `[this+0x04] == 1 && 0x00ccb9f4 == 0`, then forward into one of
  three global owners `0x00ccba00`, `0x00ccb9f8`, or `0x00ccb9fc`. The clearest member of that
  strip is still `0x005315c0`, a plain 3x4 affine point transform over three caller-supplied
  float pointers, but the adjacent wrappers are tighter now too: `0x00531520` now clearly gates
  the primary owner `0x00ccba00` through status-code predicates `0x00557c90/0x00557cb0` and then
  clears the current handle through `0x00557cd0`, which unregisters it from global slot table
  `0x00d973b8` and optionally notifies callback `0x00d973e0`; `0x00531620` queries the current
  selected Miles 3D provider-name pointer or fixed fallback pointer `0x00ccba0c`;
  `0x00531640/0x005316d0` query the selected Miles 3D provider index and preferred-flag by
  callback-selected provider name;
  `0x00531710/0x00531730` forward listener position and orientation into the Miles 3D service;
  `0x00531750/0x00531770` set and query the active Miles 3D speaker type; `0x00531790` forwards
  keyed non-3D sample-volume refresh; and `0x005317b0` selects keyed sample-record release across
  the non-3D and Miles 3D owners. The next
  adjacent owner strip is bounded enough now too: `0x00531800/0x00531840` are the null-`0x00ccb9f4`
  guarded wrappers that mark pending flag `0x100` on keyed non-3D and Miles 3D sample records
  through `0x0056ae80(0x00ccb9f8)` and `0x00569cf0(0x00ccb9fc)` with scoped reentrancy counter
  `0x00ccb9f0`; `0x00531880` releases optional handle `[this+0x4c]` through
  two function-pointer calls when global `0x00624d58 == 1`; `0x005318b0` spin-waits for that same
  reentrancy counter to drain; `0x005318c0` picks between owners `0x00ccb9f8` and `0x00ccb9fc`
  from global selector `0x00ccba04`; and `0x005318f0` is the shared constructor that allocates
  and initializes globals `0x00ccb9f8`, `0x00ccb9fc`, and `0x00ccba00`, then arms mode flag
  `[this+0x04] = 1` when all three are live. The next owner block is no longer just a loose
  cluster either: `0x00531a10` is the full teardown path for that same family, first raising
  `0x00ccb9f4`, optionally fading scalar lanes `[0x00ccba00+0x104]` and `[0x00ccb9fc+0x58]`
  through `0x00557d90/0x00569ae0/0x00569ca0` plus a `0x10`-tick sleep, then spin-waiting on
  `0x005318b0`, releasing optional handle `[this+0x4c]`, shutting the three globals down, and
  clearing `[this+0x04]` again. `0x00531c00` is the symmetric rebuild side: it force-calls
  `0x00531a10(this,1)`, reconstructs the family through `0x005318f0`, and seeds the default live
  state through `0x005696b0`, `0x00569660`, `0x00557d90`, `0x0056a8e0`, and `0x00569ae0` from
  shell-owned scalars. The smaller strip between them is bounded structurally too: `0x00531d30`
  refreshes the primary scalar and dispatches `0x00557e50`; `0x00531dc0` is the dual-scalar idle
  predicate over `[0x00ccb9f8+0x20]` and `[0x00ccb9fc+0x58]`; `0x00531e50` is the string-driven
  sibling of `0x00531e10`, tail-jumping into `0x0056a520` when the same family is ready; `0x00531e90`
  stages one 16-dword local payload block into `[this+0x08..+0x44]` and forces
  `[0x00ccb9fc+0x60] = 2`; `0x00531ed0` and `0x00531ef0` are the small active-mode field and
  selected-hash-root queries; `0x00531f40` services `0x00ccb9f8/0x00ccb9fc` and clears staged flag
  `[this+0x48]`; `0x00531f90` registers one of the guarded callbacks `0x00531800/0x00531840`; and
  `0x00531fd0` is the timed primary-scalar transition service that coordinates `0x00ccba00` with
  globals `0x00624d58/0x00624d60` under the same reentrancy counter `0x00ccb9f0`. The local
  controller layer above that family is bounded now too: `0x00532150/0x00532200` are the
  construct/destruct pair for the controller object itself, `0x00532230` rebuilds from one
  callback-selected entry through `0x005314b0 -> 0x00531c00`, and `0x00532260` rebinds primary
  handle `[this+0x4c]` while registering transition callback `0x00531fd0` and seeding selector
  `[this+0x50]`. The subordinate Miles 3D provider strip under those owners is now grounded too:
  `0x00569400` enumerates providers into the global `0x00d97bc0` table and marks only the names
  `Miles`, `Dolby`, and `RAD` as preferred, `0x005694f0` resolves one enumerated entry by name,
  `0x00569380` opens the selected provider, caches room-type capability in `0x00625c7c`, tests
  speaker-type support, and seeds fixed distance factor `0x3e806d98`, `0x00569540/0x005695d0`
  are the setter/getter for global speaker-type selection `0x00625c78`, `0x00569660` and
  `0x005696b0` lazily open the listener and push the live position/orientation basis through
  `_AIL_set_3D_position` and `_AIL_set_3D_orientation`, `0x00569720/0x00569730` expose the
  selected provider's name pointer and preferred-flag field, `0x00569830` tries the fixed
  fallback order `Creative Labs EAX (TM)`, `DirectSound3D 7+ Software - Pan and Volume`,
  `Miles Fast 2D Positional Audio`, then `Miles`, and `0x005698a0` is the broader bootstrap owner
  that enumerates, binds the requested or fallback provider, and allocates the local provider-side
  state tables only when a live Miles 3D provider actually comes up. The next local seam is
  grounded too: `0x00569990` allocates the current-provider 3D sample-handle pool, building the
  free-pool hash at `[this+0x04]`, the active-list owner at `[this+0x08]`, and one `0x5c`-byte
  record slab for up to `0x20` sample handles; `0x00569750` pops the oldest live sample record
  from the active list and refreshes global serial `0x00625c80`; `0x005697d0` returns tracked
  sample handles to the free pool or releases untracked ones directly; `0x00569d20` tears the
  local free-pool and active-list tables down; and `0x00569d90` is the broader shutdown side that
  drains the live sample state, closes the listener, releases the pool tables, restores the
  room-based speaker type when needed, and finally closes the provider. The last clean local edge
  in that sample branch is `0x00569ea0`, which explicitly drains every tracked sample handle
  through `_AIL_release_3D_sample_handle` and then clears the pool count and table fields. The
  next broader service layer is now bounded too: `0x00569f30` is the sample-command dispatcher over
  request types `0..8`, combining the local record helpers with the Miles sample controls for
  volume, stop/resume, position, distances, effects level, occlusion, playback rate, and the
  orientation-side call at `0x001c83f8`; `0x0056a330` is the acquire-or-evict owner that either
  recycles one free sample record or reclaims a lower-priority live one; `0x0056a520` is the
  configure-and-optionally-start owner that binds the file payload, loop count, world position,
  range scalars, callback, and initial playback state; and `0x0056a6e0` is the clean constructor
  that seeds the sample-service object defaults before the later destructor-side tail at
  `0x0056a740+`. The adjacent non-3D Miles sibling is now bounded too: `0x0056a770` opens the
  digital driver and seeds the keyed owner table, `0x0056a7c0` allocates the non-3D sample-handle
  pool and record tables, `0x0056a880` resets the active-sample registry, `0x0056a8e0` updates
  the non-3D master scalar and refreshes active samples, `0x0056a970` is the non-3D sample-record
  dispatcher over release, volume, stop/resume, pan, playback-rate, and deferred-start paths,
  `0x0056abe0` is the small pool acquire helper with optional payload attach, `0x0056ad20` is the
  configure-and-optionally-start owner for one non-3D sample record, `0x0056acd0` is the keyed
  volume-level refresh helper,
  `0x0056ae30` dispatches selector `3` over the active registry, `0x0056ae80` marks pending flag
  `0x100` by key, `0x0056aeb0` closes the digital driver, and `0x0056aee0/0x0056af20` are the
  constructor/destructor pair for that sibling service object. One other sibling table is no longer
  anonymous either: local `.rdata` at `0x005c9a28` is the actual world-region record-family vtable
  root, while the smaller collection table at `0x005c9ae0` is the live region manager stored at
  `0x0062bae0`. The same root now also resolves the restore-side virtual strip precisely:
  `0x0041f5c0` is slot `+0x40`, `0x0041f650` is slot `+0x44`, `0x00455870` is slot `+0x48`, and
  `0x00455930` is slot `+0x4c`.
  Constructor-side evidence is the anchor here. `0x00421660` allocates one `0x389`-sized region
  row, resolves the new record, and forwards into `0x00421200`, which seeds region id
  `[region+0x23a]`, class `[region+0x23e]`, profile collection `[region+0x37f]`, name buffer
  `[region+0x356]`, shell gate `[region+0x385]`, and the default `Marker09` stem before re-entering
  `world_region_rebuild_profile_collection_and_seed_class_split_default_weights` `0x00420ed0`.
  The small manager-side constructor `0x00421430` is the matching `0x0062bae0` collection owner.
  That family split also makes the behavioral overrides read cleanly: `0x0041f680` first refreshes
  the current global preview/helper owner through `0x00455de0` and then forwards mode `1` plus
  region id or preview handle `[region+0x23a]` into `0x004cf830`; `0x0041f720` formats
  `[region+0x356]`, publishes the resulting shell text, and conditionally enters preview mode
  through `world_switch_preview_or_tool_mode_and_seed_parameter_block` `0x00452fa0` with action
  `0x12` when world state `[0x0062c120+0x2175]` is `0` or `0x15`; `0x0041f7b0` publishes one
  fixed shell payload and only then clears that preview path through
  `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510` when the same
  world state is `0x12`. The same table also has a tighter adjacent helper strip now:
  `0x0041f6a0` is the direct `[region+0x37f] -> 0x00517cf0` profile-slot-count query,
  `0x0041f6b0` is the rounded normalized-coordinate
  world-scalar query above `0x0044afa0`, and that deeper helper is no longer opaque: it first
  computes one distance-like term from the current cell to global preview-anchor fields
  `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`, samples the
  companion float raster `[world+0x1605]` at the current cell plus two 8-direction rings, keeps
  the strongest local rise above the center sample, adds one thresholded preview-scalar bias from
  `[0x0062be68+0x20]`, and then adds `0x32` more when the small global gate `0x0041fff0` passes.
  That gate itself now reads as a shared shell/preview threshold test: it returns true when
  `[0x006cec74+0x2bb] == 2`, or when the same mode dword is merely nonzero and preview scalar
  `[0x0062be68+0x20]` exceeds the float threshold at `0x005c9a9c`. `0x0041f6e0` resolves the
  current center world-grid cell and checks one packed `u16` token through `0x0042b2d0`, and
  `0x0041f6f0` is the raw byte getter over `[this+0x42]`. One nearby mode-gated flag reader is
  bounded too: `0x0041f910` returns
  literal `1` when shell mode gate `0x004338c0` is inactive or the object class dword
  `[this+0x23e]` is nonzero, and only on the class-0 path does it return the same byte
  `[this+0x42]`. That gate itself is tighter now too: `0x004338c0` is just the normalized boolean
  wrapper over `0x004d4150`, which returns nonzero when the shell-side owner field at `0x006d07b4`
  is live. The release side under that same sibling family is bounded too: `0x00420650`
  lazily seeds `[this+0x317]` from shell-profile word `[0x006cec78+0x0d]` before re-entering
  `0x00420350`, and that body is now bounded as the local scalar refresh over `[this+0x31b]`:
  it compares the seeded word against the current shell-profile word, maps the delta through one
  bounded piecewise float curve, and applies one extra affine adjustment when `[this+0x23e]` is
  nonzero. The current split is tighter now: zero seed yields `1.0f`, deltas `0..2` rise above the
  base through the `(3-delta)` branch, deltas `3..5` stay flat at `1.0f`, and deltas `6+` taper
  back down through the scaled `(delta-6)` path after clamping at `0x14`. `0x00420670` then frees
  the optional dynamic payload at
  `[this+0x37f]`, clears the cached `u16` link chain through `0x0041f8d0`, and tails into base
  cleanup `0x00455d20`; and the small collection-side wrapper `0x00421700` simply resolves one
  entry id, re-enters `0x00420670`, and erases that id from the owning collection. The
  city-entry family also now has one tighter
  helper-object branch. `0x00474030`
  switches over mode enum `0..10`, maps those cases into `0x00475ed0` with selector families
  `4/0xd/0xe` and fixed scalar presets `0.5/0.75/1.0/1.5/2.0`, and on success publishes the
  caller-supplied world triplet through `[helper+0x4]`. The refresh helper `0x00474260` first
  reloads payload through `0x00455fc0`, then samples the current normalized coordinates plus one
  world-height scalar from `0x00448bd0`, and rebuilds `[this+0x23a]` through that same
  mode-selected helper builder using mode `[this+0x242]`. The surrounding collection-side and
  teardown helpers are tight enough now too. `0x004743d0` and `0x00474400` are the two release
  siblings over the same helper field `[this+0x23a]`: both destroy that helper through `0x00475100`
  when live and clear the field, but `0x004743d0` tails into the smaller base cleanup
  `0x00455650`, while `0x00474400` tails into the heavier dynamic-payload cleanup `0x00455d20`.
  The small predicate `0x00474430` simply returns `1` unless shell mode gate `0x004338c0` is
  active, in which case it returns byte `[this+0x42]`; the mode-gated query itself is now bounded
  as one runtime enable byte on that local object family. One level higher, `0x00474450` constructs
  the collection rooted at vtable `0x005ce4a8` with fixed parameters `(0,0,0,0x14,0x0a,0,0)`, and
  bootstrap caller `0x004487a9` stores that collection into global `0x006cea50`. The collection's
  entry path is also bounded now: `0x004744a0` seeds a stack-local temporary entry through
  `0x00474110`, allocates one `0x250`-byte live record, resolves it, constructs it through
  `0x00474130`, and then tears the temporary entry down through `0x004743d0`; `0x00474510`
  resolves one entry id, releases it through `0x00474400`, and removes it from the collection. The
  collection-owned load loop at `0x00474540` now has a direct save-side companion too:
  `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610` opens the
  same `0x61a9/0x61aa/0x61ab` bracket through `0x00531340`, forwards collection metadata through
  `0x00517d90`, and dispatches each record through vtable slot `+0x44`. The refresh side binds the
  selected path context, iterates the current collection, dispatches each record through vtable
  slot `+0x40`, accumulates the returned byte counts, and tears down the temporary entry after each
  record. That still leaves broader semantic questions open, but the current static edges around the
  city-entry family are now largely exhausted. The adjacent scaffolding is bounded too.
  Base helper `0x00455b20` initializes the shared `0x23a`-sized record family by installing base
  vtable `0x005cb1c0`, clearing the scalar bands `[+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroing
  the seven-dword block `[+0x212..+0x22a]`, and re-entering `0x0052ecd0`; that is why it shows up
  not only in the city-entry temporary constructor `0x00474110`, but also in several later object
  construction paths outside the city family. The city collection itself now has a bounded teardown
  side too: `0x00474480` is the small release-and-free wrapper for the collection rooted at
  `0x005ce4a8`, and teardown caller `0x004492c3` uses it before freeing the global collection
  pointer at `0x006cea50`. On the save side, `0x00445713`'s broader package branch re-enters
  `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610` on that same
  global `0x006cea50` collection. Outside the
  city-specific branch, the two tiny dispatch wrappers `0x00455a40` and `0x00455a50` are also now
  bounded as raw vtable-slot helpers: the first jumps through entry slot `+0x44`, while the second
  pushes one caller argument into slot `+0x40` and then clears the global roots
  `0x006acd38/0x006acd3c/0x006acd40`. Finally, `0x00455a70` is now bounded as the generic
  current-position triplet publisher that queries `0x0052e720`, converts through
  `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds a caller-supplied height bias, optionally rounds
  under `0x00434050`, and publishes through `0x00530720`. The temporary-entry constructor and live
  entry constructor are bounded now too. `0x00474110` is the tiny stack-local initializer: it
  re-enters shared base init `0x00455b20`, clears helper fields `[+0x23a]` and `[+0x242]`,
  installs vtable `0x005ce428`, and returns. `0x00474130` is the real live-entry constructor: it
  stores the entry id into `[+0x23e]`, clears the trailing helper payload block `[+0x246..+0x24e]`,
  stores mode `[+0x242]`, derives one world-height scalar from the supplied coordinate pair through
  `0x00448bd0`, builds helper field `[+0x23a]` through `0x00474030`, and then seeds the remaining
  default scalar or flag tuple through `0x00455b70` using the fixed defaults at
  `0x005ce49c/0x005ce4a0/0x005ce4a4`. That broader helper is no longer city-specific either:
  `0x00455b70` is now bounded as the shared scalar-band initializer that clears the same
  `[+0x206/+0x20a/+0x20e/+0x22e/+0x232]` family, optionally copies up to three caller-supplied
  strings into `[+0x206/+0x20a/+0x20e]`, synthesizes one default local token buffer when the middle
  string is absent, chooses one effective mode string from the third or first input, derives one
  owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and
  then seeds the remaining scalar band through `0x0052edf0` and `0x0052e670`.
  The same specialization also now has one tighter UI-facing side. The override trio
  `0x0040e4e0`, `0x0040e880`, and `0x0040e9d0` all sit in the same `0x005c8c50` table and reuse
  the linked-site-capable vtable `+0x70` latch together with creation-mode byte `[this+0x3d4]`.
  `0x0040e4e0` is the strongest current owner for contextual status text: it branches across
  linked-peer checks, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current
  owner state, and candidate or linked-peer display labels, then formats localized ids such as
  `0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd` before pushing the result through
  shell presenter `0x00538c70`. `0x0040e880` pairs with that publisher on the action side: it
  first resets the same presenter through the fixed token at `0x005c87a8`, then dispatches several
  world-side follow-ons through `0x00413620`,
  `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`,
  `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active` `0x00452db0`,
  and `world_switch_preview_or_tool_mode_and_seed_parameter_block` `0x00452fa0` under the same
  linked-peer and world-mode gates. `0x0040e9d0` is the narrower query-style formatter:
  when shell branch `[0x006cec74+0x74]` is live it formats one localized label with the fixed
  suffix `\nAbsIndex %d`, otherwise it can return one company-side owner label through
  `0x00426b10`, and only then falls back to `0x00455860`. So the current best read is that this
  concrete specialization owns both the ambient or animation transient family and one linked-peer
  status or action UI surface, without yet proving the user-facing subtype name.
  One smaller subtype hook cluster is tighter now too. The concrete table also carries
  `0x0040d170` and `0x0040d1b0`, both of which resolve the current candidate through cached stem id
  `[this+0x3cc]` and then test candidate dword `[candidate+0x4b]`. When that flag is nonzero,
  `0x0040d170` tail-calls the primary transient builder `0x0045c310` and `0x0040d1b0` tail-calls
  the matching release path `0x0045c3c0`. The same neighborhood now also gives direct cached-record
  resolvers instead of more anonymous pointer math: `0x0040d1f0` returns the linked peer from
  `[this+0x2a8]` through `0x006cec20`, while `0x0040d210` returns the owner-side record from
  `[this+0x276]` through `0x0062be10`. That makes the specialization-side ownership split cleaner:
  the `0x005c8c50` family is not only formatting labels and driving side effects, it also has a
  direct candidate-flag hook for building or dropping the primary transient handle.
  The last lower side reads are tighter now too. `0x0040e450` first seeds the projected-slot cache
  through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470` before it re-enters
  `0x00418a60`, and the broader stem-based builder at `0x00418be0` now has one named optional side
  renderer instead of an anonymous callsite:
  `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`.
  The side refresh split is bounded now too. `0x0040ee10` publishes one local position or scalar
  triplet through the shared setter `0x00530720`, then tails into
  `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`;
  that smaller follow-on only runs on the current subtype-`1`, class-`3`, linked-site branch, and
  recomputes one local-runtime triplet from the linked peer's route-entry anchor when that anchor
  is still live. The heavier sibling above that side refresh is bounded now too:
  `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` is the
  world-coordinate mutation helper that recomputes `[site+0x388]` and `[site+0x38c]`, rewrites the
  world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`, updates the subtype-`4`
  proximity-bucket family when needed, rebuilds the same local position or scalar triplet, and
  then tails into the linked-site anchor follow-on at `0x0040e360`. One later caller into that
  same side-refresh family is bounded now too: `0x00419110` clamps a caller rectangle to the live
  world bounds, resolves one per-cell bucket chain through the hashed map at `[arg0+0x88]` and
  `0x0053dae0`, and then re-enters `0x0040eba0` for every bucketed site in that rectangle using
  the stored per-entry coordinate pair plus two zero flags. Current grounded caller is the edit-side
  branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations,
  so this now looks like a bucket-map-driven local-runtime side-state refresh wrapper rather than
  another broad site sweep.
  The sibling policy-`1` side is tighter now too. The constructor lane no longer stops at “one
  linked site id at `[site+0x2a8]`”: the subtype-`1` branch in
  `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now clearly
  allocates that linked record through
  `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, whose lower
  constructor is `placed_structure_construct_linked_site_record_from_anchor_and_coords`
  `0x00480210`. That lower constructor seeds the linked record's own id and anchor-site id, clears
  the local route-anchor and display-name fields, projects the anchor footprint into world space,
  and then either binds an already-covered route entry through
  `route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` or
  falls through into the neighboring policy-`1` route-entry synthesis family around `0x00493cf0`
  before rebinding the chosen route entry through `0x0048abc0`.
  The cleanup side is tighter now too. Linked-site removal now has a bounded owner at
  `placed_structure_collection_remove_linked_site_record` `0x004813d0`: it resolves the linked
  record through `0x006cec20`, runs the per-record teardown
  `placed_structure_teardown_linked_site_runtime_state_before_removal` `0x00480590`, removes the
  live entry from the collection, and only then re-enters the still-bounded company-wide follow-on
  at `0x00429c10` when the removed record passed the narrower transit-like latch. That per-record
  teardown is no longer just “clear some scratch fields.” It now clearly clears the route-style
  scratch lane, clears the five proximity buckets at `[site+0x590..0x5b8]`, detaches or invalidates
  the current route-entry anchor, frees the three per-site byte arrays at `[site+0x24..0x2c]`,
  clears this site's indexed byte from the corresponding arrays of later placed-structure records,
  and then re-enters `0x00436040` with the current site id.
  That company-side follow-on is no longer just one opaque callback either. It is now bounded as
  `company_collection_refresh_active_company_linked_transit_site_peer_caches` `0x00429c10`, which
  walks the active company roster and re-enters
  `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` on each company. That per-company
  fast pass stamps a refresh tick at `[company+0x0d3e]`, clears and repopulates the
  placed-structure-side cache cells addressed through `[site+0x5bd][company_id]`, marks the
  eligible linked transit sites for that company, allocates one `0x0d`-stride peer table for each
  eligible site, and fills those peer rows from
  `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks`
  `0x004a6630`. That helper no longer reads as one anonymous route sweep: it either uses the fixed
  pair directly or falls back across tracker endpoint combinations before returning the winning
  route-entry id, one route-step count, and one companion mismatch count. The fast cache now reads
  more cleanly too: peer-record dword `+0x05` stores that step count, while float `+0x09` stores
  the normalized continuity share derived from `(steps - mismatches) / max(steps, 1)`, not a raw
  delta-per-step ratio. The
  adjacent timed wrapper `company_service_linked_transit_site_caches` `0x00409720` now shows the
  cadence too: `0x004093d0` is the shorter-interval refresh, while the older heavier sibling at
  `0x00407bd0` was only revisited on the longer interval.
  That heavier sibling is now bounded too:
  `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` no longer looks like a
  generic tail refresh. It reuses the fast peer tables, rebuilds candidate-local amount bands plus
  normalized issue-opinion scales, and then folds the peer-side route metrics back into three
  per-site cache floats with a cleaner split:
  `+0x12` is the raw surviving site-score total,
  `+0x0e` is the continuity-and-step-weighted companion total,
  and `+0x16` is the promoted final site-ranking lane chosen from the strongest grouped candidate
  bands.
  That also closes most of the cross-version impact question:
  the pre-`1.03` versus `1.03+` tracker metric split now looks like it mainly perturbs the weighted
  `+0x0e` lane and the promoted `+0x16` lane, not the raw `+0x12` total.
  That final lane then feeds the neighboring selectors
  `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280` and
  `company_build_linked_transit_autoroute_entry` `0x00408380`. That makes the company-side follow-on
  read more like a linked-transit autoroute cache family than a generic company maintenance pass.
  The neighboring reachability gate is tighter now too:
  `company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860` caches one company-side
  route-entry anchor, and
  `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`
  uses that anchor to decide whether a foreign linked transit site can still participate in the
  current company's fast peer cache.
  The first direct train-side consumer above that cache family is bounded now too:
  `train_try_append_linked_transit_autoroute_entry` `0x00409770`. After servicing the owning
  company's caches, it asks `0x00408380` for one staged `0x33`-byte route entry using the train's
  current anchor site, then either appends that entry through `0x004b3160` and refreshes the new
  trailing selection through `0x004b2f00`, or rotates one existing slot in place when the local
  two-entry cap has already been reached. So this edge now reaches an actual train-side autoroute
  append lane rather than stopping at anonymous company-side cache cells. The weighted cache lanes
  still do not escape that route-choice family directly: this train-side append path only inherits
  the weighted site and peer choice by calling `0x00408380`, not by reading cache `+0x0e/+0x16`
  itself.
  The train-side follow-on above that seed path is bounded now too. The owning company can count
  its live roster through `company_count_owned_trains` `0x004264c0`, measure one aggregate linked
  transit site pressure through `company_compute_owned_linked_transit_site_score_total`
  `0x00408f70`, and then rebalance that roster through
  `company_balance_linked_transit_train_roster` `0x00409950`.
  The aggregate helper no longer reads as a raw sum either:
  it starts from the site-cache `+0x12` totals, converts that into one tentative roster target
  through year and site-count ladders, and on build `1.03+` adds one special distance-side scaling
  branch when exactly two eligible linked transit sites survive.
  Because it consumes `+0x12` rather than `+0x0e` or `+0x16`, current evidence now says the tracker
  compatibility split is more important for seeded route choice and ranked site choice than for the
  final company train-count target itself. The local linked-transit chain is now bounded enough to
  say that directly: weighted cache lanes feed `0x00408280 -> 0x00408380 -> 0x00409770/0x00409830`,
  while the separate pressure or roster lane feeds `0x00408f70 -> 0x00409950` from raw `+0x12`.
  The balancer then applies two age bands to company-owned trains:
  very old trains are removed when the roster already exceeds target or upgraded when it still
  needs capacity, while the mid-age band can trigger one narrower upgrade pass.
  After that it fills any remaining deficit by either packaging multiplayer opcode `0x75` or
  locally re-entering
  `company_try_add_linked_transit_train_and_publish_news` `0x00409830`. The two visible news
  helpers under it are bounded too: `0x00409830` emits RT3.lng `2896` for a newly added train,
  while `company_publish_train_upgrade_news` `0x00409300` emits RT3.lng `2897` for the upgrade
  branch.
  The subtype-`4` sibling side is bounded now too. The nearby-site bucket family now has:
  `placed_structure_append_nearby_transit_site_distance_bucket_entry` `0x0047fdb0`,
  `placed_structure_remove_site_id_from_proximity_bucket_lists` `0x0047dd10`, and
  `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, plus the two collection sweeps
  `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480` and
  `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0`.
  Current evidence says those five buckets store `(peer site id, distance)` pairs for nearby
  station-or-transit peers, grouped through the five-way classifier at `0x0040d350`. The older
  stream-backed side is bounded too: `placed_structure_collection_load_dynamic_side_buffers_from_stream`
  `0x00481430` walks the live placed-structure collection and re-enters
  `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0`, which repopulates the
  route-entry list, the three per-site byte arrays, the five proximity buckets, and the trailing
  scratch band from the caller-supplied persistence stream.
  The linked-site route-entry list itself is tighter now too. The refresh or teardown branch at
  `0x0040e102` re-enters `placed_structure_remove_route_entry_key_and_compact` `0x0047d810`, which
  removes one matching `u16` key from the six-byte list rooted at `[site+0x462]/[site+0x466]`,
  compacts the surviving entries into a replacement buffer, and decrements the stored route-entry
  count.
  The broader linked-site mutable runtime strip is tighter now too.
  `placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch`
  `0x0047f320` is no longer just a teardown-side stub: it resolves an effective comparison mode
  from the linked candidate class byte `[candidate+0x8c]` unless the caller overrides it, derives
  one radius threshold from current world coordinates `[site+0x4a8/+0x4ac]`, frees the prior
  sampled-cell buffer at `[site+0x34]`, always clears the route-link scratch pair
  `[site+0x462]/[site+0x466]`, and then scans one bounded world-grid rectangle through
  `[0x0062c120+0x2129]` with per-cell distance measured by `0x0051db80`. For accepted cells it
  emits temporary twelve-byte `(grid x, grid y, sampled score)` rows through `0x0042b190`,
  `0x0042c530`, and `0x0042c580`; when caller arg0 is zero it compacts one representative subset
  of those temporary rows into the persistent list at `[site+0x34]/[site+0x38]`, while nonzero
  arg0 callers use the same helper as a clear-and-scan companion without the final materialization
  step. Current grounded callers are the linked-site refresh and teardown strip
  `0x00480542/0x004805c2/0x00480727/0x004807e2`.
  The proximity-bucket rebuild side above that list is tighter now too.
  `placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells`
  `0x0047fef0` first requires the current record to pass the narrower station-or-transit class gate
  `0x0047fd50`, quantizes the current site position through `0x00455800/0x00455810`, walks the
  surrounding live cell window through `[0x0062c120+0x2129]`, follows each cell's linked
  placed-structure chain through word field `[cell+0x0d6]` plus next-id `[peer+0x2a2]`, keeps only
  peers whose resolved candidate subtype byte `[candidate+0x32]` equals `4`, and appends the
  surviving `(peer site id, distance)` pairs into the same five bucket arrays rooted at
  `[site+0x590..+0x5a4]`. So the narrower one-peer append helper `0x0047fdb0` now has a real
  broader owner rather than only collection sweeps.
  The whole linked-site refresh owner is correspondingly clearer now too.
  `placed_structure_refresh_linked_site_runtime_side_buffers_and_route_entry_anchor` `0x00480710`
  first clears the current proximity buckets through `0x0047dcd0`, runs `0x0047f320(1,arg1)`
  against the pre-update state, republishes the current site position into the world-grid owner map
  through `0x0042bbf0/0x0042bbb0`, reruns `0x0047f320(0,-1)` to materialize the current
  sampled-cell list, and then rebuilds the nearby-transit buckets through `0x0047fef0`. After that
  it either reuses a still-valid route-entry anchor through
  `route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` and
  `placed_structure_rebind_route_entry_anchor_to_site_id` `0x0048abc0`, or synthesizes a
  replacement through `0x00493cf0` before rebinding it the same way; when an old anchor survives
  but now points at a different owner, the helper clears the prior `[entry+0x222]` back to `-1`.
  The world-cell owner and route-gather helpers beneath that strip are bounded now too. Word
  `[cell+0xd4]` is the head of one placed-structure owner chain: `0x0042bbb0` prepends the current
  site id into that chain by writing the previous head into `[site+0x3c]` through the tiny setter
  `0x0047d6f0`, while `0x0042bbf0` removes one site id from the same chain by walking the linked
  `[site+0x3c]` next pointers until it can splice the requested site out. The sampled-cell rebuild
  also now has its lower route-gather leaf: `0x0042c530` walks one world cell's linked-site chain
  from word `[cell+0xd6]` through next-id `[site+0x2a2]` and appends each visited site id plus the
  caller payload into the six-byte route-entry list helper `0x0042b190`. That same compact list now
  has its two local companions bounded too: `0x0042b230` removes one row by leading `u16` key, and
  `0x0042b2d0` is the shared contains-key predicate over the same `[...+0xeb]/[...+0xef]` list.
  The neighboring `[cell+0xd6]` linked-site chain is bounded now too. `0x0042c9a0` prepends one
  site id into that chain by writing the previous head into `[site+0x2a2]` through the tiny setter
  `0x0040cb00`, storing the new head back into `[cell+0xd6]`, and then re-entering the paired
  rebuild helpers `0x0042c690` and `0x0042c8f0`. `0x0042c9f0` is the remove companion over the
  same chain: it walks the linked `[site+0x2a2]` next pointers until it can splice the requested
  site id out of the `[cell+0xd6]` head chain, then reruns the same two rebuild helpers.
  The two remaining numeric leaves under this strip are bounded now too. `0x0042c580` accumulates
  the directional word fan from `[cell+0xf3 + dir*2]` while stepping toward one caller-supplied
  grid target through the fixed offset tables at `0x00624b28/0x00624b48`, and that is the floating
  sampled-score source later stored by `0x0047f320`. `0x0042c960` is the shared rounded
  issue-opinion-scaled word-lane query: it multiplies one local word lane `[this+index*2] << 4`
  against the scenario-side scale returned by `0x00437d20(index)` and rounds the result through
  `0x005a10d0`.
  The broader company-side owner above these pieces is tighter now too. The periodic service pass
  `company_service_periodic_city_connection_finance_and_linked_transit_lanes` `0x004019e0` now
  reads as the current outer owner for this branch: it sequences the city-connection announcement
  lanes, the linked-transit train-roster balancer, the acquisition-side sibling
  `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`, the annual finance-policy helper
  `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, and the shorter-versus-
  longer linked-transit cache refresh tail through `0x004093d0` and `0x00407bd0`. That outer pass
  also has one tighter temporary-state role now: it clears company bytes `0x0d17/0x0d18/0x0d56`,
  mirrors `0x0d17` into scenario field `0x006cec78+0x4c74` only while the earlier route-building
  side runs, and restores the original scenario value on exit. Current evidence now ties `0x0d17`
  to the shared preferred-locomotive chooser `0x004078a0`: the override is only armed when that
  helper picks one locomotive whose engine-type dword is `2`. That engine-type lane now best reads
  as electric rather than an unnamed class slot, because the linked approval helper around
  `0x0041d550` now reads as a real locomotive-era and engine-type policy gate, dispatching the same
  `0/1/2` field across three scenario-opinion lanes while the local player-facing engine-type
  family is explicitly `Steam / Diesel / Electric`. That same gate also now ties the later scenario
  bytes `0x4c97..0x4c99` back to the editor-side `Locomotives` page rather than treating them as
  anonymous availability flags: they are the live `All Steam Locos Avail.`, `All Diesel Locos
  Avail.`, and `All Electric Locos Avail.` policy bytes behind `0x004cd680` / `0x004cf0d0`. The
  current logic is also tighter than a plain override tier: a positive engine-family opinion result
  can carry the gate by itself only while none of those three editor bytes is enabled; once any of
  them is nonzero, `0x0041d550` instead requires one matching intersection between the record-local
  family bytes and the enabled editor family bytes. The `WhaleL` carveout is narrower now too:
  current data-file correlation ties that stem to the `Orca NX462` / `WhaleL_NE` locomotive family,
  and it explicitly zeros that positive-opinion result before the later family-availability checks,
  so it loses the shortcut rather than gaining a special approval path. The same
  chooser now also has a bounded fallback below it, `locomotive_collection_select_best_era_matched_non_electric_fallback_id`
  `0x00461cd0`, which explicitly skips engine-type `2` and chooses the lowest-penalty remaining
  locomotive by era mismatch and approval gates. The route-search side is tighter too: this
  electric-only override now clearly feeds the first path-sweep branch in `0x0049bd40`, forcing the
  larger `1.8` initial quality multiplier instead of `1.4`, which is the same branch otherwise
  chosen by explicit route-policy byte `4`. The neighboring `0x00442a40..0x00442ae1` helper strip
  is tighter now too: it is not generic issue math, it is the forward and inverse mapper between
  two compact locomotive engine-family index spaces and the raw issue bands `0x0f1..0x15f /
  0x1c9..0x1da` plus `0x160..0x1c4 / 0x1db..0x1f6`, and the same strip is reused by both the
  stream save/load pair `0x0042ddd0/0x00430feb` and the shell-side issue-row resolvers
  `0x00462449/0x004624ae` over the fixed table at `0x00610398`. So the later annual finance helper is reading
  same-cycle side-channel state from the earlier city-connection and linked-transit branches, not
  unrelated long-lived finance fields. The inner
  finance helper is not debt-only either. Current grounded outcomes include bankruptcy news
  `2881`, the debt restructure family `2882..2886`, a later share-repurchase headline `2887`, and
  the dividend-side adjustment branch. The main commit verbs under that helper are now grounded too:
  `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`,
  `company_issue_bond_and_record_terms` `0x004275c0`,
  `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and
  `company_issue_public_shares_and_raise_capital` `0x00427450`. The threshold side is tighter now
  too. The earliest creditor-pressure lane requires scenario mode `0x0c`, the bankruptcy toggle
  `[0x006cec78+0x4a8f]` to be clear, at least `13` years since `[company+0x163]`, and at least
  `4` years since founding year `[company+0x157]`; it then scans the last three years of the
  derived net-profits and revenue lanes `0x2b` and `0x2c`, chooses one negative pressure ladder
  `-600000 / -1100000 / -1600000 /
  -2000000` from the current slot-`0x2c` bands around `120000 / 230000 / 340000`, requires the
  broader support-adjusted share-price or public-support scalar at least `15` or `20` depending on
  whether all three sampled years failed, checks the current fuel-cost lane in slot `0x09` against
  `0.08` times that ladder, and requires the
  three-year slot-`0x2b` total to clear one final `-60000` gate before it falls into the
  bankruptcy commit and RT3.lng `2881` headline.
  The middle debt-capital layer is split more clearly now too. With `[+0x4a8b]` clear, one annual
  bond lane first simulates full repayment through `company_repay_bond_slot_and_compact_debt_table`
  and then uses the post-repayment cash window with fixed `-250000` and `-30000` thresholds plus
  the broader linked-transit train-service latch `[company+0x0d56]` to decide whether to append one
  or more `500000` principal, `30`-year bonds. The repurchase lane is separate again: when the
  city-connection announcement-side latch `[company+0x0d18]` is set, growth setting `2` does not
  suppress it, and `[+0x4a87]` is clear, it starts from one `1000`-share batch, can replace its
  default `1.0` factor with one linked-chairman personality scalar, scales that by `1.6` when
  growth setting `1` is active, and then runs one `800000` stock-value gate plus one
  support-adjusted-share-price-times-factor-times-`1000`-times-`1.2` affordability gate before the
  repeated `1000`-share buyback commits behind RT3.lng `2887`. The ordering above this helper is
  tighter now too:
  `company_service_periodic_city_connection_finance_and_linked_transit_lanes` clears those latches
  first, runs the city-connection and linked-transit branches, and only then enters the annual
  finance helper, so these look like same-cycle reaction gates rather than long-lived balance-sheet
  flags.
  After the earlier debt or bankruptcy outcomes stay inactive, the later stock-capital lane also
  has a tighter bounded shape now too: it only opens on build `1.03+`, only after the earlier
  bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles
  `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since
  founding. It derives one issue batch from outstanding shares rounded down to `1000`-share lots
  with floor `2000`, trims that batch until the broader support-adjusted share-price scalar times
  batch no longer exceeds the `55000` gate, recomputes the pressured support-adjusted share-price
  scalar and the paired `price/book` ratio, then tests the remaining gates in a fixed order:
  share-price floor `22`, proceeds floor `55000`, current cash from `0x2329/0x0d` against the
  chosen highest-coupon bond principal plus `5000`, one later stock-issue cooldown gate that
  converts the current issue mixed-radix calendar tuple at `[company+0x16b/+0x16f]` through
  `calendar_point_pack_tuple_to_absolute_counter` `0x0051d3c0` and compares the result against the
  active world absolute calendar counter `[world+0x15]`, and only then the coupon-versus-price-to-book
  approval ladder `0.07/1.3 -> 0.14/0.35`. The issue mutator preserves the previous tuple in
  `[company+0x173/+0x177]` and refreshes the current tuple from `[world+0x0d/+0x11]` on the
  derived-pricing lane. On success it issues two
  same-sized tranches through repeated `company_issue_public_shares_and_raise_capital` calls and
  publishes a separate equity-offering news family rooted at localized id `4053`, not the earlier
  debt or buyback headline family.
  The dividend side is bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be
  clear, mode `0x0c`, at least `1` year since `[company+0x0d2d]`, and at least `2` years since
  founding, then averages the last three years of the net-profits lane `0x2b`, folds in the
  unassigned-share pool and the current `0x0d` band, applies the map-editor building-growth
  setting `[0x006cec78+0x4c7c]`, treats growth setting `1` as a `0.66` scale-down and setting `2`
  as a zeroing pass on the current dividend, quantizes surviving adjustments in tenths, and
  finally clamps against
  `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`.
  The linked-transit route-seeding side has one tighter sibling now too:
  `company_reset_linked_transit_caches_and_reseed_empty_train_routes` `0x00401940`. It clears the
  two company-side linked-transit cache timestamps, forces one immediate cache rebuild through
  `0x00409720`, strips route lists from company-owned trains in modes `0x0a/0x13`, and then
  re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770` only when a train's
  route list has become empty.
  On the wider chooser question, the current evidence is also tighter than before: every recovered
  external owner of `0x00402cb0` is still in the city-connection family, so the two later direct
  placement lanes currently read as city-connection fallback behavior rather than a broadly shared
  world placement service.
  It can still unwind through route-state cleanup without committing new placed structures, so the
  exact lower helper semantics are not fully closed, but the broader chooser is no longer
  anonymous and its main policy split is now visible. The two lower helpers directly under those
  commit lanes are bounded now too:
  `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840` is the shared
  projected-footprint offset helper over candidate bytes `[candidate+0xb8]` and `[candidate+0xb9]`,
  and `placed_structure_validate_projected_candidate_placement` `0x004197e0` is the shared
  go-or-no-go validator that checks company, territory, world-tile, and footprint occupancy state
  before either direct-placement commit is allowed to fire. Its strongest current subtype branch is
  a station-attachment or upgrade-style lane keyed by `[candidate+0x32] == 1`, which now has the
  concrete failure family `2901..2906`: blocked upgrade footprint, ground not flat enough, not
  your track, insufficient track-laying capacity, cannot connect to existing track, and ground too
  steep. That tightens the chooser materially without yet proving that the validator is
  station-only for every caller.
  The recurring outer owner is tighter now too:
  `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580` walks every
  fourth live placed structure from a scenario-time-derived offset and re-enters the per-site
  rebuild with stack flag `0`, giving the route-style lane a concrete recurring maintenance sweep
  under `simulation_service_periodic_boundary_work` rather than only a floating caller note. One
  neighboring helper is now bounded on the message side too:
  `shell_building_detail_handle_subject_value_row_band_action` `0x004ba270` switches over the
  clicked row family `0x7d07..0x7d14`, treats subject bytes `+0x21/+0x22/+0x23` as one current
  selection plus one bounded low/high pair, increments the family dirty latch at `0x006cfe0c` on
  change, and republishes the refreshed value through the shared shell control helper on code
  `0x66`. One neighboring helper is now bounded on the side-list path too:
  `shell_building_detail_propagate_selected_subject_state_into_side_list` `0x004b9ec0` walks the
  sibling list owner at `0x006cfe08`, copies the active subject state into each side-list record,
  mirrors the current service or capability id at `+0x24`, and preserves the `0x40/0x20/0x10`
  subflags from the active subject. That means the value-row actions and later selector rows now
  read as propagating one shared building-detail state across the sibling list rather than only
  mutating one isolated subject record. One neighboring helper is
  now bounded separately too: `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20`
  owns the mutually exclusive value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and
  `0x7d13/0x7d14`, choosing among them from the same selected-subject flag byte and payload fields
  at `+0x22/+0x23`, while the larger cargo-or-service row owner also gates the extra visual lanes
  `0x7d6a`, `0x7d6b`, and `0x7d9d` from that same subflag family. The asset-string block is tighter
  too: that branch family now explicitly uses `AnyCargo.imb`, `AnyFreight.imb`, `PassMail.imb`,
  `Caboose.imb`, and `Dining.imb`, with the bit-`0x20` special lane already aligned to
  `Caboose.imb` and the sibling bit-`0x10` special lane now aligned to `Dining.imb`. The larger
  `0x7f58..0x801f` band is no longer just a styled row family either:
  `shell_building_detail_present_flagged_service_capability_popup` `0x004b9fd0` is now grounded as
  its explanatory popup callback. It resolves either one fixed express-side row from `0x00621e04`
  or one active candidate or service id from `[subject+0x24]`, then formats one popup through the
  shell message-box path. The neighboring refresh helper `shell_building_detail_refresh_flagged_service_capability_rows`
  `0x004b9a20` is tighter now too: `0x7d07..0x7d1c` is not one anonymous block, but a real mask
  partition over subject bits `0x20` and `0x10`, with one zero-mask pair, one bit-`0x20`-only
  pair, one exclusive-or pair, and later one-bit and two-bit indicator rows. RT3.lng now closes
  the fixed popup text family too: the single-line branch uses
  `3922` `%1\nLoads available at %2: %3`, while the richer ordinary-candidate branch uses
  `2981` `%1\nLoads available at %2: %3     Current Price: %4` and can append
  `2982` `Price at next station, %1: %2 (%3%4)`. The selector band is narrower too: current
  refresh-side evidence shows `0x7f58..0x801f` as one selected-ordinal highlight family over the
  three fixed express rows plus the ordinary active-candidate rows, not as a generic unstructured
  list. The neighboring `0x8020..0x8051` band is tighter too: it is primarily the matching
  remove-entry family for the selected subject's live id list, with two special row indices
  re-routing into the `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction
  when the current `0x20/0x10` service-bit combination demands it. That means the exact captions
  are no longer broadly open across the whole selector family: the fixed express-side rows, the
  mask partitions, and the add/remove structure are grounded, and the remaining caption gap is
  mostly the ordinary candidate rows further down the same band. The top-level toggles are
  tighter now too: the paired
  `0x7d02/0x7d03` controls are the real mode switch over subject bit `0x40`, choosing between the
  bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`, while
  the smaller `0x7d0f/0x7d10` controls flip the same special-service subflags later rendered as
  `Caboose` and `Dining Car`. One adjacent control is tighter now too: the extracted
  `BuildingDetail.win` resource contains the plain-English line `Set the initial cargo amount for
  'Disable Cargo Economy' scenarios.`, and the `0x7d01` plus `0x7d09/0x7d0a` message-side branch
  can mirror the current subject or selection through
  `shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` into the auxiliary
  owner queue at `[0x006cd8d8+0x8f48]`, with side-owner presence now explicitly grounded through
  `shell_has_auxiliary_preview_owner` `0x00434050`. That queued request is tighter too: both
  current callsites forward the same side-list mirror latch at `[0x006cfe08+0x0c]`, so the
  auxiliary owner now clearly sees not just the staged subject but also whether the local
  `BuildingDetail` side-list is in mirrored-subject mode. The same `0x7d01` lane also now has one
  clear rejection note: localized id `3587` `This option is only available by following the
  tutorial.` now sits behind the active tutorial flag at `0x006d3b4c` and the cached previous
  tutorial expected-control id at `0x00622b38`, while the neighboring tutorial helper
  `tutorial_advance_step_and_refresh_expected_control_ids` `0x00516be0` now grounds
  `0x00622b34/0x00622b38/0x00622b3c` as the current and previous expected-control cache rather
  than anonymous globals. The last field is tighter now too: `0x00622b3c` is currently best read
  as the active tutorial step's alternate-accepted companion control id, because the generic shell
  control path compares clicked control ids against it directly and suppresses the `3587` tutorial
  rejection when they match. That does not fully close the player-facing caption bind for every
  control, but it does bound the neighboring side-owner sync and tutorial-rejection lane instead
  of leaving it as anonymous glue.
  The extra pre-insert gate is narrower than it
  first looked. It is now grounded as tutorial-only:
  `tutorial_validate_train_route_station_indicator_step` `0x00516d00` checks the current tutorial
  step from the shell tutorial descriptor table at `0x00622b48` before a live station-or-transit
  site id can be committed into the staged route entry, and the currently accepted steps align with
  localized prompts `3777` and `3778`, the two train-routing tutorial instructions that tell the
  player to click the Milan and Turin station indicators. Outside that tutorial state family, the
  route-entry insertion path is not gated there. The adjacent validator is tighter now too:
  `train_route_list_validate_reachability_and_station_pair` `0x004b2c10` walks that same route list,
  resolves placed-structure-backed entries through the live placed-structure and route-node
  collections, uses the direct route-node payload branch for the remaining entry family, and fails
  with `3089..3091` when the resulting route cannot be traversed or does not preserve a valid
  terminal station pair. The post-validation follow-on is bounded too:
  `train_current_route_context_uses_strict_reachability_mode` `0x004a9460` is now the small shared
  gate above the stricter branch, keyed off the current linked route object's downstream class type,
  and `train_set_route_operating_mode_and_scalar` `0x004ab980` now reads as the shared train mode
  setter beneath route editing, with the local and multiplayer insertion paths choosing mode
  `0x13` only when that stricter second validation succeeds and mode `0x0a` on the looser fallback
  path. The first
  deeper world-mode interaction branch is now better
  bounded: `GameUppermost.win` hotspots, cursor drag, held Shift state, discrete shell view-step
  commands, direct keyboard turn/pan/zoom bindings, the `TrackLay.win` and `StationPlace.win`
  world-command surfaces, and a frame-owned hover or focus-target transition branch all feed the
  same shell-controller-backed path. The remaining uncertainty has moved farther from basic
  ownership only in the per-tool sense: the hover-target branch clearly exists, `0x07d6` now looks
  like the shared
  main-world interaction surface rather than a generic detail button for one tool family only. One
  more shell-side consumer is bounded now too: `0x004bc350` is a world-surface brush handler over
  that same `0x07d6` control plus the adjacent mode family `0x0faa..0x0faf` and ordinal strip
  `0x0fa0..0x0fa7`. That family is no longer just a generic unlabeled brush owner: the
  detail-panel manager now grounds the sibling tool-window strip immediately above it as
  `Bulldoze.win`, `ChangeHeight.win`, `ChangeTrees.win`, `PaintTerrain.win`, `PaintRegion.win`,
  `PaintSound.win`, and `PaintTerritory.win`, each with its own constructor, refresh pass, and
  message owner beneath the same controller rooted at `0x006d0818`. Once its local drag latch is
  active it dispatches the current mode dword at `[0x006d0818+0x8c]` into the companion-float
  helpers `0x0044d4e0`, `0x0044d880`, and `0x0044da70`, or into the secondary-raster nibble path
  `0x00448e20 -> 0x00419110`, so the remaining uncertainty has narrowed from ownership to the
  exact one-to-one mode-button mapping inside that grounded tool-window strip. The
  `PaintTerrain.win` side is tighter now too: constructor `0x004f7ce0` seeds shell singleton
  `0x006d1304`, callback root `0x006d1334`, a constructor-time bulk-update latch at
  `0x006d1330/0x006d1331`, and the broader terrain mode or scalar state from `0x00622748..0x00622788`
  plus `0x006d1308..0x006d1324`; it then registers the callback strip `0x004f5960`,
  `0x004f59f0`, `0x004f6070`, and `0x004f69e0` through `0x00540120`. The direct message owner
  under that same family is no longer just a loose branch fan-out either: `0x004f6f50` owns
  messages `2/0xca/0xcb`, keeps control `0x07d6` as the live world-surface drag latch, routes
  explicit undo control `0x2775` into `0x004f5c30`, maps the selector and mode strips
  `0x2711..0x2730`, `0x27d9..0x27df`, `0x283d..0x2843`, `0x28a1..0x28e6`, `0x2915..0x291e`,
  `0x2964..0x2967`, and `0x29cd..` into the cached terrain lanes, and then fans the active drag
  path into preview helpers `0x004f6930`, `0x004fb5e0`, `0x004fc280`, `0x004fc4d0`, and
  `0x004fc630` depending on the current terrain mode. Inside that same family
  `0x004f5a80/0x004f5c30` are now the bounded local undo snapshot pair, `0x004f5dd0` is the
  tiny active-scalar-group selector, `0x004f6b50` owns the ten-entry mode strip rooted at
  `0x28dd`, `0x004f6390` is the broad mode-panel repaint owner, `0x004f6250` is the
  mode-dependent world-dispatch bridge, `0x004f6930` samples the current preview raster at
  world coordinates, and `0x004fb5e0` is the heavier preview-raster rebuild and shell-surface
  publish worker. The next local helpers under that same family are tighter now too:
  `0x004f5ea0` and `0x004f5ec0` are just the two tiny special-mode predicates
  `(mode 5, variant 2)` and `(mode 4, variant 2)`, `0x004f8770` is the weighted RGB sampler
  over the current preview or undo-backed raster neighborhood, `0x004f89b0` is the local
  byte-grid connected-component grower over the eight-neighbor tables `0x00624b28/0x00624b48`,
  and `0x004f8bb0` is the main drag-path preview compositor that consumes the drag sample strip
  `[this+0xf0/+0xf4/+0xf8]`, allocates temporary float or byte grids, and then rasterizes the
  surviving preview rectangle through the current terrain descriptor tables at `0x005f3500`,
  the weighted color sampler `0x004f8770`, the component grower `0x004f89b0`, and several live
  world samplers before writing final RGBA pixels back into the preview surface. The late tail
  under that same compositor is tighter too: the mode-`4`, variant-`2` path toggles
  secondary-raster byte-2 bit `0x20` by comparing current and previous cells through
  `0x00534f40`; the broader mode-`4/5` world-facing branch samples class set `2/4/5` through
  `0x00534ec0`, re-enters `0x0044de30` and `0x0044df10`, latches pending world coordinates into
  `[0x006d1304+0x78/+0x7c]`, and rewrites the low nibble plus the signed overlay-vector planes
  through `0x00448df0`, `0x00448e20`, `0x00448ec0`, `0x00448ee0`, `0x00448e60`, and
  `0x00448e90`. After the optional mode-`5` smoothing sweep through `0x004f8370`, the publish
  tail either materializes one shell preview surface through `0x0051f090 -> 0x00534730` or, for
  the mode-`4/5` world-facing variants, converts the surviving preview rectangle back into
  world-space bounds and re-enters `0x0044e940`,
  `world_refresh_active_preview_mode_from_four_dword_parameter_block` `0x00452f20`, and
  `0x0044d410`. The companion
  preview-rebuild owner `0x004fb5e0` is tighter on entry, too: `0x004f726c` is the early
  rebuild path that first copies the live preview raster into `[this+0x118]` and snapshots undo
  state through `0x004f5a80`, while `0x004f7ada` is the later drag-active path that first
  allocates a temporary occupancy mask before rebuilding and then conditionally mirrors that
  mask through `world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds`
  `0x00450520` on the world-mode-`0x17` side path. The remaining local lanes can therefore be
  carried conservatively as PaintTerrain per-mode scalar and token bands beneath that already-
  grounded mixed shell/world ownership strip, not as another ownership seam.