Input, Save/Load, and Simulation: Runtime Roots, Camera, and Support Families

Runtime Roots and Cadence

Roots: the shell controller window-message ingress shell_controller_window_message_dispatch at 0x0054e3a0, the shell input-state object initialized at 0x006d4018 through shell_input_state_init 0x0054e710, the saved-world restore path world_load_saved_runtime_state_bundle at 0x00446d40, the live-world save path world_runtime_serialize_smp_bundle at 0x00446240, world_entry_transition_and_runtime_bringup at 0x00443a50, the frame-owned cadence simulation_frame_accumulate_and_step_world at 0x00439140, the recurring GameMessage.win service branch through game_message_window_service_if_present 0x004e0720, the world-facing GameUppermost.win overlay branch ensured by shell_ensure_game_uppermost_window 0x004e0e40 and serviced through game_uppermost_window_service_world_hotspot_band 0x004e0780, and the lower step family rooted at simulation_advance_to_target_calendar_point 0x0040ab50 with periodic branches through simulation_service_periodic_boundary_work 0x0040a590.
Trigger/Cadence: shell-side input is event-driven by controller-window WM_* traffic while save or load work is triggered either directly from shell commands or through the fileopt.win branch flags into the .smp runtime-state family; post-bring-up world service becomes recurring once a world root exists at 0x0062c120, but the current grounded top-level cadence still remains the shell-owned shell_service_pump_iteration path, which calls simulation_frame_accumulate_and_step_world directly and lets it accumulate elapsed wall-clock time into one or more simulation-step quanta. A second ingress is now bounded too: simulation_run_chunked_fast_forward_burst at 0x00437b20 repeatedly calls the same lower stepper simulation_advance_to_target_calendar_point, but current grounded callers put that helper inside the larger post-load generation pipeline world_run_post_load_generation_pipeline at 0x004384d0 under the Seeding Economy... phase rather than under the ordinary player-facing speed buttons. That setup pipeline is now clearer at the progress-banner level too: on the fuller setup path it first runs one preliminary named-candidate availability prepass through 0x00437737 before any visible progress banner is posted. One startup-side selector edge is tighter now too: shell_active_mode_run_profile_startup_and_load_dispatch 0x00438890 reaches an early selector-2 branch at 0x00438a66..0x00438c00 that refreshes one support-family type-7 record from setup path buffer 0x006d1370 through 0x0053d130, strips the basename extension into a local label buffer, briefly drops the nested mouse-cursor hold through 0x0053f310, builds three progress-text payloads, and re-enters the hold through 0x0053f2f0 before the common world-root bring-up continues. After that, localized id 318 Computing Transportation and Pricing... stays visible while the pipeline runs world_compute_transport_and_pricing_grid 0x0044fb70, the early collection-owned staging pass world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect 0x0044e940, structure_candidate_collection_run_post_load_local_service_setup_phase 0x0041ea50, and the conditional region pair world_region_collection_seed_default_regions 0x00421b60 plus world_region_collection_refresh_neighbor_and_profile_bands 0x00420f30. One save-load-side status-stack strip is now tighter too: 0x004422d0/0x00442330 push and pop the low bytes of the same four shell lanes [0x006cec74+0x140/+0x13c/+0x138/+0x144] plus startup byte [0x006cec78+0x4c74] through the local stack 0x0062be90 with depth 0x0062bedc, and the paired wrappers 0x004423a0/0x004423d0 bracket that same band while also servicing the live TrackLay.win and StationPlace.win tool objects through 0x0050e070, 0x00507a50, 0x0050a530, and 0x0050e1e0. The live .smp serializer uses the higher pair, while the neighboring world-entry branch 0x00443a50 and non-.smp package-save tail under shell_map_file_world_bundle_coordinator 0x00445de0 now show the raw split explicitly. 0x00443a50 calls 0x004422d0 at 0x444e2c, services TrackLay.win and StationPlace.win entry-side helpers through 0x444e3b/0x444e4a, then later calls 0x00442330 at 0x444ecb and services the recurring tool frames through 0x444eda/0x444ee9. The package-save tail similarly calls 0x00442330 directly at 0x00445a55 and then services StationPlace.win and TrackLay.win at 0x00445a64/0x00445a73 without re-entering 0x004423d0. So the save/load-side tool choreography is no longer one uniform wrapper path across world-entry, package-save, and .smp branches, and current local evidence does not show 0x00446d40 itself directly re-entering either the raw pair or the higher wrapper pair. world_region_border_overlay_rebuild 0x004882e0. The transport/pricing side is tighter now too: 0x0044fb70 first routes one null-build path through the preview ensure wrapper 0x0044faf0, whose deeper worker 0x0044f840 allocates a default target through 0x00534930, seeds five palette entries through 0x0051de10, maps each target pixel back into the live secondary raster through 0x00533970/0x00533980, uses the low-3-bit class split plus a local +/-4 neighborhood and 0x0051db80 to choose the preview color, and only then re-enters 0x0044e940 on the full rectangle. The later 322 side is tighter now too: the top owner 0x0044d410 rejects while generation counter [world+0x2205] is live or when 0x00449e90 cannot supply a surviving work rect, then forwards that rect into 0x005374d0, 0x00533e70, and 0x00537010, notifies the shell owner at 0x0062be68, and refreshes neighboring region or manager companions through 0x00421f50, 0x00461770, and 0x00415340. 0x00421f50 itself is now bounded as the narrow class-0 side of that refresh: it scans the live region collection for class-0 records whose normalized coordinates fall inside the caller-supplied float rectangle and republishes each surviving region's current-position triplet through 0x00455a70(0). The local companion-float strip under that same owner is tighter now too: 0x0044d4e0 and 0x0044d6e0 are sibling five-pass cross-neighbor relaxers over [world+0x1605]; both clamp the caller rectangle, average the four cardinal neighbors, subtract the current sample, scale the delta by one fixed coefficient and caller gain, and then feed the surviving rectangle back into 0x0044d410. The first helper only checks raster bit 0x01 in [world+0x2135], while the second adds the tighter acceptance gate 0x004499c0 and can skip the final 0x0044d410 tail when its caller disables that refresh. Their center-biased sibling 0x0044d880 is now bounded too: it seeds one baseline from the current center sample when its caller gain is positive, expands one square neighborhood by radius, and raises surrounding cells toward that baseline through the same 0x0051dc00 falloff model before tailing into 0x0044d410. The local peak-oriented sibling 0x0044da70 then raises one clamped square neighborhood by quantized local maxima and on its optional branch also consults 0x00534f00 before keeping the larger peak. So the 0x0044d4e0/0x0044d6e0/0x0044d880/0x0044da70 band now reads as the local companion-float refinement layer immediately beneath the shared Calculating Heights... owner rather than a set of unrelated scalar writes. The default-region side is tighter too: one earlier class-0-only helper 0x0041fb00 now sits directly under that same family too: it skips nonzero [region+0x23e] records, rounds the region center through 0x00455800/0x00455810/0x005a10d0, stamps one orientation-dependent local secondary-overlay pattern through 0x00534e10 plus 0x004497a0, and then runs one bounded scored refinement pass through 0x0051db80, 0x00534040, 0x005340a0, 0x00534100, and 0x00533fe0. The finalizer 0x00421730 then clears the per-cell region word at [world+0x212d] + cell*4 + 1 across the full live world raster, seeds each live region's cached bounds fields, and repopulates that same raster by writing the nearest class-0 region id [region+0x23a] into empty or weaker cell slots from one bounded center-and-radius sweep. The region-profile side is tighter too: 0x0041f940 counts only the current subcollection entries whose backing candidates pass 0x0041f998, and that smaller predicate now has one real content split instead of staying anonymous. Candidates whose subtype byte is not 2 pass immediately, while subtype-2 candidates only pass when either availability word [candidate+0xba] or runtime recipe latch [candidate+0x7ac] is nonzero; 0x00412af0/0x00412b70 now ground the lookup step beneath both counters as a casefolded profile-label-to-candidate resolver over the global candidate pool 0x0062b268; and the stricter year-filtered counter 0x0041f9b0 then stacks the subtype and [candidate+0x26] <= max_year gates on top of that same availability test. Two adjacent collection helpers are grounded now too. 0x0041fa30 linearly scans the same region profile collection [region+0x37f], compares labels through 0x005a57cf, and returns profile-weight float [entry+0x1e] from the first casefolded match or the shared zero float when none match; 0x0041fac0 resolves one 1-based ordinal out of that same collection and copies both the matched profile label and weight [entry+0x1e] to caller-owned outputs. Those reads line up with the editor copy-industry mutator 0x004206b0, which already treats [entry+0x1e] as the live editable profile-weight lane. That border pass is now tighter too: the outer owner refreshes the companion region set 0x006cfc9c through the reset-and-assign wrapper 0x00487650 above the heavier record initializer 0x00487540, then re-enters 0x004881b0 to refresh the raw per-region cell-count band from the live world raster, and the inner emitter 0x00487de0 clears prior chunked segment queues through 0x00533cf0, scans the live region raster, and appends fresh border-segment records through 0x00536ea0. The lower presentation helper strip under the same owner is now explicit too: 0x00533970/0x00533980 query the cached world-grid X/Y maxima, 0x00533990 stores the secondary-overlay shift field [world+0x15e1], 0x005339a0 builds one plane equation from three XYZ points, and 0x00533a30 uses the same three-point patch to solve one sampled height at caller-supplied (x,z), 0x00533ae0/0x00533af0/0x00533b00 expose the secondary-raster and companion byte-raster roots, and 0x00533b20/0x00533b30/0x00533b70/0x00533b90 expose the normalized coordinate, strip-offset, and sample-triplet tables used by shell-side overlay staging. The adjacent queue side is tighter now too: 0x00533bc0/0x00533bd0/0x00533be0 are the direct append, remove, and root getters for shell queue [this+0x166d]; 0x00533bf0/0x00533c20 are the cell-addressed attach/detach helpers over nearby-presentation table [this+0x1671]; 0x00533c50/0x00533c70/0x00533ca0 do the same for the region-border overlay chunk table [this+0x1679]; and 0x00533dd0/0x00533e00 are the matching geographic-label cell-table attach/detach wrappers over [this+0x1675]. The downstream layout-state staging side is bounded now too: 0x005454c0 snapshots the current slot-triplet table into the history list [layout+0x259f], 0x00545520 is the optional per-slot item-binding setter over [layout+0x2593], normalizing mismatched item mode tokens through 0x005435d0 before publishing node property slot +0xf4 on [layout+0x25df], and 0x00548940 is the paired seeded-triplet applier that walks the temporary 0x18-byte record list at [layout+0x259b] and forwards both triplet halves into 0x005455e0/0x005456d0 for the first N destination slots. The neighboring probe strip is bounded now too: 0x00548820 seeds every live slot to the fixed triplet pattern (1,2,1) in both triplet halves, 0x005488a0 snapshots the current slot-triplet table into that same seeded list and can immediately re-apply it, while 0x005489f0 uses literal TextureForTests to run one layout-side binding probe whose boolean result is later mirrored into shell capability bytes [0x006d4024+0x114250/+0x114251]. The setup-side owner over that same strip is bounded now too: 0x0055ddc0 chooses one small resolution tier from shell dimensions [0x006d4024+0x11423b/+0x11423f], seeds a sequence of fixed slot-triplet patterns, snapshots the resulting tables into local probe handles, and then drives the same TextureForTests probe to populate shell capability bytes [0x006d4024+0x114250/+0x114251]. The broader lifecycle side is bounded too: 0x00547610 is the one-shot publisher for cached bound-node pair [layout+0x2607/+0x260b], 0x00547640 clears that publish gate again, 0x00542c10 is the shell-side sweep that releases the active global layout-cache entries rooted at 0x00ccbb2c, 0x0054be60 exports the live 0x72c-byte preset table [layout+0x840] into the global default cache 0x00ccbb68 and refreshes the shell-side state, 0x00548c50 is the pre-release cleanup owner for history list [layout+0x259f], seeded list [layout+0x259b], and optional slot bindings [layout+0x2593], 0x0054a190 is the broader bound-presentation release body that drops the same node and controller slot [0x006d4024+0x08], 0x005463e0 and 0x005465c0 are the two adjacent notice-emitting handle-bank cleanup strips beneath it, with 0x005463e0 now grounded as the five-handle midband release set [layout+0x260f/+0x2617/+0x261f/+0x2627/+0x262f], and 0x00547650 is the capability-gated property-strip owner over the bound node plus auxiliary handles [layout+0x2623/+0x2633], while the small adjacent helper 0x00546390 now reads as the apply-or-reject bridge that asks shell helper 0x0051f0f0 to resolve one intermediate object from a caller resource plus bound-node pair [layout+0x25df] and then forwards that object into bound owner [layout+0x25db] through slot +0x3c, returning success when the owner accepts it, 0x005478a0 is the trig-derived alternate property strip over [layout+0x261b/+0x262b], 0x00547c30 is the shared four-scalar publisher that stores local band [layout+0x36df/+0x36e3/+0x36e7/+0x36eb] and emits the derived property-0x07 block, 0x00546d40 is the descriptor-publish helper fed by local scalar bands [layout+0x2517..+0x25ff] plus seeded handle [layout+0x36fd], and the lower bind/publish strip is bounded now too: 0x005471f0 is the shared table-bind helper that chooses node property 0x112 or 0x142 by record size and can also publish one companion dword through property 0x154; 0x005472a0/0x00547300 are the clear/publish helpers for property 0x1b; 0x005472c0/0x005472f0 are the adjacent shell-flag-driven set/clear helpers for local byte [layout+0x36f8]; 0x00547320/0x00547380 are the capability-gated apply/clear helpers for the 0x0f/0x18/0x19 property strip; 0x00546760/0x00546780 are the two tiny caller-driven publishers for property 0x07 and property 0x09 = caller + 1; 0x00548030/0x00548060 are the two adjacent fixed property-pair setters for 0x13/0x14 = 1/6 and 0x13/0x14 = 5/6; 0x00544270 is the tiny scalar-pair store into [layout+0x25ef/+0x25f3], 0x00544360 is the identity-reset publisher for local descriptor [layout+0x34ef], 0x00544290 is the sibling descriptor publisher for [layout+0x352f] from one integer span pair, 0x005443b0 is the copy-side sibling that republishes one incoming descriptor payload from caller offset +0xce, and 0x00544450 is the tiny query-and-optional-clear helper for local flag byte [layout+0x36f7]. The next local recompose strip is bounded now too: 0x005443f0 exports the current 0x33ab handle pair plus one auxiliary band into caller record payload offsets +0xce/+0x10e/+0x14e, 0x00544470 recomposes local blocks [layout+0x356f/+0x362f/+0x35af/+0x33ef] from the adjacent descriptor blocks through the shared matrix-style helpers 0x0056d3cd, 0x0056d616, and 0x0056d8d9, 0x00544500 is the sibling recompose owner that writes the final result into [layout+0x366f], 0x00544630 is the tiny scalar-triplet store into [layout+0x2533/+0x2537/+0x253b], and 0x00544660 is the four-outparam query helper for local rect band [layout+0x2523/+0x2527/+0x252b/+0x252f]. The projection side beneath that strip is explicit now too: 0x005446b0 projects caller XYZ through local block [layout+0x33ef..+0x342b] into one XY pair, 0x00544750 is the visibility-gated sibling that projects through [layout+0x33af..+0x33eb] into XY plus optional depth, and 0x00544860 applies local descriptor [layout+0x34ef..+0x352b] to one vec3 with a projective divide, while 0x00544930 composes local blocks [layout+0x34ef/+0x35ef/+0x352f], applies weighted caller XYZ through that stack, rejects the result on the same projective sign test, and otherwise emits XY plus one derived score, 0x00544a80 maps one local XY pair through cached rect band [layout+0x2523/+0x2527/+0x252b/+0x252f] and affine coefficient triplet [layout+0x342f..+0x346b] into XYZ, and 0x00544b80 is the relative-output sibling that subtracts that mapped XYZ from one caller-supplied vec3 reference block. The small property-pair strip is complete now too: 0x00544c80/0x00544cf0/0x00544d20 clear or arm the same 0x0d/0x0e pair for selectors 4, 2, and 1; the next rect-strip owner is bounded now too: 0x00548120 resets the identity block, ensures fallback handle [layout+0x25e3], and refreshes the current span; 0x00548180 stores normalized local rect band [layout+0x2523/+0x2527/+0x252b/+0x252f], publishes either a dynamic or fallback block, and then refreshes the same span; 0x0052d4d0 is the controller-side bridge that materializes one active-display rectangle from normalized scalar band [controller+0x50..+0x5c]; and 0x005482e0 is the join point that either feeds that rectangle into 0x00548180 or falls back to a direct width/height span refresh through 0x00544290; 0x0054bb10 is the alternate segment-record bind over [layout+0x263f]; 0x0054bbd0 and 0x0054bbf0 are the two tiny wrappers that reuse 0x005471f0 for the 0x264f/+0x2653 and 0x2647/+0x264b bind-and-publish pairs. The next owner layer is bounded too: 0x0054a500 is the wider branch that clears the visited-byte strip, pulses the surrounding property gates, derives two normalized shell scalars, and then either rescales rows from handle [layout+0x2663] through the local four-scalar band or publishes the local descriptor set rooted at [layout+0x35af] before committing the same variant-bank-backed batch ranges. 0x0054ab20, 0x0054b030, and 0x0054b4e0 are the three setup-side batch-refresh owners that all walk the 0x2d-stride batch records rooted at [layout+0x266f], but split cleanly into a three-slot candidate-binding variant, a two-slot candidate-binding variant, and a narrower 0x265f-backed capability-switch branch. That last branch is tighter now: 0x0054b4e0 first tries a special descriptor bind by asking node slot +0x128 whether handle [layout+0x265f] plus the caller pair can be accepted directly, and only on failure does it fall back to the capability-selected property path that either raises 0x2c4 and binds [layout+0x265f] on property 0x28, or raises 0x1c4 and binds the same handle on property 0x20, before walking the same variant-bank-backed batches with the narrower slot-0 plus optional slot-1 clear behavior. One layer above those batch owners, 0x0054bea0 is now bounded as the interpolated preset-row owner. It treats the preset table at [layout+0x840] as 0x33-byte rows, blends two caller- selected rows into the local pose and color bands [layout+0x24f0..+0x250c/+0x2510..+0x251f], applies extra amplitude terms from [layout+0x25af/+0x25fb/+0x2603], reuses the same 0x265b/0x112 and 0x265f bind decisions as the neighboring batch owners, packages one stack descriptor through node slot +0xb0, stores the packed RGB into [layout+0x25a3], and then finishes through 0x0054a280 so the resulting pose and color state becomes live on the bound presentation node. One layer further up, 0x0054c420 is now bounded as a timed vertex24 batch-stream owner rather than another anonymous setup blob. It resets the same presentation node side, rebinds [layout+0x2647] onto property 0x142 when needed, reads one 0x2800-byte block from that handle, materializes one fixed 0x28-entry stack batch, and then spends about 1000 ms driving repeated 0xc80-byte commits through node slot +0x118. The smaller helpers beneath it are now grounded too: 0x0054c880 refreshes local count field [layout+0x19] from base count [layout+0x15] plus scalar [layout+0x36a0], clamped to [[layout+0x15] >> 1, 0xff], while 0x0054c8f0 is the paired getter. The timed owner's tail computes one elapsed-work ratio, publishes bound pair [layout+0x2607/+0x260b] once through node slot +0x7c, re-raises property 0x89 from template byte [layout+0x83c+0x22], forces property 0x07 = 1, and returns that ratio in st(0). The next body down, 0x0054c900, is no longer just a raw internal branch. It services a 0x10-entry local slot band rooted at [layout+0x4ad] with stride 0x31a, gated by the same refreshed local count [layout+0x19] plus active-slot counter [layout+0x22b57]. It first resets subordinate layout-state [layout+0x2d] through 0x005467e0, 0x00545080, and 0x00547320(1), then uses the timer or RNG globals at 0x00d93828..0x00d93834 to seed new slots or advance live ones. Those slots can attach to caller-owned records from [arg+0x40c] through the 0x00554210/0x005545d0/0x005543a0/0x00554340/0x005542c0/0x005543f0 strip, and each active slot expands into repeated 0x18-byte generated records while counters [layout+0x71] and [layout+0x75] advance. The tail commits or clears that generated strip back through the same subordinate layout-state using 0x00545520, 0x00545c50, 0x00544f30, 0x005450a0, and 0x005467a0. Its sibling 0x0054d810 now reads as a second service owner over the same slot band, not just a hidden math tail. It has a detach-clear fast path when [layout+0x19] < 0x80, lazily seeds a distinct global jitter table at 0x00d8d830, refreshes subordinate layout-state [layout+0x2d] through 0x0054bb70, 0x00544360, 0x005457c0(0), 0x00545000, and 0x00546890, and then builds another generated 0x18-byte strip by combining those jitter values with local origin scalars [layout+0x369c/+0x36a0/+0x36a4], one time-derived color band, and the live per-slot bytes and countdowns under [slot+0x4b1..+0x4c3]. Like 0x0054c900, it advances counters [layout+0x71/+0x75] and commits the result back through subordinate layout-state using the same span and property-reset helpers. The adjacent 0x5de2a8 subobject family under the same owner is bounded now too. 0x0055e9f0 is the tiny family initializer that seeds fields around [+0xa2..+0x106], while 0x0055ecb0 is the constructor-side owner that installs vtable 0x005de2a8, loads resource 0x87, and copies the resulting dimension band into [subobject+0xa2/+0xa6/+0xaa/+0xae/+0xb2]. 0x0055ec00 is the cached-surface ensure path: it allocates one 0xec-byte surface owner through 0x00543980, materializes a zeroed RGBA backing buffer through 0x00541970, publishes it through 0x005438d0, and then consults mode table 0x0062583b from [subobject+0xea] << 4 before optionally triggering global helper 0x0053f000. 0x0055ea60 is the paired table-driven service body that fills that cached surface from payload root [subobject+0xf2], and 0x0055ed40/0x0055ed90/0x0055ee60 are the matching cached-surface release, broader payload-release, and readiness-or-release guards. The next owner layer is grounded now too. 0x0055ee80 is the timed payload-cursor service owner: it gates on readiness and global latch 0x00d97970, advances payload cursor [payload+0x10] -> [payload+0x08] from elapsed ticks 0x0051d890 and rate pair [payload+0x14/+0x18], retries completion through import thunks 0x005c8370/74/78, and, when the cursor is exhausted, consults mode-table bytes 0x00625836/0x0062583a to restart or reseed the payload through 0x005c836c and 0x005c837c before flipping completion latches [subobject+0xda/+0xae/+0x106] or calling optional callback slot [subobject+0xd6]. 0x0055f0b0 is the setup-side owner above that path: it tears down prior state through 0x0055ed90(0), formats one mode-table-backed payload name from 0x00625830, loads that payload through 0x005c8368, derives capped power-of-two surface dimensions into [subobject+0xb6/+0xba], optionally allocates staging slab [subobject+0xbe], ensures cached surface [subobject+0xe6] through 0x0055ec00, computes local aspect or scale floats [subobject+0x13/+0x17], primes the timed service through 0x0055ee80(1), and then repopulates the cached surface through 0x0055ea60. 0x0055f3f0 is the compact registered-message dispatcher above that setup path, while 0x0055f4e0 is the live service and render owner that refreshes the payload or cached surface when mode-table byte 0x00625837 is set and then draws either a fallback marker through 0x0054f710 or the cached-surface overlay through 0x0054f640 plus follow-on marker sprites through 0x0054f9f0. The family is now closed on the teardown side too: 0x0055f9b0 is the destructor wrapper that re-enters 0x0055ed90(1), decrements live counter 0x00d9797c, and optionally frees the object storage. The adjacent sibling family rooted at vtable 0x005de318 is bounded now too. 0x0055f9f0 is the family initializer: it zeroes the local field band [+0xa2..+0x102] and [+0x172..+0x1e6], seeds selector word [+0x06] = 0x08, stores sentinel -1 into [+0x192/+0x1d6], and seeds active-state dword [+0x172] = 1. 0x0055fcc0 is the constructor-side owner that loads resource 0x12f, then copies 0x34 dwords from resource offset +0x5f into [subobject+0xa2..+0x16d], while 0x0055ff70 is the alternate constructor that copies the same 0x34-dword band from a caller-supplied record instead of a resource. Below that, 0x0055faf0 is the small active-state refresh helper over local range or selector fields and optional handle [subobject+0x19a]; 0x0055fb80/0x0055fba0/0x0055fbc0/0x0055fc10 are the row-table accessors and chain-walk queries over the 0x20-byte row band rooted at [subobject+0x176]; 0x0055fc50 is the paired optional-handle release that also clears control status tokens for child control id [subobject+0x04]; and 0x0055ffb0 is the small helper that rounds normalized scalar [subobject+0xb6] onto the current view-height grid. The next owner layer in the same sibling family is bounded too. 0x00560000 assembles one descriptor object from local bounds, owner-relative coordinate fields, optional payload root [subobject+0xf2], and current owner or child ids, allocates a 0x1b9-byte record through 0x0053b070, initializes it through 0x0055ab50, binds it back to owner [subobject+0x86] through 0x0053f9c0, seeds fallback color [subobject+0xf6] = 0xffffff00 when needed, and then re-enters 0x0055faf0 to refresh the local active-state latch. The adjacent helpers 0x005602c0 and 0x00560300 count or select the Nth nonterminal row chain by re-entering 0x0055fbc0, and 0x00560350 is the family world-anchor query that combines owner origin with local offsets and normalized height scalar [subobject+0xb6] to produce an (x, y) pair. 0x005603e0 is the broader live owner above that strip. It either renders the already-bound descriptor object when [subobject+0x126] is live, or iterates the local row table for up to two passes, deriving per-row anchor and span data from owner origin, local float bands, selected row or chain helpers 0x005602c0/0x00560300, and optional cached surface [subobject+0xe6], then emitting the resulting overlays through 0x0054f710, 0x005519f0, and callback slot [subobject+0x1ce] when present. That closes the sibling family at a real owner boundary rather than leaving it split between constructor and table helpers only. The next callback and state band is grounded too: 0x00560e50 rebuilds the callback-row cache in [subobject+0x18a/+0x18e] and dispatches it through callback slots [subobject+0x1c6/+0x1ca]; 0x00561150 is the small refresh wrapper above that path that can also advance [subobject+0x1e2] from rollover dword [subobject+0x1e6]; 0x00561740 is the live render wrapper that forwards a derived view box into 0x005603e0 and then optionally emits extra marker sprites; 0x00561840 is the selected-row setter that clamps the incoming row, mirrors it through optional outputs and callbacks, and signals shell input with event 0xce; 0x005618f0 appends one row record, grows table [subobject+0x176], refreshes rollover counters, and re-enters both 0x560e50 and 0x55faf0; and 0x005615f0 is the destructor-side owner that drains callbacks, row strings, the row-table slab, and the owner registration before falling back to base cleanup. The family now extends through its message and mutation owners as well. 0x00561c30 is the thin destructor wrapper over 0x005615f0; 0x00561c50 removes one row, compacts the 0x20-byte row slab, repairs selection and visible-window state, and refreshes both callbacks and family activity; 0x00561e40 updates one row flag at +0x18, recounts nonterminal rows, and repairs selection if the current choice no longer lands on a valid terminal chain; 0x00561f30 handles a narrow navigation-message strip and can synthesize a 0xca event around the current selection; 0x00562540 is the timed auto-scroll owner driven by pointer proximity at the top or bottom of the visible band; 0x00562650 clears all rows by repeatedly re-entering the remove-row owner; and 0x005626a0 is the registered-message dispatcher that ties the whole family together by routing callback setters, row append/remove, clear-all, callback refresh, selection changes, and handle release through the now-grounded local owners. The next sibling family rooted at vtable 0x005de360 is bounded now too. 0x00562d30 is the family initializer: it seeds selector word [this+0x06] = 0x10, clears callback and timer dwords [this+0xa2/+0xce/+0xd2/+0xd6], seeds delay or range dword [this+0xa6] = 0x1f4, and zeroes the four watched child-control words [this+0xaa..+0xb8]. 0x00563120 is the constructor-side owner that loads resource 0x8b and copies the +0x5f payload band into [this+0xa2..+0xb8], while 0x00563210 is the alternate constructor that copies the same 11-dword band from a caller record. Below that, 0x00562e40 snapshots elapsed ticks into [this+0xce/+0xd2], optionally invokes callback slot [this+0x9e] with owner-relative local coordinates, and then falls through the shared base update 0x00558760; 0x00562da0 is the optional marker-pair render helper under controller mask [0x006d401c+0xc79]; and 0x00562ed0 is the registered-message dispatcher that validates readiness through vtable slots +0x30 and +0x20, updates callback slot [this+0xd6], compares incoming child ids against watched words [this+0xb2/+0xb4/+0xb6/+0xb8], can synthesize 0xca events, and can resolve a target shell window through 0x00538810 before forwarding the paired words [this+0xae/+0xb0]. The family closes cleanly on the teardown side too: 0x005631e0 is the thin destructor wrapper over base cleanup. The shared base child-control family under vtable 0x005ddcd0 is tighter now too. 0x00558580 is the real base constructor: it resets state through 0x00558080, optionally copies one caller template block, rebuilds localized text handles [this+0x63] and [this+0x92], normalizes selector byte [this+0x37] to default 3, and snapshots the primary span bands into [this+0x6c..+0x7c]. 0x00558000 is the matching base release body that clears parent-window active-child links and drops localized or payload handles. On the interaction side, 0x005582f0 is the broader point-hit owner above the local shape helper 0x005581e0, while 0x00558670/0x005586c0 are the primary and secondary readiness predicates over flag words [this+0x68/+0x6a], owner latches [owner+0x5c/+0x60], optional nested child [this+0x4b], and shell controller byte [0x006d4024+0x57]. Just above those gates, 0x00558760/0x00558840 are the paired active and clear-side service helpers that drive cue callback 0x0045ea20, optional callback slots [this+0x9e/+0x96], and active caption publish through 0x00538c70, while 0x005588b0/0x00558980 are the corresponding clear/set mutators for state word [this+0x6a] and the parent active-child slots [parent+0xc6d/+0xc71]. Above that, 0x00558a10 is now bounded as the common registered-message dispatcher for the base child-control family rather than an unnamed shared wndproc fragment. The preview-surface child subfamily above 0x00559520/0x005595d0 is tighter now too: 0x00559340 seeds its preview and aspect fields, 0x005593e0 refreshes current local spans and optional aspect scalars from the bound preview handle, 0x005594c0 stages the current local origin and requests the deferred refresh through vtable slot +0x34, 0x00559f50 stores one highlighted local rect band, 0x00559f90 and 0x0055a040 are the heap-template and inline-template constructors, and 0x0055a090 is the matching preview-surface destroy path. The render and message owners are tighter now too: 0x005595d0 switches over style field [this+0xb0], uses 0x54f710 for flat overlay strips, binds preview surface [this+0xaa] through 0x54f640 -> 0x51f460 on style 8, and uses 0x53de00 -> 0x552560 for the generic tagged-preview draw lane keyed by selector [this+0xae] and local rect [this+0xd8..+0xf0]; 0x00559c40 is the matching preview-surface-specific registered-message owner that updates selectors, colors, aspect scalar [this+0x108], alpha byte [this+0x10c], and optional callback slot [this+0x10d] before tailing into the shared child-control dispatcher 0x00558a10. The adjacent sibling family under vtable 0x005ddd58 is bounded one step further now too: 0x0055a560 clears the local selector and metric band [this+0x101..+0x1b5], 0x0055a640 stores the item-count field [this+0x101], 0x0055a660 clamps the current index into [this+0x185], optionally mirrors that index into one nested type-8 child, and can fire cue selector [this+0x11d] through 0x0045ea20, 0x0055a170 rebuilds a paired token-child strip from preview-handle selectors [this+0x129/+0x131/+0x139/+0x13d] plus local offsets, 0x0055a720 is the matching paired preview-selector render and outline pass, 0x0055a990/0x0055ab50 are the resource-backed and inline-payload constructors, 0x0055aba0 is the message-side gesture and selection dispatcher above 0x0055a660, and 0x0055a0e0/0x0055ab30 are the paired-child destroy path and thin destructor wrapper above the shared base cleanup. The shared owner above that small family is bounded too. 0x00563250 and 0x00563260 now read as the clear and update helpers for global child-control filter dword 0x00625a94, and 0x00563290 is the real shell-side owner that formats one anchored text or callout payload through 0x005519f0, tries to resolve the target child through 0x0053f830, and when no child exists builds one 0xda-byte payload block, allocates a new child object through 0x0053b070, initializes it through 0x00563210, registers it through 0x0053f9c0, and finally dispatches a kind-0x7b descriptor through 0x0053fe90 with callback 0x00563260. The adjacent sibling family rooted at vtable 0x005de3b0 is bounded as well. 0x005634e0 is the family initializer: it seeds selector word [this+0x06] = 0x20, clears scalar and handle bands [this+0xa2..+0xd8], zeroes optional text root [this+0xb2], and resets state dword [this+0xcc]. 0x00563c00 is the constructor-side owner that loads resource 0xa1, copies the payload band rooted at +0x5f into [this+0xa2..+0xd8], and seeds fallback text root [this+0xb2] through 0x0053cb10(0xbc1), while 0x00563d70 is the alternate constructor that copies the same payload band from a caller record and duplicates the caller string root at +0x6f. The live side is bounded now too: 0x00563550 refreshes optional localized label id [this+0xb6] into text root [this+0xb2] and applies several mode- and control-id-specific vertical offset bumps to [this+0x13] and [this+0xc0]; 0x00563670 is the primary render owner that can emit an upper label through 0x0053de00 -> 0x00552560, render the main body or callout through 0x005519f0 using text root [this+0xb2], style bytes [this+0x2b/+0x2c], optional color bands [this+0xcc..+0xd8], and owner-relative float bands [this+0xa2..+0xc4], and then emit one or two marker sprites through 0x0054f9f0; and 0x00563950 is the registered-message dispatcher that updates local text root [this+0xb2], toggles active state [this+0xc8/+0xcc], restyles sibling control 0x93 through 0x00540120, and can synthesize a 0xca event carrying the current active value. The family closes on the teardown side through 0x00563d20. The next adjacent helper strip is bounded too. 0x00563e30 is the lazy ensure path for a tiny callback-registration handle object: when live flag [this+0x0c] is still clear it releases any old imported handle at [this+0x04], allocates or registers a new one through import 0x005c81c0 with callback 0x00563dd0, stores the returned handle in [this+0x04], and marks the object live. 0x00563e90 is the direct destructor-side release of that same imported handle. The neighboring owned-list strip is tighter now too: 0x00563ed0 releases every entry in owned list [this+0x8d] through 0x005544b0(-1, 1), and 0x00563f10 is the tiny remove-from-list helper on that same root. Above those leaves, 0x00563f20 is the broader cell-radius refresh owner: it clears the 0x1000-byte visited band at [world+0x47c], clamps one tile rect through 0x00533970/0x00533980, repopulates owned list [this+0x79] from the nearby-presentation cell table via 0x00533ba0, repopulates owned list [this+0x8d] from the border-overlay chunk table via 0x00533c50, marks visited cells with bit 0x01, and then deactivates or removes stale [+0x8d] entries whose cached owner marker no longer matches [this+0x05]. One small resource-bank seam beside that branch is bounded now as well. 0x005641f0 loads one heap-owned payload copy from the shared bank root 0x006d4020: it hashes or canonicalizes the caller key through 0x0053b5c0, falls back to the caller backup string when the canonical key is absent, resolves the payload length through 0x0053c9c0, opens the row through 0x0053bd40, allocates a buffer through 0x005a125d, copies the bytes through 0x0053b7c0, and optionally returns the length to the caller. 0x00564280 is the adjacent cache reset or destructor-side owner above that helper: it walks the table rooted at [this+0x04] with callback 0x005641d0, releases and frees the owned descriptor, table root, and pool roots at [this+0x00/+0x04/+0x08], and clears the local counters and live flag. The cache family itself is bounded now too. 0x00564570 is the constructor or reset owner: it allocates the three helper roots, builds the scored heap and hash table, allocates the 0x15e0-byte pool behind the vector root, stores the caller byte budget in [this+0x10], clears the hit or miss counters, and zeroes the optional prefix byte at [this+0x24]. 0x00564310 is the scored-eviction helper that pops the top entry from heap [this+0x08], frees its payload buffer, removes it from hash root [this+0x04], conditionally relinks or frees the entry record, and returns the freed payload size. Above that, 0x00564390 is the primary cache-backed load owner: it composes the lookup key from optional prefix [this+0x24] plus the caller stem, bypasses the cache when [this+0x14] is zero, and otherwise uses the hash root and scored heap to reuse or evict entries before returning a fresh heap-owned payload copy. The neighboring tiny helpers are explicit now too: 0x005641b0 copies a caller string into local field [this+0x24], 0x00564150 clears one 0x100-dword table, 0x00564180/0x00564190/0x005641a0 are the adjacent indexed-byte set or clear or query helpers, and 0x00564560 is the direct destructor thunk back into 0x00564280. The next geometry seam beneath the same owner band is bounded now too: 0x00564660 builds one six-record 0x18-byte primitive block from a compact record with two projected corners, one packed color, and one scalar multiplier, while 0x005648c0 is the sibling three-record builder that handles the larger record form with three independently scaled packed colors. Above both, 0x00564c70 is the queue-driven owner that walks the caller record list, keeps low-nibble mode byte [this+0x374d] synchronized through the 0x5472.. and 0x5474.. strip, chooses between direct subordinate-state calls and the two primitive builders, accumulates emitted primitive count in [this+0x71], and re-enters 0x00523d30(1) after each serviced record. The sibling 0x00564ee0 is the more general list-service owner on the same branch: it first reapplies the current optional item binding through 0x00545520, then walks the caller intrusive list while keeping both mode nibbles in [this+0x374d/+0x374e] synchronized, dispatching records either into direct routed payload calls through 0x005669d0, direct subordinate-state calls through 0x005473c0/0x005474a0, or the two primitive builders, and finally restoring one trailing deferred direct-state tail before it returns. One shell-side layer above that branch is explicit now too: 0x00565110 is the broader owner that rebuilds subordinate layout state through 0x0055dd80 and 0x0055e2b0, services one mode-selected record source through 0x00564c70 or repeated 0x00564ee0 calls, and only then commits the bound-node finalization strip through 0x00548940, 0x005467a0, 0x00545020, and 0x00547fe0. The adjacent small trace-helper seam is bounded now too. 0x00565370 allocates one power-of-two square-mask table and one pair buffer, 0x00565440 is the matching destructor, 0x00565470 marks one coordinate pair once and appends it to the live pair buffer, and 0x005654f0/0x00565500 are the tiny exponent and square-mask getters. Above those leaves, 0x00565510 is the broader owner that advances the helper generation, walks the square mask, collects two complementary boundary-run lists through globals 0x00d97a30 and 0x00d979b0, and emits the resulting pair strip into the live pair buffer. The neighboring world-anchor marker config seam is explicit now too. 0x00565c40/0x00565c60 store and query the local marker pair plus selector byte used by the later indexed marker emitter 0x00565c90, 0x00565d60/0x00565da0 replace or release the shared type-6 image handle rooted at 0x00d97ab0, and 0x00565dc0 loads one named payload triplet through the banked-resource strip before seeding the caller output with the default transform band from 0x00625ae8. The adjacent sprite-billboard instance seam is bounded now too. 0x00565e30 is the default initializer, 0x00565e80 seeds one instance from caller basis, timing, flags, and scale, and 0x00565f40 is the per-step update helper that advances lifetime, updates position and basis, refreshes the dynamic scratch basis globals, and maintains the live fade scalar later consumed by 0x005662a0; when that step needs to rebuild the scratch quad it re-enters 0x005661b0, which applies one helper matrix to the four billboard basis points rooted at 0x00d97b98. The neighboring routed-payload seam that the layout-state record owners use is explicit now too: 0x005669d0 scales one caller float quad by layout spans [this+0x25c7/+0x25cb], rounds the results to integers, and forwards that integer quad into an optional sink object through the sink vtable strip. The next shell-side streamed-record seam is bounded structurally now too. 0x00566a80 loads one 0x24-byte record plus a trailing 0x0c-stride array, packs four leading floats into one RGBA dword, and swaps the second and third float lanes inside each loaded element, while 0x00566b80 is the broader sibling that loads one 0x45-byte record, normalizes its source triples against the current global anchor, derives bounds and max-radius, and expands the result into one 0x4c-stride table. That streamed-record seam is no longer floating without owners either. 0x00567400 is the keyed 3DPF collection loader: it opens the current-or-selected banked stream, validates magic 33 44 50 46, allocates one 0x18-stride child-entry array, and then fills each child through 0x00567190. That child loader reads one leading 0x08-byte header, optionally copies one inline anchor triplet into [out+0x00..+0x08], mirrors the same triplet into globals 0x00d97ba8..0x00d97bb4, stores the entry count at [out+0x14], and then chooses one of the two earlier payload formats from a trailing format byte: L allocates and fills the 0x24 inline-entry band at [out+0x10] through 0x00566a80, while I allocates and fills the 0x45 expanded-entry band at [out+0x0c] through 0x00566b80. The matching release side is explicit too: 0x005672e0 frees the nested inline or expanded payloads plus the optional shared helper at 0x00d97bb8, 0x005674c0 releases the whole 3DPF collection by walking its child-entry array, and the tiny wrappers 0x00567500/0x00567520 are now just the construct-and-release front doors used by the typed staging-row family. The next streamed-patch owner layer is bounded now too. 0x00567730 clamps one caller rectangle against grid dimensions [this+0x15d5/+0x15d9], walks the patch-cell pointer table at [this+0x1669], and for every live cell scans the surrounding neighborhood for other live cells while skipping the center. It uses 0x005675c0 to compare candidate four-corner patch pairs: that helper measures corner-to-corner distances from the triplets rooted at +0x00/+0x08, ignores corners already masked with state byte +0x31 == 2, updates the caller best-distance scalar when a closer match survives, and averages the paired blend bytes at +0x39 back into output bytes +0x35, or marks both corners with state 1 when the distance only falls under the looser threshold at 0x005c85b8. Once one best neighbor survives, 0x00567730 averages the winning patch positions into midpoint triplets, resolves a world-height scalar through 0x00534490, and decrements the caller output budget before continuing. The actual streamed quad emission side is tighter now too. 0x005679b0 expands one streamed patch item into one 0x90-byte six-vertex vertex24 quad: it derives an 8-step brightness phase from GetTickCount plus item field [this+0x3a], combines that phase with the four corner blend bytes at +0x35..+0x38, forces masked corners at +0x31..+0x34 fully transparent, and writes six 0x18-byte vertices from the corner positions rooted at +0x00..+0x2c. The two list streamers above it are explicit too: 0x00567c70 emits the primary intrusive list rooted at [this+0x1c], 0x00567ce0 does the same for the alternate list at [this+0x20] with one extra selector value, and both advance the destination by 0x90 bytes per emitted quad. Their shared release side is 0x00567bf0, which frees both intrusive lists and all queued quad items through 0x005570b0, while 0x00567d50 is the immediate destructor-side sibling that drops the two list-root objects themselves and clears owner slots [this+0x1c] and [this+0x20]. The actual streamed-patch owner above those leaves is bounded now too. 0x00567da0 first clears any previously queued quads through 0x00567bf0, then walks the live signed-byte sample grids at [this+0x08] and [this+0x0c] together with the u16 type-word table at [this+0x10] across the current interior tile rectangle. For each admitted cell it allocates one 0x3e patch record, derives corner positions and color or blend bytes from the surrounding signed-byte samples plus the low three type bits through table 0x00625c60, and accumulates those records into the primary and alternate intrusive roots at [this+0x1c] and [this+0x20]. After that initial build it runs a second neighborhood-processing pass over the primary list, using local pair and radius gates before finalizing the generated blend-byte bands. The constructor side is explicit too: 0x005692e0 allocates and initializes the two intrusive list roots, copies the caller bounds and grid-owner accessors into [this+0x00..+0x24] through the neighboring world-grid query helpers, and immediately re-enters 0x00567da0 to build the live patch lists. The coarse secondary-overlay backend under [world+0x1685] is now explicit too. Each coarse chunk is one 0x54-byte object initialized by 0x0056af70, with quantized origin dwords at [chunk+0x00/+0x04], world-space origin floats at [chunk+0x08/+0x0c], total live-cell count [chunk+0x10], and a 4x4 local-page table rooted at [chunk+0x14]; 0x0056afc0 is the matching full-page release walk. Each present local page is 0x8a bytes loaded or saved by 0x0056b490 and 0x0056b510, with a live-cell word at [page+0x00], a shared state byte at [page+cell*8+0x0a], one per-cell sample-slot side band at [page+cell*8+0x02+i], and one auxiliary byte at [page+cell*8+0x0b]. The state byte split is bounded too: 0x0056b000/0x0056b070 toggle and query the low-nibble flag mask, 0x0056b180/0x0056b1f0 query and store the three-bit sample-slot count, and 0x0056b0e0 decrements that sample-slot count, decrements both the page and chunk live-cell counters, and frees the page when its live count reaches zero. The auxiliary byte side is separate: 0x0056b260 queries it and 0x0056b700 stores it while marking shell dirty byte [0x006d4024+0x374a]. The broader append owner above those leaves is now bounded too: 0x0056b580 ensures one local page, seeds its minmax height band through 0x0056b2c0 from a 5x5 world-sample lattice, writes the caller auxiliary byte, derives one quantized sample byte from the world-height path, and appends it into the per-cell sample-slot side band while incrementing both the page live-cell word and the cell's three-bit sample-slot count when that count is still below 6. The earlier rectangle helper at 0x00533e70 is corrected now too: it does not release chunks. It walks the surviving coarse-chunk rect and re-enters 0x0056b770 on every live chunk so those per-count side bytes are refreshed from the current world callbacks across the whole rect. The adjacent bundle-codec seam is explicit now too. The shared callback context at 0x00d93984 is no longer just an anonymous transport scratch block: 0x00552f30 and 0x00552fa0 are the paired source and sink callbacks over that context, with progress publish through 0x00d93988, and the two bundle-side wrappers 0x00553000/0x00553120 now read as the encode/decode owners for payload families 0x91 and 0x92. Selector 0x91 routes into the older ring or backreference codec: 0x0056be10 decodes fixed header 0x10/0x91 through buffered byte helper 0x0056b8f0, replays literals and packed backreferences through 0x0056b940, and uses one 0x200-byte ring cursor rooted at 0x1be; 0x0056bfe0 is the matching encoder, with adaptive dictionary state initialized by 0x0056bca0, updated through 0x0056b990 and 0x0056bb10, and emitted through the pending-token strip 0x0056bc00 -> 0x0056bbb0. Selector 0x92 routes into the simpler run or literal family: 0x0056c3e0 emits header 0x10/0x92 then packs either repeated-byte runs or literal spans through 0x0056c320, while 0x0056c630 reverses that same (high-bit-set => run, high-bit-clear => literal span) control format through 0x0056c370 and 0x0056c320. That closes the support-family gap beneath the companion-payload rewrite owners 0x004427c0/0x00442900, the tagged-surface importer 0x00541c30, and the tagged-surface exporter 0x005428c0: they are all now reusing the same pair of explicit bundle codecs rather than separate anonymous transform bodies. The adjacent format-descriptor seam under the same surface path is explicit now too: 0x005700e2 looks one requested tag up in the live 0x24-byte descriptor table rooted at 0x005de500 and falls back to the default entry, 0x00570106 scores one candidate descriptor against a reference through the compatibility matrix at 0x005deb38, 0x0057017b iterates the same table and optional target interface to select the best supported descriptor tag, 0x0057033f is the broader validation owner that resolves or selects that descriptor, clamps width or height or depth or level counts against target limits, rounds DXT1..DXT5 sizes up to four-pixel blocks, and forces power-of-two sizes when the selected descriptor and capability flags require it, 0x00570669 is the mode-3 wrapper over that validator, 0x00570691 is the target-side owner that feeds the validated result into vtable slot +0x50, and 0x005706f7 is the next materialization owner that either takes one fast matching-descriptor transfer path through target slot +0x70 or falls back into the broader decode owner 0x0057025d. The Direct3D-side gate in that seam is explicit now too: 0x00571570 is not a generic lock, it lazily resolves DebugSetMute from d3d8.dll and d3d8d.dll and forwards the caller's mute on or off flag through whichever callbacks exist. The fallback decode stack is explicit now too: 0x00571600 and 0x0057160a are the tiny two-handle decode-pair init or release helpers used by 0x0057025d, 0x0057163e is the broader weighted axis-map builder for the general resample branches, 0x005718fb is the flagged release path for those temporary axis maps, 0x00573e02 is the lighter dual-tap axis-map builder used by the mode-3 weighted resamplers, and 0x00574ed5, 0x00574ee5, and 0x00574f4e are the same for the 0x10-byte temporary source-view context, 0x00574f53 is the broader owner that resets that context, queries source bounds, validates or synthesizes the working rect, acquires one subordinate view when needed, and aligns the rect for block-compressed or packed-YUV tags such as DXT1..DXT5, YUY2, and UYVY, and 0x00574dbb is the decode-branch dispatcher that links one handle pair and then tries the supported codec bodies in sequence. The concrete branches are tighter now too: 0x00572f1e falls into a direct row copy when the linked source and destination layouts already match, 0x00573056 allocates one temporary width*0x10 row buffer and transfers rows through the source and destination callback slots, 0x00573147 is the mode-1 branch that allocates two temporary row buffers and zero-fills any destination rows or slices outside the shared minimum bands, 0x00573349 is the mode-2 branch that rebuilds destination rows through fixed-point step ratios derived from the linked source and destination dimensions, 0x00571dbb is the narrow direct compressed-block copy sibling for DXT1..DXT5 when the source has no auxiliary descriptor payload, 0x0057354d is the first mode-5 half-resolution branch with subtype-gated specialized dispatch, 0x0057206f and 0x00572305 are the two front doors into a CPU-selected packed-32 2x2 reducer pair, 0x005722a1 and 0x005722d6 are the one-time initializers for those reducer slots, 0x00572188 is the MMX-or-scalar packed-32 wrapper beneath them, 0x00571f49 and 0x005720a0 are the scalar packed-32 reducers, 0x00572336, 0x00572486, 0x005725aa, and 0x005726f9 are the scalar RGB565, RGB555, ARGB1555, and ARGB4444 2x2 half-resolution reducers in the same jump-table family, 0x0057298b is the generic packed-8 reducer reused for the type-0x1c and type-0x32 entries, 0x00572a26 is the alpha-plus-RGB332 sibling, 0x00572b72 is the scalar X4R4G4B4 reducer, and 0x00572c93 plus 0x00572ddf are the scalar A8L8 and A4L4 reducers, and 0x00573970 is the broader mode-5 single-slice box-filter half-resolution fallback, 0x00573f02 and 0x005742e8 are the two weighted mode-3 axis-map resamplers with two and four staged row sets built from 0x00573e02, and 0x00574a19 plus 0x00571947 are the general 2D and 3D weighted resample branches that build refcounted row or slice contribution tables through 0x0057163e and release them through 0x005718fb, 0x00575b34 is the shared decoder-base constructor, 0x00575366 and 0x00575677 are the two release-side companions for the base and the larger nested-table families, 0x0057537f is the auxiliary vec4 staging-row builder behind the peer-mode bridge, 0x00575d9c is the small peer-mode mismatch helper that allocates and caches one auxiliary width*0x10 staging row, 0x00575e17 is the temporary single-sample local-color helper that runs the decoder's vtable pair against [obj+0x1c..+0x28] under a rewritten one-sample state, 0x00575ee3 zeroes decoded sample quads when all four float lanes exceed the descriptor clip thresholds, 0x0057909e flushes live packed-YUV-422 auxiliary samples back into the payload window, and 0x00578eef and 0x0057989d are the shared packed-YUV-422 and DXT1..DXT5 decoder bases. 0x00579325 refreshes the packed-YUV-422 cached window and builds the auxiliary sample band under that family, 0x00579727 and 0x005797f1 are the packed-YUV-422 row decode and output-copy siblings, and the actual packed-YUV-422 subtype wrappers are now the FourCC or custom-tag cases 0x0057a3c8 and 0x0057a3e0 over base 0x00578eef. The earlier constructor band 0x00578ed3, 0x00579008, 0x00579045, 0x00579082, 0x005792ab, 0x005792e8, 0x005795f6, 0x00579633, 0x00579670, 0x005796ad, and 0x005796ea are now tightened to factory tags 0x14..0x1e, all still using aux mode 1 with sample strides 0x08, 0x10, 0x18, or 0x20; 0x0057a1ab, 0x0057a1e8, and 0x0057a225 are now also tightened to factory tags 0x36314c41, 0x36315220, and 0x36315241, with sample strides 0x20, 0x30, and 0x40; 0x0057a37f is the packed-YUV-422 base release owner that flushes live auxiliary state before freeing it, 0x00575717 is the broader DXT tile-row decode owner above the cached cell table, 0x00579bdc is the tag-dependent threshold-quantization helper in that same DXT neighborhood, and the subtype strip between 0x00579a8f and 0x00579ee1 is now explicit as factory-tagged wrapper pairs over the shared base for tags 0x28, 0x29, 0x32..0x34, 0x3c..0x41, 0x43, 0x46, and 0x31545844, with aux modes 1, 2, and 3, sample strides 0x08, 0x10, and 0x20, and one nested-table release case at 0x00579b62. The factory tail is tighter too: 0x0057ab70 and 0x0057ab91 are the missing release wrappers for the custom packed-YUV-422 and YUY2 subtype vtables 0x005def10 and 0x005def20, and the adjacent 0x0057abb2/0x0057abc4/0x0057acd4/0x0057ad15 strip is now grounded as a small mapped-file view context with closed-handle initialization, read-only open or map, release, and conditional release helpers. 0x00579f02 is the next DXT owner above that strip: it allocates or refreshes the cached 0x10-byte sample strip at [obj+0x10b8], rebuilds it through the primary kernel when the aligned block origin changes, copies the requested region back out, and then optionally reuses the same threshold vec4 [obj+0x1c..+0x28] as a whole-vec4 zeroing gate on the copied output, 0x0057ecb3 is the shared RGB565-to-vec4 expander with unit alpha, 0x0057ecff and 0x0057ed7d are the shared vec4-block unpremultiply and premultiply helpers, 0x0057edd0 is the shared RGB565 quantizer that clamps one float RGB triplet, switches the x87 rounding mode through 0x0057edad, and packs the rounded five-six-five lanes back into one endpoint word. The next owner layer is explicit now too: 0x0057eeca is the shared DXT4/5 alpha-endpoint fitter over sixteen scalar samples, 0x0057f1cf is the shared DXT1-family color-endpoint fitter over sixteen vec3 samples, and 0x0057f73a is the shared DXT1-family color-block encoder that chooses transparent-versus-opaque policy from the caller alpha lanes, fits float endpoints, quantizes them to RGB565, and writes the final selector bits. 0x0057ff3e is the shared DXT1 RGB565-endpoint-to-palette builder, 0x0058007c and 0x005800ff are the shared DXT2/3 explicit-alpha and DXT4/5 interpolated-alpha block decode cores, 0x0058023b, 0x00580253, and 0x00580367 are the secondary DXT1, DXT2/3, and DXT4/5 block-write kernels, 0x005807b9 and 0x005807dc are the dedicated DXT2 and DXT4 decode wrappers that re-enter the unpremultiply helper after the shared cores, and 0x005807ff plus 0x00580833 are the matching DXT2 and DXT4 encode wrappers that premultiply one temporary vec4 block before entering the shared DXT2/3 and DXT4/5 encoder cores, 0x0057a262, 0x0057a29b, 0x0057a2d4, 0x0057a30d, and 0x0057a346 are the thin DXT1..DXT5 wrappers above that DXT base, their release-side siblings now route through the broader DXT family teardown 0x00575677, and 0x0057a3f8 is the broader format-tag decoder factory beneath the handle-pair dispatcher. Above all of those, 0x0057025d is the owner that materializes one temporary source view, snapshots the caller descriptor band, dispatches the decode chain, and fills one intermediate materialization descriptor on success. That keeps the DXT and tagged-surface import path grounded as one explicit descriptor-selection and decode stack instead of a decode call hanging off anonymous table probes. The adjacent 0x005def5c seam is tighter now too. 0x0057b4fd and 0x0057b5d4 are no longer generic target-side wrappers: 0x0057b4fd builds one temporary transform block from up to three optional anchor pairs plus caller angle and scale, then dispatches that block through target slot +0x18, while 0x0057b5d4 is the broader target-service draw owner that queries surface bounds, validates or synthesizes one caller rect, classifies the active format tag, converts that rect into normalized float bounds, builds either four 0x1c-byte or four 0x18-byte local vertex records, optionally projects them through 0x0056cdda, applies the local -0.5f pixel-center bias, and dispatches the finished strip through slot +0x120. The family growing above those owners is now recognizable as a shader-assembly context rather than another generic target object: 0x0057b9a7 initializes seven embedded dword-vector bands plus the string-log vector at [this+0x84] and publishes the context through singleton 0x00db89d8, 0x0057ba6e is the reverse destructor, and the shared error helper starts one step earlier than the old row implied: 0x0057bafd formats assembly-error lines like %s(%d) : (Assembly Error) %s, statement incomplete, constant definition in shader body, and shader version expected into that owned string log. 0x0057bc33 parses one opcode token plus grounded suffixes sat, x2, x4, d2, d4, and d8 into context fields [this+0x1c8/+0x1cc], 0x0057c34a parses the destination write-mask token over rgba or xyzw, 0x0057c3f3 is the matching source-swizzle parser, and 0x0057c494 parses grounded register families c/v/t/a/oPos/oFog/oPts with optional source modifiers _da, _dw, _db, _dz, _x2, _bx2, and _bias, including the indexed forms reported by the local invalid register formatters. The output-side seam under the same context is now explicit too: 0x0057c835 emits one grounded constant-definition record from a parsed constant register plus a caller vec4 payload, 0x0057c8de flushes one pending TEXT comment chunk into the output dword stream, and 0x0057c9b4 emits FILE and LINE chunks only when the current source location changes. That extends cleanly into the owner layer too: 0x0057cb2b is the shared lexer that skips comments, maintains line state, accepts #line, rejects other preprocessor directives, tokenizes identifiers and numeric spans into [this+0xc8], and returns the grounded token/status codes; 0x0057d043 is the main statement compiler above it, dispatching version declarations, constant-definition statements, comment/file/line chunks, arithmetic and texture opcodes, and operand parsing through the helper bands we already grounded while enforcing the current version-specific rules like constant modifiers not supported in ps.1.4, coissue not supported in vertex shaders, complement not supported in vertex shaders, negate and divide modifiers cannot be combined, and the indexed-register restrictions around a0.x. One owner level above that, 0x0057d97a is now bounded as the shift-reduce parser driver: it initializes the parser stacks and lookahead globals rooted at 0x00db85d0/0x00db89c0/0x00db89c4/0x00db89c8/0x00db89cc, repeatedly asks 0x0057cb2b for the next lookahead token, walks the grammar action and goto tables at 0x006265a0..0x00626a68, invokes 0x0057d043 on reductions 0..0x32, and handles error recovery through the same shared formatter with grounded strings like statement expected and yacc stack overflow. The wider API-side owner is bounded now too: 0x0057de38 records the caller source span and optional file name into the same context, emits the default D3DX8 Shader Assembler Version 0.91 banner when needed, invokes 0x0057d97a, and then conditionally materializes the assembled output stream, adjacent constant-table-style object, and joined error-log text while probing the grounded registry-side policy keys under 0x005df51c, 0x005df530, 0x005dec20, and 0x005dec3c. That closes the nearby shader-assembly parser and API seam enough to stop treating those rows as anonymous string switches. The next tiny seam after that is now grounded too: 0x0057e300 and 0x0057e410 are not anonymous literal tables but the two math function-table seeders immediately above the later packed and x87 helper families. The first writes the older scalar or x87 geometry, plane, quaternion, and matrix entrypoints like 0x00582c30, 0x00582e40, 0x00582eb0, and 0x00582fd0 into one fixed slot layout, while the second writes the packed or vectorized successors like 0x005830a0, 0x00583320, 0x00583e80, 0x00584010, 0x005840f0, and 0x00584210 into the same table shape. One owner layer above that is bounded now too: 0x0057e520 is the local CPUID feature-mask probe for MMX and AMD-extended SIMD paths, 0x0057e5f5 is the broader MMX or 3DNow table-seeding owner that populates the later 0x005895.., 0x00589b.., 0x0058a0.., 0x00584b.., and 0x005860.. families when those capability bits are present, and 0x0057ec77 is the compact x87-side table seeder for the nearby low-dimensional strip. That local strip is explicit now too: 0x0057e81b/0x0057e884 are the x87 2D basis-plus-translation and basis-only helpers, 0x0057e8b9/0x0057e944 are the corresponding 3D variants, 0x0057ea3c is a fast table-assisted vec3 normalize-or-zero helper over lookup tables 0x00626c80/0x00626c84, and 0x0057eb06/0x0057ebe9 are the two alias-safe 4x4 multiply siblings that differ mainly in whether they write results in contiguous row order or one 0x10-byte column stride. The adjacent x87 math seam is explicit now too. 0x00571493 is the one-time dispatch-table initializer for the live function-pointer strip rooted at 0x00625c88: it copies the default seed table from 0x00625d70, optionally resets the whole strip, and on first live use patches selected slots in place after the local feature probes. The wrapper entries 0x0056c890, 0x0056c948, 0x0056ca21, 0x0056cacd, 0x0056cba5, 0x0056cca0, 0x0056cf7f, 0x0056d07a, and 0x0056d197 are not standalone subsystem owners; they are the dispatched x87 or feature-gated front doors for the same curve and blend helpers we already grounded later in SSE and MMX form. The older bootstrap seam beneath that family is explicit now too: 0x005a1081 and 0x005a10b9 seed the five-slot legacy x87 dispatch table at 0x0062a360..0x0062a374, probe KERNEL32!IsProcessorFeaturePresent(0) or fall back to the local arithmetic test at 0x005a63ca through 0x005a640a, store that result in 0x00dba008, and then apply the local x87 control-state setup through 0x005a63b8. The adjacent CRT-style support seam is explicit now too: 0x005a1a1c is the unlocked buffered element-reader over the FILE-like band at [stream+0x00/+0x04/+0x0c], 0x005a1b05 is the public lock-scoped wrapper already used by the companion-image import and rewrite paths, 0x005a1b60 is the older x87 pow owner with the clean-state fastpath probe and the full negative-base or NaN or infinity special-case ladder, 0x005a1dc2 classifies st(0) as non-integer, odd integer, or even integer for those pow special cases, 0x005a1e1d/0x005a1ea5 are the locale-aware signed-decimal core and wrapper, 0x005a2076 is the corresponding floating parser returning one f64 in st(0), and the neighboring string seam is explicit too: 0x005a1df0 is the reverse character search helper, 0x005a1eb0 is the bounded append helper, 0x005a1ff0 is the substring search helper, 0x005a2a06 is the single-character search helper beneath that fast path, 0x005a2abe is the locale-aware lowercase-in-place normalizer already used by the hotkey modifier parser, and 0x005a20b0 remains the shared overlap-safe byte mover beneath both the parser and transport text families. The adjacent helper layer is explicit now too: 0x005ac3b0 is the unbounded append helper the lowercase normalizer uses for copyback, 0x005ac579 is the broader locale string-mapping owner that prefers LCMapStringW + MultiByteToWideChar/WideCharToMultiByte and falls back to LCMapStringA when the wide path is unavailable; the ANSI-side fallback helpers are grounded now too as 0x005b16ef for LCID -> default ANSI codepage and 0x005b1738 for the source-or-destination multibyte transcode bridge beneath that ANSI path. 0x005ac935/0x005ac9bd are the temporary stream-buffer prepare or restore pair beneath the locked formatter. The same CRT strip now also owns the formatted-stream and on-exit table side: The adjacent classification leaves are explicit too: 0x005b1a00 is the shared mbctype-mask predicate over 0x00dba541 and the secondary table at 0x005e6f12, and 0x005b1a31 is its alpha-character wrapper. The neighboring locale-info bridge is explicit now too: 0x005b2828 is the wide-output GetLocaleInfoW wrapper with GetLocaleInfoA + MultiByteToWideChar fallback, and 0x005b2958 is the multibyte-output sibling that prefers GetLocaleInfoW + WideCharToMultiByte and falls back to direct GetLocaleInfoA. Above those two wrappers, 0x005b1a42 is now grounded as the shared locale-field materializer used by the broader locale-structure builders: it either allocates one exact-sized multibyte locale string for the caller or parses one short decimal locale-info field into a single output byte. The same locale-record owner strip is explicit now too: 0x005ad524 builds the primary 0xb8 locale text record from the current-thread and user-default locale words, 0x005ad88b releases that record’s owned string fields, and 0x005ada1b publishes either the dynamic record or the static fallback at 0x0062abe8 through globals 0x0062abe0/0x00dba2f8. The adjacent narrower record families are grounded as well: 0x005ada7a is the release helper for the active three-string record at 0x0062acd4, 0x005adad9 refreshes that tri-string record and its digit-map side globals, 0x005adca6 releases the secondary 0x30-byte text record band, and 0x005add7f rebuilds that secondary record plus the multibyte lead-byte or classification side state. The older locale-selection layer is explicit now too: 0x005ae38c is the static-locale-table or GetLocaleInfoA bridge over the fixed 0x005e7448 LCID rows, 0x005ae2d8 seeds the user-default LCID pair, 0x005ae8c3/0x005ae8fa/0x005ae980 are the three EnumSystemLocalesA-driven name-selection branches, 0x005ae278 binary-searches alias table 0x005e7a30 to rewrite incoming locale-name pointers in place, 0x005ae2f2 parses the final codepage selector from ACP, OCP, or locale-info text, and callbacks 0x005ae4c1, 0x005ae5d2, and 0x005ae7f2 are the concrete secondary-name, two-name, and primary-name EnumSystemLocalesA matchers that fill 0x00dba304/0x00dba308 and selector bits in 0x00dba300. Above those, 0x005ae9d5 is the broader old setlocale-style owner that selects the LCID pair, validates it through IsValidLocale and IsValidCodePage, and exports the final (primary LCID, secondary LCID, codepage) triple plus canonical locale-name text. The same locale-text seam now includes the compare and environment side too: 0x005b2b6d is the broader CompareStringW/CompareStringA owner with codepage-selection and transcode fallback, 0x005b2a98 is the smaller prefix-compare wrapper that turns CompareString* equality into 0, 0x005b2ae6 is the wide-env to multibyte-env materializer that seeds 0x00dba030 from the wider backing vector at 0x00dba038, 0x005b2ef7 is the search helper returning either a nonnegative env-slot index or the negated end slot, 0x005b315a is the DBCS-aware character finder beneath the '=' split path, and 0x005b2fa5 is the broader multibyte environment set-or-unset owner that also forwards updates into SetEnvironmentVariableA. The next CRT support strip is grounded now too: 0x005b1907 is the user32.dll-backed runtime-error message-box owner beneath 0x005acdb0, 0x005b1ddd/0x005b1e23/0x005b1e36 are the top-level unhandled-exception filter callback plus its install and restore bridges, 0x005b1eab/0x005b1f2c are the nolock and lock-scoped environment name=value lookup owners, 0x005b1b73/0x005b1bb1 are the unsigned and signed integer-to-ASCII helpers, and 0x005b1bdb is the standard security-cookie initializer over time, pid, tid, tickcount, and QPC. The same neighborhood now also owns the older signal and decimal-record leaves: 0x005b23bd is the per-thread signal-action lookup over [thread_data+0x54], 0x005b23eb is the higher signal-dispatch owner above that table and the global handler slots at 0x00dba480..0x00dba48c, 0x005b1f6b is the checked u32 add helper, 0x005b1f8c is the three-dword carry-propagating add helper, and 0x005b1fea/0x005b2018 are the left and right one-bit shifts on that same internal 96-bit decimal band. The neighboring fatal-report owner is bounded now too: 0x005b1c31 formats either the buffer-overrun or unknown-security-failure message body, adds the program path or <program name unknown>, and then routes the final text through crt_report_runtime_error_via_user32_message_box_or_callback before forced CRT termination. 0x005a2bd2 is the lock-scoped varargs stream formatter, while 0x005a2c30/0x005a2cb0/ 0x005a2cd8/0x005a2d10 append callbacks into the global on-exit table at 0x00dbb8dc/ 0x00dbb8d8, initialize that table, and expose the narrow boolean registration wrapper just beneath crt_init_exit_handlers 0x005a2d64; 0x005ac9e7 is the allocation-size query helper for that same dynamic table, and 0x005a6649 is the local CRT heap-region descriptor probe that lets 0x005ac9e7 avoid HeapSize on the small-block fast path. The shared rounding leaf under both the overlay and math families is explicit now too: 0x005a10d0 is the signed float-to-integer helper reused by the later quantized-origin, height-bias, and layout-state callers. Their default local fallbacks are now bounded too: 0x0056c8ba, 0x0056caf7, and 0x0056cfa9 sample the primary cubic basis over four vec2, vec3, and vec4 control points; 0x0056c972, 0x0056cbcf, and 0x0056d0a4 do the same for the alternate cubic-basis family; and 0x0056ca50, 0x0056cccf, and 0x0056d1c6 are the lower-dimensional affine blend helpers computing p0 + s*(p1-p0) + t*(p2-p0) for vec2, vec3, and vec4. So the support-family boundary is tighter now: the older x87 seam is not another anonymous math island, it is the dispatch-layer predecessor of the later 0x00582320..0x005827c0 and 0x005897a2..0x0058a6c5 interpolation families. The same seam also owns the older scalar matrix-transform siblings: 0x0056ce53 -> 0x0056f496 is the x87 forward projective apply owner matching later 0x00589bb7, 0x0056ce64 -> 0x0056f623 is the inverse-side x87 projective sibling matching later 0x00589d3f/0x00589f67, and that inverse-side owner now has its own broader x87 inverse seam too: 0x0056d8d9 -> 0x0056d8df is the second x87 4x4 inverse variant with optional determinant outparam, matching the later inverse helpers 0x00581db0, 0x00588bd0, and 0x005892aa. The same strip still owns the earlier transform helpers too: 0x0056cd2f -> 0x0056cd42 is the x87 vec3-basis-plus-translation to vec4 helper matching later 0x00581830, 0x0056cde0 -> 0x0056cded is the translation-free vec3 basis helper matching 0x00581770, 0x0056f0d7 -> 0x0056f0e4 is the x87 full-vec4 basis helper matching later packed helper 0x00583320, 0x0056ce75 -> 0x0056ce82 is the x87 4D cross-product seam matching later 0x005821d0, 0x0056d2f6 is the scalar x87 4x4 determinant helper matching later 0x005828e0, 0x0056d23d -> 0x0056d24a is the first x87 4x4 multiply predecessor of the later packed or MMX multiply families, and 0x0056d689 -> 0x0056d696 is the broader alias-safe x87 4x4 multiply sibling paired with local copy helper 0x0056d61c. The local constructor side is tighter now too: 0x0056dc6c -> 0x0056dca0 is the x87 4x4 scale-matrix seam matching later 0x00585e7c, 0x0056dd2a is the x87 translation-matrix constructor reused by the 0x00570e8e/0x00570f0a composition owners, 0x0056dd8c -> 0x0056ddae is the x87 single-angle X-axis rotation-matrix seam, 0x0056de28 -> 0x0056de4a is the matching Y-axis seam, and 0x0056dee1 is the local Z-axis constructor in the same strip. The quaternion side is bounded now too: 0x0056e8c3 -> 0x0056e8d6 is the x87 quaternion-product seam matching later 0x00582d10, 0x0056e96c -> 0x0056e97f is the x87 vec4 normalize-or-zero seam matching later 0x00584379, and 0x0056ea38 -> 0x0056ea4b is the x87 quaternion-inverse seam matching later 0x00582e40/0x00584c41. The earlier quaternion construction side is explicit now too: 0x0056e7b6 -> 0x0056e7ea is the x87 three-Euler-angle-to-quaternion seam matching later 0x00582fd0/0x005848ba, 0x0056e092 -> 0x0056e098 is the x87 quaternion-to-4x4 rotation-matrix seam matching later 0x00582c30/0x00584010, and 0x0056f882 is the direct x87 Euler-to-matrix owner that composes those two helpers. The nearby conversion bodies are bounded now too: 0x0056eb05 converts one quaternion into scaled-axis form, while 0x0056eb89 converts scaled-axis back into a quaternion and matches the later MMX helper 0x00584d4c. The curve side is explicit now too: 0x0056ec24 -> 0x0056ec4e is the x87 quaternion-slerp seam matching later 0x005849eb, 0x0056ed5b is the x87 quadratic nested-slerp helper matching later 0x00584baf, and 0x0056edc3 -> 0x0056edf2 is the two-parameter nested-slerp seam matching later 0x00584b22, and 0x0056fd08 is the broader four-quaternion owner that flips neighboring inputs into one hemisphere, converts the two relative quaternions around q1 and q2 into scaled-axis form, averages them with fixed scalar -0.25f, converts that average back into a quaternion, and produces the two inner quaternion spline-control outputs. The adjacent plane builders are bounded now too: 0x0056efe3 -> 0x0056ef41 is the x87 plane-versus-segment intersection seam matching later 0x00582820, 0x0056eff0 copies one caller normal vec3 into plane output and derives the signed plane constant from one caller point vec3, and 0x0056f028 -> 0x0056f035 is the x87 three-point plane seam matching later 0x005829b0. The older plane-matrix seam is explicit now too: 0x0056ee8a -> 0x0056ee90 is the shared x87 vec4 normalize-or-zero seam used to normalize caller plane vec4s, 0x0056fb6f is the x87 plane-driven projective-matrix helper matching later 0x00582aa0/0x00583e80/0x00585b9b, and 0x0056fc49 is the x87 plane-reflection matrix helper matching later 0x00585c86. The lower-dimensional transform side is explicit now too: 0x0056f183 and 0x0056f337 are the x87 vec2 and vec3 normalize-or-zero helpers, 0x0056f7c9 is the adjacent second x87 vec4 normalize-or-zero variant with the same near-unit fast path, 0x0056f210 is the x87 2D-basis-plus-translation-to-vec4 helper matching later 0x00581690/0x0058a0b8, 0x0056f27b is the x87 2D projective sibling matching 0x005816d0/0x0058a146, 0x0056f2fb is the translation-free x87 2D basis helper matching 0x00581730/0x0058a10d, and the nearby scalar-trig seam is explicit now too: 0x005a2ee0 is the older x87 exp seam, and its clean-state branch now resolves concretely into the SSE2 pair 0x005acaf0/0x005acb08, while 0x005a2f70 and 0x005a3040 are the sibling x87 acos and tan helpers that stay on the local x87 bodies instead of using that SSE fast path. The same support strip also now has the optimized power pair grounded: 0x005aad20/0x005aad39 are the x87-to-SSE bridge and SSE2 core beneath 0x005a1b60. These seams sit on the same older status-report path rooted at 0x005a76ee/0x005a77f7, whose local helper strip is now explicit too: 0x005a7650 is the x87 2^x rebuild helper used after fyl2x, 0x005a7665 loads one masked-exception x87 control word while preserving rounding control, 0x005a7695/0x005a76d8 are the paired load-or-classify helpers for scalar f64 inputs, 0x005a76ee restores the saved control word on the clean exit, and 0x005a76fb/0x005a77e0/0x005a77f7 are the shared precision-check and math-error report owners. The older CRT report seam beneath them is grounded now too: 0x005acdb0 is the common runtime-error or math-error message emitter by code, 0x005acf27 is the banner-pair wrapper above it, and 0x005acf60 is the registered floating-point exception dispatcher that maps Windows exception codes like 0xc000008e and 0xc0000093 into the local runtime math codes before falling back to UnhandledExceptionFilter. The adjacent startup-side helper 0x005ad0c4 is the shared program-name-tail extractor from the raw command line. The same older report family is tighter one layer deeper too: 0x005b08ba is the common matherr-style report formatter and dispatcher under 0x005a77f7/0x005a790a, while 0x005b09b8 is its default hook stub that simply returns zero before the path falls through to the default runtime-message emitter. The older exp fallback seam is explicit now too: 0x005a7480 and 0x005a74e7 are the unary and binary x87 special-case dispatchers driven by fxam and the state table at 0x0062a4bc, 0x005a787e and 0x005a7a51 are the unary fallback bodies that reach them from st(0) or one stack f64, 0x005a790a is the shared finalize-or-report owner, and 0x005a7a84 is the stack-side f64 loader or special promoter beneath that path. The SSE2 side now has its small exception tails grounded too: 0x005acd7e is the moderate-input roundtrip tail under 0x005acb08, while 0x005acd13 is the larger finite or non-finite ladder that returns the fixed overflow or underflow constants, pass-through infinities, or the shared report path. The next startup seam is tighter now too: 0x005ad1f4 is the shared argv parser and byte-count helper that honors the CRT multibyte lead-byte table, 0x005ad360 is the two-pass argv owner above it, 0x005ad402 is the multibyte environment-block materializer using the wide API when available, and 0x005ad12d is the filtered envp-table builder that skips leading-= entries. The adjacent locale-conversion seam is explicit now too: 0x005b0b06/0x005b0bc6 are the core and current-thread-locale wrappers for one multibyte-to-wide character conversion, 0x005b0c1b/0x005b0c7b are the matching wide-to-multibyte pair, and 0x005b0bf1 is the small CRT file-handle text-mode flag probe that sits immediately beside them. The neighboring older-CRT stream strip is tighter too: 0x005a16f4/0x005a1740 are the nolock and lock-scoped close owners for FILE-like streams, 0x005b09bb is the broader stream-table cleanup sweep under CRT lock slot 1, and 0x005b0a56/0x005b0a9a are the pushback-buffer allocator and single-byte pushback helper. The next helper strip beside that is explicit now too: 0x005b0cb0 is the unsigned u64 divide-with-remainder helper, 0x005b0d45 is the tiny x87 round-to-integral shim, 0x005b0d58 maps DBCS codepages to default LCIDs, and 0x005b0d87 resets the older CRT multibyte-locale tables before the broader bootstrap owner takes over. That owner is grounded now too: 0x005b0db0 rebuilds the active-codepage multibyte classification and case tables, 0x005b0f42 is the refcounted current-thread locinfo getter under CRT lock slot 13, 0x005b0fb1 configures the global multibyte tables for one codepage, 0x005b1147 is the sentinel-aware public codepage-set owner above that, and 0x005b1297 is the one-shot ANSI codepage bootstrap wrapper. One older bootstrap layer is explicit now too: 0x005adfbe builds the active codepage character-type tables or installs the ASCII fallback through globals 0x0062abd8, 0x00dba760, 0x00dba764, and 0x0062acf0, while 0x005aec88 is the shared GetStringTypeW/A bridge beneath both that owner and 0x005b0db0. The adjacent leaf 0x005b16ef directly queries the default ANSI codepage for one LCID through GetLocaleInfoA(0x1004). The adjacent older locale-aware compare seam is explicit now too: 0x005a57cf and 0x005a5f26 are the shared current-locale casefolded strcmp and bounded-compare siblings, 0x005a5838 is the per-byte or DBCS-pair casefold helper beneath both, and 0x005a5900 is the one-byte current-locale wrapper used by the nearby numeric text and string-hash helpers. When locinfo field [+0x14] is absent, the two compare owners fall back to plain ASCII casefolded comparators 0x005b0040 and 0x005b0100; otherwise they route folding through 0x005ac579, so this strip now reads as the older locale-aware compare family rather than anonymous text glue under the locale selectors and shell name lookups. The same local text seam now has the paired legacy numeric-text normalizers too: 0x005a5fa5 inserts the active decimal separator before the exponent marker in place, 0x005a5fe1 trims trailing zeros and an optional decimal separator before the exponent or terminating NUL, and 0x005a602c is the adjacent fixed threshold predicate installed into the same five-slot legacy math dispatch table rooted at 0x0062a360. The adjacent older decimal-conversion strip is bounded now too: 0x005b0485 and 0x005b04c8 parse ASCII numeric text through 0x005b12b5 and convert the resulting decimal record into two-dword or single-dword integer outputs through the fixed-table wrappers 0x005b0459/0x005b046f, while 0x005b050b materializes rounded significand digits into ASCII, 0x005b0582 normalizes one x87 extended value into the local compact float-record form, and 0x005b063c bridges that normalized record into the shared digit-builder path used by the adjacent legacy numeric-format owners. That owner layer is explicit now too: 0x005a6046 is the small parse-to-single-or-pair-integer dispatch entry, 0x005a614f is the scientific formatter over one x87 extended input, 0x005a625f is the fixed-format sibling, 0x005a62c7 is the general-format owner that chooses between them, and 0x005a6367 is the style-dispatch wrapper over e/E/f and the remaining general-format lane. The neighboring x87 control-word strip is explicit now too: 0x005b06b7 maps one raw x87 control word into the older CRT abstract control-mask space, 0x005b0749 rebuilds the raw x87 word from that abstract mask, 0x005b07d7 is the merge-and-apply owner over current state plus caller (value, mask), and 0x005b0809 remains the narrow wrapper that forces bit 0x80000 clear before applying the update. The next numeric seam is grounded structurally too: 0x005b12b5 is the shared ASCII floating literal parser into the older 12-byte decimal record, 0x005b2045 accumulates the digit string into that record, and 0x005b279c scales it by a signed power-of-ten exponent. 0x0056f3d7 is the x87 3D projective sibling matching 0x005818f0/0x00589960. 0x0055dd80 is the small direct release helper for subordinate layout-state field [owner+0x2d], and 0x0055e060 is the wider owner teardown that releases the surrounding handle bands and the same subordinate layout-state object before the family falls back to the higher-level shell teardown path. The geographic-label text side is tighter now too: beneath shell_emit_geographic_label_text_span 0x0053a960, the support strip 0x0053b090, 0x0053b390, 0x0053b590, and 0x0053b5c0 now reads as one banked fixed-record loader and keyed lookup family with a small recent-query cache plus a string-hash helper. The static load loop at 0x0053ce09 seeds those banks from the pointer table rooted at 0x00624e48, while the lookup core partitions rows by key & 0x1f into 32 per-bank buckets and keeps a 10-entry recent-query cache rooted at [this+0x4290c]. The adjacent stream and staging side is bounded too: 0x0053b630/0x0053b690/0x0053b6f0/0x0053b7c0/0x0053b830 now read as the current-entry ordinal resolver, current-stream close/open helpers, and the shared byte-read strip, while 0x0053b850/0x0053b8d0/0x0053b920/0x0053b970 own the local 13-byte staging-table growth, type-7 service passes, and bucket-chain reset. The next owner layer is tighter now too: 0x0053b9e0 is the broader Pack System Leak Count : %1 report-and-reset pass, releasing the four owned report-slot roots at [this+0x429b0..+0x429bc] plus sibling global 0x00ccba50, formatting staging-row fields through 0x0051b700, publishing them through callback slot 0x005c8078, then tearing the staging slab and all per-bank handles back down. The keyed query side now extends cleanly beyond raw lookup: 0x0053bd40 seeks the selected-or-current payload stream and returns the handle, 0x0053be10 resolves or lazily opens one keyed typed auxiliary object including a descriptor rooted at data\\Other\\AirplaneTypes.txt, 0x0053c930 is the composite-string lookup wrapper, and 0x0053c9c0 is the matching payload-length resolver. The local row side is now first-class too: 0x0053bf60, 0x0053c000, and 0x0053c070 release, drop references on, and acquire-or-create refcounted staging rows with typed payload roots at [row+0x09], while 0x0053c900 resets the adjacent stream-plus-recent-query-cache strip. 0x0053ca20/0x0053ca90 now bound the current-selection push/pop frame stack at [this+0x20428], and 0x0053cb10 is the small two-u32 plus optional heap-blob reader sitting directly on top of the shared byte-read helper. The broader bootstrap owner is tighter too: 0x0053cb60 zeroes the whole family, allocates the four owned report slots, walks the static root-pointer table 0x00624e14..0x00624e48, loads banks through 0x0053b090, and then routes selected keys such as companyLogo, portrait, and trainSkin back through the typed-object strip into those report slots. The nearby wrappers 0x0053d0f0/0x0053d110 are just the string-keyed type-1 and type-6 staging-row acquire helpers above 0x0053c070. The adjacent 0x0053d130 is tighter now too: it strips one caller path to the final basename, derives a second stem copy through 0x0051d8a0, gates on support_query_path_is_openable_for_read 0x0051e430, and only then refreshes one type-7 staging row through 0x0053c710 before resetting owner dword [this+0x427b0] = -1. Immediately after that, the local utility strip 0x0053d1d0..0x0053d470 now resolves as one scored binary-heap plus scored-node queue family: 0x0053d1d0/0x0053d240/0x0053d2e0/0x0053d300 are the heap reorder and top-score helpers, while 0x0053d320/0x0053d390/0x0053d440/0x0053d470 are the queue acquire, pop-highest, membership, and release-side helpers. The sibling heap-owner body now lands too: 0x0053d4c0/0x0053d540/0x0053d5d0/0x0053d630 are the pooled scored-heap insert, pop-top, release, and construct-with-capacity paths over the same score-at-+0x04 node shape. The adjacent extended owner is now bounded too: 0x0053d6f0/0x0053d740 are the release and construct-with-capacity paths for the sibling scored-heap owner that carries one extra sentinel header at [this+0x10] plus best-score lane [this+0x14], and current callers are the hotkey report iterator 0x0045f250 and the nearby shell/runtime owner around 0x00522c67. The next support strip is tighter too: 0x0053d810/0x0053d870 are the CRC32-like NUL-string and fixed byte-span hash helpers over table 0x00624e48, while 0x0053d8a0/0x0053d960/0x0053d9e0/ 0x0053daa0/0x0053dae0/0x0053db20/0x0053dbf0 now resolve as one intrusive u32 -> ptr hash-table family with optional pooled 0x10-byte nodes: release, insert, remove-and-return, contains, lookup, callback iteration, and construct-with-bucket-count-and-node-capacity. That family is already grounded on real world owners too, not just support-side data-structure shape: connected-component and local bucket maps under 0x00416170/0x00419110, selected owner hashes under 0x00531ef0, and the shell-side cleanup owner around 0x00522e7e all use the same pooled hash helpers. Beneath both the scored heaps and that hash family, 0x0053dcb0/ 0x0053dcf0 are now bounded as the shared fixed-stride pool-descriptor release and reset helpers, with freelist seeding over caller stride and count rather than one owner-family-specific allocator. The next typed payload branch in the same banked-record family is tighter now too: row type 6 is no longer just “some constructor under 0x0053c070”. 0x0053ee70/0x0053e370 now read as the construct wrapper and full constructor for one shell image-marker payload that parses a grounded keyword set from the banked record text (Image, ImageWH, ImageWHForceScale, ImageWHWithRef, ImageScaled, ImageWHScaled, MaxPercentOfInterfaceVRAM, MaxPercentOfInterfaceVRAMToUse, Scaleable, TGATargetScreenHeight, TGATargetScreenWidth, TGAHeight, TGAWidth, TGAName, HorizontalScaleModifier, VerticalScaleModifier), registers one shell helper token through [0x006d401c+0xc69], and then hands off to 0x0053de60. That heavier sibling is now bounded as the payload's screen-metrics and VRAM-policy variant-table refresh owner: it derives current screen-space scale from shell display state, resolves one selected TGA or DDS resource through 0x0053c1c0, and rebuilds the live variant array [this+0x24] through 0x005520a0 for later consumers such as shell_queue_world_anchor_marker 0x00552560. The rebuild and release side is explicit too: 0x0053e2b0 releases current variants and the loaded image handle before tail-jumping back into 0x0053de60, while 0x0053e2e0/0x0053ee60 are the real destructor and release thunk for the same type-6 payload family. The nearby overlay builders are tighter now too. 0x00478200 is no longer just a generic single-marker wrapper: it validates owner id [this+0x11b] against collection 0x0062bae0, resolves that live city-database-style owner, samples normalized XY through 0x00455800 and 0x00455810, derives one localized label through 0x0053de00([this+0xaf],2), measures projected half-height through 0x00477a10, and then queues the finished marker through 0x005521a0/0x00552160/0x00552560. The broader sibling 0x00478330 now reads as the real active-mode overlay-list owner: it derives the current world-space view box from [this+0xc3/+0xc7/+0xcb/+0xcf] plus live world dims, runs six category passes 0..5, pulls one active-mode collection through 0x005130f0 -> 0x004b2b70 or 0x0050f600, walks live placed structures in 0x006cec20 through 0x0047fd50, 0x0047df30, and 0x0047df50, and emits one repeated label-marked overlay stream through 0x00477a10, 0x004779c0, and 0x00552560. After those category passes it also walks 0x006cfcbc and can add one final focused-region marker from [this+0x113] through 0x0048a170 with label id 0x3c. The local overlay-state helper strip under those builders is tighter now too. 0x00477af0 is the actual default reset for the state band [this+0xa3..+0x11f], seeding minimum span floor [this+0x11f], default cell bounds [this+0xbb/+0xbf/+0xcb/+0xcf], scale lanes [this+0xd3/+0xd7/+0xdb], and normalized rect [this+0xef/+0xf3/+0xf7/+0xfb]. 0x00477a70 is the paired scaled-max-span helper over the rebuilt cell bounds, while 0x00478dc0 and 0x00479510 are now bounded as the two heavier owner passes above that strip: the first rebuilds world-cell bounds and normalized rect from mode flags, raster bit 0x02, and optional placed-structure scans, while the second clamps and recenters those bounds and then refreshes the normalized rect again after drag- or zoom-side updates. One input-side owner is bounded now too: 0x00477c10 maps one screen-space point into a world-cell pair under the current overlay-state bounds, and the larger sibling 0x00478cb0 is the drag-side loop above it that repeatedly applies those deltas through world_view_apply_screen_delta_to_focus_position 0x0043d0c0 before re-entering the same overlay-state rebuild or clamp family. The next query above that is tighter now too: 0x00479b50 is the nearest-target resolver for this overlay family, first searching placed structures in 0x006cec20 through 0x0047df30/0x0047df50 and 0x0051db80, then optionally falling back to regions in 0x006cfca8 through 0x0048a170 when the shell-side metric flag bit 0x4 is set. The click-side owner above that is bounded now too: 0x00479d30 first maps the cursor through 0x00477c10, resolves the nearest target through 0x00479b50, then either publishes restriction notices 0x0c12/0x0c13, forwards one compact selector-0x384 request into the Multiplayer preview owner at 0x006cd8d8, or dispatches that same local target through the active-mode handler pair 0x004b3160/0x004b2c10 before easing the shell scalar tail through 0x0045ea20. The broader raster owner above this branch is bounded now too: 0x0047a120 first stages one visible overlay rect through 0x00534930/0x00534c50, optionally allocates the target RGBA buffer, and then rasterizes the visible map window through the world classification helpers 0x00534e50, 0x00534f00, 0x00449bd0, and 0x00448aa0, mapping the result through palette table 0x005f2c34 and finally marking city-database owners from 0x0062bae0. The small constructor strip under that raster owner is tighter now too: 0x0047b070 and 0x0047b0d0 are the two concrete constructors for vtable 0x005ce840, both reusing 0x00477af0 for default state and then seeding the trailing template byte [this+0xa2]. The release and service strip under the same vtable is tighter now too: 0x0047b110 drops template handle [this+0xaf] and surface root [this+0xab] before tailing into the base release; 0x0047b170 is the main service body that refreshes bounds through 0x00479510, draws the current overlay surface, and then queues either the repeated marker list 0x00478330, the single city-database marker 0x00478200, or the fallback quad path 0x00477d80; and 0x0047b3d0 is the narrow wrapper that reruns 0x0047a120 into a temporary raster target and commits the result back into live surface handle [this+0xab]. The next local owner strip is tighter now too: 0x0047b470 ensures surface handle [this+0xab] by deriving zoom-scaled requested dimensions from the current shell zoom table at [0x006d4024+0x11421e], growing them as powers of two under controller caps, allocating one 0xec-byte surface owner through 0x00543980, and immediately rerasterizing through 0x0047b3d0; 0x0047b5e0 is the hover-update sibling that either tracks hovered classification id [this+0x117] under overlay flag 0x00400000 or refreshes nearest target ids [this+0x10f/+0x113] through 0x00479b50 before forwarding the live cursor band into 0x00558760; and 0x0047b720 is now bounded as the main message dispatcher for the same family, with current grounded cases for id 6, refresh pair 0xba/0xbb, and scalar-update id 0xbc, dispatching into the click owner 0x00479d30, the drag owner 0x00478cb0, the ensure-surface path 0x0047b470, the reraster path 0x0047b3d0, and the bounds rebuild owner 0x00478dc0. The adjacent global marker strip is tighter now too: 0x0047ba60 clears the ten-entry global pointer-marker slot table at 0x006ceba4, 0x0047bb90 is the matching release loop, and 0x0047ba80 rebuilds one indexed slot by constructing a 0x26e-byte specialization-root object through 0x0045b680, seeding it from literal roots pointer, pointer2, or pointer3 through 0x0045b9b0, publishing the caller world anchor through 0x004556f0, applying scalar 0.8f through 0x00455720, and clearing bit 0x20 in the derived state byte. Current grounded callers are the clustered world-side branches at 0x0051677b, 0x00516797, 0x005167df, and 0x005167fe, so this now reads as a real shell-side global pointer-marker slot family rather than loose specialization constructors. The shared 0xec-byte surface-owner seam beneath those overlay and layout callers is tighter now too. 0x00543080 is the per-owner row-budget refresh pass: unless constructor bytes [owner+0x93/+0x94] stay live or selector token [owner+0x07] already matches the current shell mode token, it revisits the eight row slots [owner+0xa0..+0xbc] through 0x00542fb0, drops rows whose import now fails, marks readiness bytes [owner+0x98..+0x9f] against the caller-supplied byte-budget threshold, derives owner byte [owner+0x06] from the surviving ready rows, and can still re-enter the non-type-2 postprocess owner 0x00542550. 0x00543220 is the broader global service above that pass: it rate-limits itself through 0x0051d890, samples the live shell view matrix from [0x006d4024+0x28], derives one dynamic byte budget from summed camera-motion deltas cached in 0x00ccbb3c..0x00ccbb54, retires stale owners from the intrusive list 0x00ccbb2c, and then revisits the surviving active owners through 0x00543080 when the current budget crosses the local scaled row thresholds. The publish side is tighter now too: 0x005435d0 sits beneath both 0x005438d0 and the layout-slot binding strip at 0x00545520, can lazily ensure selector handle [owner+0x07], then asks the caller-supplied presentation handle to materialize a bound target through vtable slot +0x50, uploads the first ready row plus matching-dimension siblings as a mip-style chain through [bound_handle]+0x3c, frees the uploaded row buffers [row+0x22/+0x26/+0x2a/+0x2e], stamps the current shell mode token back into [owner+0x07], increments active-owner global 0x00ccbb34, and refreshes cached byte totals through 0x00540fc0. The lower cursor-capture strip beneath that input service is tighter now too. 0x00543ae0 and 0x00543b20 are the begin/end pair for the shell cursor-helper object returned by 0x0051f0b0: the first sets active byte [+0x08], dispatches vtable slot +0x1c, and snapshots the live shell cursor XY from 0x006d4018+0xa94/+0xa98, while the second clears that active byte, dispatches slot +0x20, and restores one screen-space cursor position from the stored XY anchor through the current shell zoom table and import 0x005c8264. The query side is explicit too: 0x00543ba0 returns the stored-or-live cursor triplet, 0x00543c10 returns the stored-or-live XY pair, and 0x00543c50 is the heavier relative-delta service used by world_view_service_shell_input_pan_and_hover 0x0043db00. That heavier helper queries one current view metric bundle from the helper object, converts the returned deltas into floats, suppresses repeated zero-delta states through 0x00ccbb5c/0x00ccbb60, accumulates the motion into stored XY and triplet bands, clamps the XY anchors to [0.0, 1.0], derives one local edge-flag mask, and forwards the resulting state into 0x0054eb90 when live shell input is present. The owned-object seam is explicit now too: 0x00543a10 is the constructor-side initializer that seeds half-XY defaults and binds the two owned helper objects, while 0x00543e60 is the paired release helper that first ends capture and then drops both owned objects through their +0x08 destructors. The tiny live-input gates beneath the same world-view predicates are explicit now too: 0x00543e00/0x00543e20/0x00543e40 are the three direct tests over shell input word [0x006d4018+0xa8c], masking bits 0x400, 0x2000, and 0x800 respectively for the primary and secondary pan-channel branches. The adjacent layout-state bridge in the 0x52be..0x52c0 setup strip is bounded too: 0x00543e80 is the fixed node-slot-+0x90 publish helper for selector 3 with unit scalar 1.0f, 0x00543ee0 is the fixed selector-2 sibling, and 0x00543ea0 is the optional RGB-plus-scalar helper that can reuse cached color [layout+0x25a3] before publishing the same selector-3 block into bound node [layout+0x25df]. That keeps the label side grounded as a real support-family database strip rather than a loose collection of anonymous bootstrap helpers. If shell-state gate [0x006cec74+0x174] is set it then posts id 320 Setting Up Buildings... for world_region_collection_run_building_population_pass 0x00421c20; if [0x006cec74+0x178] > 0 it then posts id 321 Seeding Economy... for simulation_run_chunked_fast_forward_burst 0x00437b20; only after those setup-side gates does the code post id 319 Setting up Players and Companies.... That 319 lane is no longer just a shell-state placeholder: its earlier hidden prepass is tighter now too: 0x00437737 is the scenario-side named candidate-availability seeding pass over the live candidate pool 0x0062b268, feeding the override collection at [state+0x66b2] through 0x00434f20 before any visible banner is posted. That grounded write path is narrower than the static file evidence, though: the startup reset helper world_runtime_reset_startup_dispatch_state_bands 0x004336d0 explicitly clears [state+0x66b2] before the dispatch path begins, and the current exported write-side callers we can name after that reset are still just the live-pool preseed 0x00437737, the sibling startup lane 0x00436ad7, and the editor-side Industry (Overall) toggle handler 0x004cf430 through 0x00434f20. So while the fixed 0x6a70..0x73c0 candidate-availability block is now well grounded as bundled map/save source data, a direct bulk-import path from that block into the live runtime collection [state+0x66b2] is still not grounded by the current disassembly notes. That candidate-side table now has a grounded fixed record layout too: each entry is a 0x22-byte blob with a zero-terminated candidate-name slot at [entry+0x00..+0x1d] and one trailing availability dword at [entry+0x1e], read through 0x00434ea0 and mirrored later into [candidate+0x7ac]. The candidate support strip around that latch is tighter now too: 0x00412c10 walks the live candidate pool, forces [candidate+0x7ac] = 1 whenever availability bytes [candidate+0xba/+0xbb] are already set or subtype [candidate+0x32] is not 2, and only for the remaining subtype-2 cases does it consult 0x00434ea0 by candidate stem before tailing into structure_candidate_collection_refresh_cargo_economy_filter_flags 0x0041eac0. The neighboring collection helpers now read cleanly too: 0x00412bd0 is the collection-wide 0x00411ee0 cargo-summary rebuild sweep over already-materialized 0xbc descriptor strips, and 0x00412ba0 is the remove-and-release sibling that clears one candidate's dependent runtime descriptor and cargo-membership tables through 0x00411cb0 before erasing that id from the pool. The same pool now has an explicit destroy-side wrapper too: 0x00412a90 resets the collection vtable to 0x005c93cc, releases the indexed live-entry storage through 0x00518600, and tails into the common indexed-collection cleanup 0x00518bd0. The global teardown branch at 0x00434480 uses that wrapper immediately before freeing the live candidate-pool object at 0x0062b268, so the pool lifecycle is now bounded on both the rebuild and destroy sides instead of only on the rebuild path. The auxiliary-owner side is tighter now too: 0x00413dd0 resolves one auxiliary entry's owner candidate through dword [entry+0x173] and reuses the same current-year gate 0x00412510, while 0x00413d80 only succeeds for subtype-1 owners and copies candidate words [candidate+0xcb] and [candidate+0xcd] into the projected-footprint helper family. The same scenario state keeps a locomotive-side sibling collection at [state+0x66b6], read through 0x00435030 and updated through 0x004350b0, which is now the shared named locomotive-availability lane beneath the Locomotives editor page and the startup-side locomotive seeding branches. That locomotive-side table is the same pattern at a larger width: each entry is a 0x41-byte blob with a zero-terminated locomotive-name slot at [entry+0x00..+0x3c] and one trailing availability dword at [entry+0x3d], later mirrored into [loco+0x7b]. Both override dwords now read most safely as simple availability bits rather than wider mode enums. That 319 lane is no longer just a shell-state placeholder: its primary grounded work is still the chairman-profile pair world_seed_default_chairman_profile_slots 0x004377a0 plus world_build_chairman_profile_slot_records 0x00437220, which seed the 16 selector bytes at [0x006cec7c+0x87], materialize the per-slot chairman records from the scenario selectors, campaign override flag [0x006cec7c+0xc5], and the static persona table at 0x005f2d28, and then publish the selected chairman-profile and linked company summary pair through [state+0x25] and [state+0x21]. The local slot-record shape is tighter too because the shell editor panel around 0x004cc2d0 now surfaces it directly: [slot+0x00] is the staged chairman profile id, [slot+0x01] is the Optional-versus-Mandatory byte with nonzero=Optional and zero=Mandatory, [slot+0x02] combines with the separate per-slot gate at [world+0x0bc3+slot*9] to surface Human, Computer, and Human or Computer, [slot+0x03] is the special occupied-seat byte, and [slot+0x04] is the numeric tuning field. Both the selector seeder and the record materializer treat either [slot+0x02] or [slot+0x03] as enough to keep a slot live, but current grounded writes only seed [slot+0x03] on slot zero and later move it solely by whole-record compaction. That makes [slot+0x03] the strongest current anchor for the distinguished primary-human-seat flag rather than a generic role byte. The summary fields are tighter too: current direct accessors now show [state+0x25] as the selected chairman profile id in 0x006ceb9c, while [state+0x21] is the linked owning company id copied from [profile+0x1dd] through scenario_state_set_selected_chairman_profile 0x00434890. The raw id strip under those record helpers is tighter now too: 0x004337a0 reads [state+0x21] directly as the selected company id, 0x004337b0 reads [state+0x25] directly as the selected chairman profile id, and 0x00433790 is the paired raw selected-company setter that the company and chairman reassignment flows use when the visible ownership summary changes without re-entering the full profile setter. The underlying profile constructor family is grounded now too. 0x00476140 is the broad named-profile constructor beneath both chairman seeding passes: it stores the caller id at [profile+0x00], marks the record live through [profile+0x04] = 1, seeds byte and guard lanes across [profile+0x291..+0x295] and [profile+0x1e1], zeroes the large per-company and tail bands [profile+0x2ab..] and [profile+0xc66..], copies the caller byte into [profile+0x15c], seeds [profile+0x158] to 7.763f, formats localized fallback name 0x0b87 when the caller name is empty, copies the caller biography into [profile+0x27], and picks one static persona row through 0x004760f0. That helper is now bounded as the wrapped-unused-row allocator over the static persona table at 0x005f2d28, marking one zero flag byte at stride 0x27 after a modulo-0x29 search. The neighboring raw company-slot strip is explicit too: 0x004760a0 resolves indexed dword slot [profile + company_index*4 + 0x2ab] when the caller's generation stamp differs from [profile+0xc43], and 0x004760c6 is the paired store-side helper for the same slot plus optional stamp write. The adjacent profile-metric strip used by the player-list page is tighter now too: 0x00476320 sums the per-company holding band [profile+0x15d..] against either cached company scalar 0x00423eb0 or the broader support-adjusted company scalar 0x00424fd0, while 0x004763b0 folds those same per-company contributions through one extra thresholded transform before accumulating them. The active-profile collection helpers are direct now too: 0x004778c0 returns the live record id of the Nth active chairman profile, and 0x00477920 counts how many active chairman profiles precede one caller-selected live record id. The neighboring transaction and cached-metric strip is tighter now too. 0x00476780 is the direct-total-plus-cash query (0x00476320 + [profile+0x154]), while 0x00476c20 is the threshold-adjusted-total-plus-cash sibling (0x004763b0 + [profile+0x154]). 0x004767a0 selects between raw cash [profile+0x154], the direct holding total, or their sum, and 0x00476810 caches selectors 0 and 1 into the local qword band rooted at [profile+0x1e9]. The trade-side helpers now split cleanly too: 0x00476460 is the sell-side mutator that reduces one company holding slot [profile + company_id*4 + 0x15d], converts the resulting proceeds through 0x00424fd0(-units,1), and adds the scaled result back into [profile+0x154]; the buy companion is 0x00477110, which first reuses the feasibility gate 0x00476ff0, then increases that same holding slot and subtracts the scaled purchase cost from [profile+0x154]. Between them, 0x00476e50 computes the rounded 1000-sized trade block by mode, and 0x00476ff0 performs the actual buy-affordability check against current cash plus an optional direct-holdings fallback; the reduction-side sibling 0x00476c40 uses the same threshold-adjusted-total-plus-cash lane from 0x00476c20 as its optional fallback when the direct holding slot is too small. One broader periodic scalar is grounded now too: 0x00476560 walks raw issue 0x39 through scenario_state_sum_issue_opinion_terms_raw plus the scenario baseline at 0x00433740, clamps the resulting factor against several [profile+0x154] thresholds, and then adds the final scaled delta back into [profile+0x154]; current grounded caller 0x0040a760 applies that adjustment across every active chairman profile before the later trigger-kind-2 pass. The adjacent start-new-company gate is explicit now too: 0x00476d10 first rejects through localized id 2952 You're not able to start a new company. when scenario gate 0x00476a60 is active; otherwise it treats 0x004763b0(1) + [profile+0x154] as the relevant purchasing-power lane, succeeds only when that total reaches threshold 0x005c8830, and on failure formats the richer localized warning 271 You don't have enough money to start a new company!... using the selected chairman profile's current purchasing-power figure from 0x004348c0. The adjacent persona-row lookup strip is partly explicit now too: 0x00476bb0 returns the matched static persona row index for current profile stem [profile+0xc47], while 0x00476b30 returns the same matched row's +0x20 asset-stem pointer or falls back to [profile+0x20], and 0x00476ab0 is the structural +0x40 string-pointer sibling for that same row family. The adjacent chairman refresh owner is tighter now too: 0x00433850 uses the guard pair 0x0062be20/0x0062be1c to walk the active-chairman collection through 0x00477820/0x00477860 -> 0x004771e0 until no nested mutation asks for another pass. The editor-side scenario setup surface beside that chairman panel is clearer now too. map_editor_scenario_metadata_panel_refresh_controls 0x004ca790 republishes the scenario description from [0x006cec78+0x672e], the start-year trio [+0x66ca], [+0x66d2], and [+0x66ce], the direct campaign-designated bit [+0x66de] through control 0x5b6e, and the inverse of the paired metadata byte [+0x66f3] through control 0x5b74. The resource-side anchor is now explicit too: editorDetail.win carries localized ids 3160/3161 Campaign Scenario and If checked, this map will be reserved as a campaign scenario. inside the control record rooted at 0x5b6e, so [+0x66de] is now the grounded campaign-scenario flag rather than an anonymous metadata boolean. map_editor_scenario_metadata_panel_refresh_briefing_mode 0x004ca670 now bounds the single-player versus multiplayer briefing switch by flipping selector 0x621f50, publishing localized headings 1491 and 3586, and refreshing the two briefing texts from [state+0x4f30] and [+0x5ae9]. The companion dispatcher map_editor_scenario_metadata_panel_handle_message 0x004cb4a0 makes the year semantics tighter too: it commits the description and both briefing texts from edit-control payloads, toggles the same two booleans, and clamps the three year fields to 1829..2100 while maintaining minimum <= default <= maximum, which now lines up directly with the editor strings Description: Minimum Start Year: Default Start Year: Maximum Start Year: Briefing and Multi-Player Briefing. The neighboring special-conditions page is clearer as well: map_editor_scenario_special_conditions_panel_construct 0x004cb2b0 now grounds the live owner for the Setup_Options_Buttons.imb list rooted at 0xa7fa, walks the 49-entry static rule table at 0x005f3ab0, counts enabled flags from [0x006cec78+0x4a7f], and publishes the Special Conditions In Effect summary from localized id 1053. The same page now has a bounded live dispatcher too: map_editor_scenario_special_conditions_panel_handle_message 0x004cb8e0 handles both bulk selection controls and direct row-state changes, commits them back into [0x006cec78+0x4a7f], and then re-enters the panel constructor to refresh the summary. That table is no longer just a raw id run; it now clearly includes the finance and construction restrictions 2535..2563, plus later editor toggles such as Use Bio-Accelerator Cars, Disable Cargo Economy, Disable Train Crashes, Disable Train Crashes AND Breakdowns, and AI Ignore Territories At Startup. The neighboring available-chairman page is tighter too. map_editor_available_chairman_panel_construct 0x004ca540 now bounds the shell-side owner for the 40-entry persona-availability surface under 0x5aa0..0x5b03: it walks the same persona table family at 0x005f2d28, publishes one localized chairman-name row per profile, counts enabled availability bytes from [0x006cec78+0x6987..], and emits the summary %1 out of %2 are selected. from localized id 1035. The live state owner beside it is now grounded as well: map_editor_available_chairman_panel_handle_message 0x004cb6f0 handles three bulk-selection controls 0x5aa1..0x5aa3 by rewriting that same availability-byte array from preset bytes embedded in the persona table, and it also commits direct per-row toggle changes from 0x5aaa..0x5b03 back into [state+0x6987..] before refreshing the page. So the editor lane now has three distinct scenario-setup slices rather than one chairman-only blob: chairman slots, scenario metadata and briefings, plus both a rule-toggle matrix and an available-chairman pool. There is now one adjacent company-side lane too: current neighboring setup flow conditionally enters world_conditionally_seed_named_starting_railroad_companies 0x0047d440 when the Multiplayer preview owner 0x006cd8d8 is absent and either sandbox flag [0x006cec7c+0x82] is set or shell-state flag [0x006cec74+0x14c] is set while editor-map mode [0x006cec74+0x68] is clear. That helper no longer looks like a generic company refresh. It seeds exactly three fixed named railroad-company records from RT3.lng ids 575..577: Missouri Pacific, New York Central, and Grand Trunk Railroad. The first seeded company is tied back to the selected chairman-profile summary and becomes the selected company id. The second railroad is tighter now too: it only receives a chairman link when profile_collection_count_active_chairman_records finds at least two live chairman records, and the helper then binds the zero-based second active chairman through profile_collection_get_nth_active_chairman_record with ordinal 1. The third railroad currently gets no matching chairman-link branch in the grounded setup flow and therefore remains an unchaired named company in the live roster. The shell UI above that setup lane is now tighter as well: shell_company_list_window_construct 0x004c7200 builds a live company-list window over the company collection at 0x0062be10, shell_company_list_window_refresh_rows 0x004c6c30 formats the active companies with localized strings 267..270, and only then conditionally appends one synthetic row id 0x7fff through shell_company_list_format_company_or_start_row 0x004c6b40 so <<Start New Company>> appears as a separate affordance rather than as part of the seeded trio itself. Current shell paging around that same roster is tighter too because the live company collection now has a grounded active-only ordinal helper family: company_collection_count_active_companies 0x00429a50, company_collection_count_active_companies_before_company_id 0x004299f0, and company_collection_get_nth_active_company_id 0x00429990. Those helpers now anchor the “current company among active companies” math used by shell-side detail and picker flows rather than leaving it as anonymous collection glue. shell_company_list_window_handle_message 0x004c6f30 then routes the synthetic row into start_new_company_dialog_open 0x0047d080, whose commit path now grounds through start_new_company_dialog_commit_create_company 0x0047d120. That lower helper unlinks any current chairman-owned company, allocates a fresh company id from the live collection at 0x0062be10, initializes it through 0x00428420, and only then publishes the new selected company. The neighboring compact request helper start_new_company_request_create_company 0x0047d320 does the same fresh-company path from a request block and is already reached from the startup-company branch at 0x00470e48. The dialog side is tighter now too: 0x0047c070 and 0x0047bea0 rebuild the two funding-band globals from the selected chairman profile through 0x00476c20 and 0x00476950, publish their range cards into controls 0x714f and 0x7150, 0x0047c190 republishes the current pair 0x006cec14 and 0x006cec10 into controls 0x7149 and 0x714a, 0x0047c220 snaps those two current funding lanes back onto the active band steps, and 0x0047c360 is the small child-control callback gate over that same funding family. The immediate pre-open helper 0x0047d020 is now bounded too: it seeds the staged dialog name buffer and then runs the same clustered funding-band rebuild sequence before start_new_company_dialog_open continues into the constructor/callback modal path. The constructor and message side are bounded enough now too: 0x0047c590 constructs the modal dialog controls for 0x714f/0x7150/0x7149/0x714a/0x714b/0x714c/0x714d/0x714e, installs callback 0x0047c360 on the funding-band pair, and publishes the live dialog root at 0x006cec18, while 0x0047c3a0 is the main dialog message owner over shell messages 0xca/0xcb, the staged name field 0x714b, the two funding-step controls 0x714c/0x714d, the companion summary lane 0x714e, and the modal notice branch rooted at 0x03f2/0x03f4. The immediate sibling shell branch below that roster is still station-oriented: current grounded resource names and handlers put one branch on shell_station_detail_window_construct 0x005068c0, another on shell_station_list_window_construct 0x005074c0, and the subordinate selector lane on shell_station_pick_window_open_modal_and_return_selected_station_id 0x005078c0 above shell_station_pick_window_construct 0x00507620. But the broader company-detail ownership question is no longer open. There is now a separately grounded CompanyDetail.win family rooted at shell_company_detail_window_construct 0x004c5540, with shell_company_detail_window_handle_message 0x004c56a0 as its main dispatcher and shell_company_detail_window_refresh_controls 0x004c2ca0 as the shared repopulation pass for the selected-company presentation and tabbed control bands around 0x9476..0x9490. A grounded direct shell-command strip now sits cleanly above those two company panels too: 0x00433a40 is the shared availability gate for both the company-list and selected-company-detail lanes, rejecting only when scenario toggle [0x006cec78+0x4aef] is set. 0x004405a0 uses that gate to open detail-panel mode 7 as the direct company-list path, while 0x004405d0 first recovers the selected-company id through 0x004337a0, optionally offers Start New Company through 0x0047d080 after warning 368 when no company is selected, and only then opens detail-panel mode 8 for the selected-company CompanyDetail.win lane. A grounded shell detail-manager caller reaches that constructor at 0x004dde24, the first finance-action layer beneath it is now bounded through shell_company_detail_issue_bond_offer_flow 0x004c3890, shell_company_detail_issue_stock_offer_flow 0x004c3f30, shell_company_detail_buyback_stock_flow 0x004c46d0, and shell_company_detail_change_dividend_rate_flow 0x004c5360, and the first non-finance layer is now bounded too through shell_company_detail_resign_chairmanship_flow 0x004c5a0e, shell_company_detail_bankruptcy_flow 0x004c5b99, the territory-access family rooted at shell_company_detail_refresh_selected_territory_access_summary 0x004c1b60 plus shell_company_detail_buy_territory_access_rights_flow 0x004c5fc9, backed by company_clear_selected_chairman_if_current_profile 0x00428a10, company_declare_bankruptcy_and_halve_bond_debt 0x00425a90, company_has_territory_access_rights 0x00424010, company_set_territory_access_rights_byte 0x00424030, and company_can_purchase_territory_access_rights 0x00426be0, plus the two control-transfer lanes. shell_company_detail_attempt_chairmanship_takeover_flow 0x0050ccc0 now grounds the special chairman's election path: it checks the caller's current stock ownership in the target company, rejects insufficient holdings through localized id 623, rejects recent failed attempts through id 624, and then opens the confirmation under id 625 before seeding the local takeover-election state or packaging the same request through the multiplayer shell transport. The follow-on resolver shell_resolve_chairmanship_takeover_vote_and_commit_outcome 0x0050c940 now closes the single-player election loop too: it walks the active chairman profile collection, computes weighted votes for and against the takeover, compares the affirmative total against half the target-company value, presents the result through shell_present_chairmanship_takeover_vote_outcome_dialog 0x0050c500 in single-player or localized id 3082 in multiplayer, and then either transfers chairmanship through 0x00428a30 or stamps the current year into [company+0x289] as the grounded takeover-cooldown field. shell_company_detail_attempt_merger_flow 0x004ec640 now grounds the merger side too: it rejects empty worlds through id 727, rejects recent failed attempts through id 728, checks the proposed premium against company cash through localized id 3889, and then commits into the resolver family. That merger resolver is now bounded too: shell_resolve_merger_vote_and_commit_outcome 0x004ebd10 walks the active chairman profile collection, computes weighted votes for and against the proposed merger, compares the affirmative total against half the target-company value, presents the result through shell_present_merger_vote_outcome_dialog 0x004eb890 in single-player or localized id 3059 in multiplayer, and then either commits the merger through 0x00427e20 or stamps the current year into [company+0x15f] as the grounded merger-cooldown field. The vote-bias side beneath that resolver is tighter now too: scenario_state_compute_issue_opinion_multiplier 0x00436590 is no longer just an abstract issue table lookup because its merger callsite uses issue id 0x3a, which lines up directly with localized id 726 saying merger votes depend on public attitude toward the management of the two companies. By contrast the broader support-adjusted share-price helper company_compute_public_support_adjusted_share_price_scalar 0x00424fd0 uses issue id 0x37, and the shared setter under that lane is tighter now too: 0x004339b0 clamps one small scenario-side issue value into [state+0x2d] with range 0..4, derives one companion scalar in [state+0x29], and then forces a live-company sweep through 0x00424fd0 so the support-adjusted share-price family is recomputed immediately after the issue lane changes. The finance-side debt helpers now bound 0x38 and 0x39 separately as the explicit credit-rating and prime-rate lanes. That leaves 0x37 as the broader investor-confidence lane behind equity support, share price, and adjacent governance pressure, with the strongest current text anchors coming from the investor-attitude strings 1217 and 3048/3049 about company or chairman performance rather than from the merger-only management-attitude term. One older local lead is now ruled out too: the 0x460900..0x460cac / 0x473620 setup block is the camera-view command family over localized ids 3474..3493 (Select/Assign Camera View 1..9 and 0), not issue-opinion infrastructure, so it should no longer be used as evidence for the player-facing meaning of issue 0x37. The editor-side Stock Prices label is also no longer being used as direct evidence here: the 0x4ca980 / 0x4cadf0 panel owns a separate float-tuning block [state+0x0bde..0x0bf6], with [state+0x0bde] merely mirroring [state+0x0be2], so that label belongs to a different settings family than the issue table behind 0x37. A direct shell-resource follow-up now narrows the remaining caption question too: the extracted CompanyDetail.win blob from rt3_2WIN.PK4 contains no plain-English investor or finance caption for this lane, which matches the owner-side read that section-0 is a dynamic 0x947f text widget fed by shell_format_company_governance_and_economy_status_panel 0x004e5cf0 rather than a separate fixed label row. The supporting stat layer is bounded more cleanly now too: the surrounding 0x0b setup in the merger and takeover offer builders is formatter mode rather than a player-facing issue number, while the company-side stat wrapper company_read_year_or_control_transfer_metric_value 0x0042a5d0 now reads as a generic stat-family accessor over year-relative series or the bounded slot family in company_read_control_transfer_metric_slot 0x0042a2e0. Its recurring family token 0x2329 is no longer treated as an issue id here either; it is the stat-family selector paired with localized company-stat label id 2329. That means the paired raw and scaled helpers at 0x004241e0 and 0x00424200 now read as narrow control-transfer offer policy totals instead of direct issue-argument consumers, and the same broader support-and-governance metric family now also feeds the annual shareholder-revolt and creditor-liquidation lane surfaced by localized ids 300..304. The editor-side help text cluster around ids 2433..2437 is no longer floating either: current grounded map-editor code now has a live economic tuning family beside the chairman-slot panel. map_editor_economic_cost_slider_panel_construct 0x004cadf0 binds six slider controls through map_editor_economic_cost_slider_dispatch 0x004ca980, which now grounds as the real writer for the scenario-state float block [0x006cec78+0x0be2..0x0bf6]: lane 0 uses one dedicated scale divisor, the trailing five lanes share the centered (value-0xce) path, and the helper mirrors lane 0 into [state+0x0bde]. The surrounding descriptor table at 0x00611c70..0x00612220 pairs that wider editor lane with localized fields Prime Rate, Merger Premium, and Build Stations Cost through Steam Engine Cost plus the comparison or help texts 2433..2437. The broader shell-state master flag at [0x006cec74+0x68] still sits above the remaining post-load phases, plus two narrower per-phase gates: [0x006cec74+0x174] directly fronts id 320 Setting Up Buildings... and the later region-owned structure-demand and placement pass through world_region_collection_run_building_population_pass 0x00421c20 plus the deeper per-region worker world_region_balance_structure_demand_and_place_candidates 0x004235c0, while [0x006cec74+0x178] directly fronts id 321 Seeding Economy... and the chunked burst helper simulation_run_chunked_fast_forward_burst, whose grounded tail now also sweeps the live region collection through world_region_refresh_cached_category_totals_and_weight_slots 0x00423d30; id 322 then fronts Calculating Heights.... The master +0x68 flag is no longer just structural: the shell load/save coordinators now use the same flag to force the editor-map .gmp family, so current evidence treats it as the broader editor-map mode above those later setup branches rather than an unnamed generic toggle. That worker is no longer one opaque building bucket: current grounded categories split into House, a weighted region-profile family surfaced through the Industry Weightings stats path, and a third branch whose low-level fallback token is Commercial but whose aligned stats label is City Support. The same placement-commit gate beneath it, world_region_validate_and_commit_candidate_placement 0x00422a70, is also corroborated by the separate world-side randomized batch helper world_try_place_random_structure_batch_from_compact_record 0x00430270, which retries placements around one compact center/radius record rather than the ordinary per-region demand deficits. That batch placer now sits under a wider compact runtime-effect dispatcher, world_apply_compact_runtime_effect_record_to_resolved_targets 0x00431b20, so the world-side branch is no longer just “another caller near 0x43051e” but one real effect family alongside the ordinary region-demand worker. Above that, the live scenario event collection at 0x0062be18 now has a tighter runtime-effect lane too: scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects 0x004323a0 services one live runtime-effect record, dispatches its linked compact effects through 0x00431b20, and can synthesize follow-on records through scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets 0x00430b50, which in turn allocates new live records through scenario_event_collection_allocate_runtime_effect_record_from_compact_payload 0x00432ea0. Above that, scenario_event_collection_service_runtime_effect_records_for_trigger_kind 0x00432f40 now bounds the collection-wide loop that services those live runtime-effect records for one trigger kind. That trigger split is tighter now too: recurring simulation maintenance drives kinds 1, 0, 3, and 2; the neighboring route-style follow-on drives 5 and 4; startup-company and named-railroad creation branches drive 7; kind 6 is now bounded as a mixed post-change family spanning the placed-structure post-create tail, one build-version-gated company-startup or roster-refresh tail, and the route-entry post-change sweep on 0x006cfca8; one world-entry-side one-shot gate drives 8 and then clears shell-profile latch [0x006cec7c+0x97]; the briefing-text query lane is kind 9; and the collection dirty latch still forces the internal rerun at kind 0x0a. That moves this branch out of the “isolated world-side placement oddity” bucket and into a real scenario-runtime effect pipeline with a mostly bounded trigger-kind family. The same lower helper also reappears later on a slower simulation-side cadence with scale 1/12, so it no longer looks like one-time setup glue only. The actual game-speed control family remains separate, rooted at world_set_game_speed_mode 0x00434680, world_adjust_game_speed_mode_delta 0x00434850, and world_toggle_pause_or_restore_game_speed 0x00437a60. The direct shell command stub above that family is now explicit too: 0x00440880 just re-enters the pause-or-resume toggle with flag 1 and then issues one indexed shell feedback nudge through 0x0045ea20 with selector 0x2c and scalar 0.5f. That feedback path is tighter now too: 0x0045ea20 is the reusable indexed audio-feedback helper over the table-driven pairs at 0x005f0828/0x005f082c, and 0x00531e10 is the shell-audio-service sink that only dispatches those nudges when the live service gates are satisfied.

Camera View Command Strip

The adjacent shell-command family at 0x004408f0..0x00440c30 is now grounded as the ten-slot Assign/Select Camera View owner rather than as a generic modal strip. shell_assign_camera_view_slot_and_publish_confirmation 0x004408f0 snapshots one 0x30-byte record inside the live world-view owner through world_view_store_camera_view_slot_snapshot 0x0043b2c0, storing both the live view tuple [view+0x04..+0x24] and one saved focus-kind pair from [0x006cec78+0x45/+0x49]; shell_select_camera_view_slot_or_publish_unassigned_warning 0x004409c0 then re-enters world_view_restore_camera_view_slot_snapshot_if_populated 0x0043ca20, which restores the same fields, optionally replays the saved focus through shell_world_focus_selected_subject_kind_and_id 0x00437a90, and returns silently on success. Only empty slots surface the shared shell modal path, using localized ids 371..373 after one label-format pass through 0x0051b700. The wrapper strip 0x00440b00..0x00440c30 is now fully bounded too: 0x00440b00/10/20/30/40/50/60/70/80/90 are Assign Camera View 1..9/0, while 0x00440ba0/b0/c0/d0/e0/f0/c00/c10/c20/c30 are Select Camera View 1..9/0, and the registration block at 0x00460903..0x00460cac ties those wrappers to localized command ids 3474..3493.

CompanyDetail Addendum

The shared helper shell_company_detail_resolve_selected_company at 0x004c16f0 now bounds the common current-company accessor beneath the whole pane, and the read-side owner also has a separate active-company navigation family through shell_company_detail_step_selected_active_company_delta at 0x004c3470 plus the next or previous wrappers at 0x004c3540 and 0x004c3550. The section switch in shell_company_detail_window_refresh_controls is now grounded too: section index 0x006cfe60 selects a chairman/governance slice, a debt-and-capital slice, a per-share slice, or a territory-access slice, published through the tab band around 0x9472..0x9479, with adjacent section-navigation controls around 0x947b..0x947c and 0x948f..0x9490.

Key Dispatchers

shell_controller_window_message_dispatch, shell_input_apply_window_key_transition, shell_input_snapshot_dispatch_state, shell_input_cursor_inside_active_view, world_load_saved_runtime_state_bundle, world_runtime_serialize_smp_bundle, simulation_frame_accumulate_and_step_world, game_message_window_service_if_present, game_message_window_service_frame, game_uppermost_window_handle_message, game_uppermost_window_service_world_hotspot_band, game_uppermost_window_refresh_controls, world_view_service_keyboard_turn_pan_and_zoom_bindings, world_view_step_heading_quadrant, world_view_step_zoom_bucket, world_seed_default_chairman_profile_slots, world_build_chairman_profile_slot_records, world_conditionally_seed_named_starting_railroad_companies, scenario_state_set_selected_chairman_profile, scenario_state_get_selected_chairman_profile_record, scenario_state_get_selected_chairman_company_record, shell_company_list_window_construct, shell_company_list_window_refresh_rows, shell_company_list_window_handle_message, start_new_company_dialog_open, start_new_company_dialog_commit_create_company, start_new_company_request_create_company, shell_station_detail_window_construct, shell_station_list_window_construct, shell_station_list_window_handle_message, shell_station_pick_window_construct, shell_station_pick_window_populate_station_rows, map_editor_chairman_slot_panel_construct, map_editor_chairman_slot_panel_handle_message, map_editor_chairman_slot_panel_refresh_selected_slot, map_editor_chairman_slot_panel_cycle_selected_slot_profile, map_editor_available_chairman_panel_construct, map_editor_available_chairman_panel_handle_message, map_editor_scenario_metadata_panel_refresh_briefing_mode, map_editor_scenario_metadata_panel_refresh_controls, map_editor_scenario_metadata_panel_handle_message, map_editor_scenario_special_conditions_panel_construct, map_editor_scenario_special_conditions_panel_handle_message, map_editor_economic_cost_slider_panel_construct, map_editor_economic_cost_slider_dispatch, station_place_world_surface_sync_and_dispatch, station_place_window_handle_message, track_lay_window_refresh_controls, track_lay_window_service_frame, track_lay_window_handle_message, simulation_advance_to_target_calendar_point, the smaller single-step helper at 0x00409e80, 0x0040a9c0, 0x0040a910, and simulation_service_periodic_boundary_work.

State Anchors

Shell input object 0x006d4018, per-key state table starting at [input+0x100], packed shell input flags at [input+0xa8c] now grounded as Right Shift 0x1, Left Shift 0x2, Control 0x4, and Alt 0x20, nested dispatch counter [input+0xa90], global shell controller 0x006d4024, active world root 0x0062c120, GameMessage.win object 0x006d081c, GameUppermost.win overlay object 0x006d0820, StationPlace.win tool object 0x006d1720, TrackLay.win tool object 0x006d1a8c, accumulated leftover simulation time at [this+0x4c80], shell and mode globals at 0x006cec74, 0x006cec78, and 0x006cec7c, world manager collections at 0x0062be10, 0x006ceb9c, 0x006cfcbc, 0x006cec20, 0x0062bae0, and 0x006acd34, plus the packed calendar-like tuple fields around [this+0x0d], [this+0x0f], [this+0x11], and [this+0x14].

Subsystem Handoffs

The controller window dispatcher now looks like the first grounded input ingress. It translates keyboard and mouse WM_* traffic into shell controller state and the separate input object at 0x006d4018; read-side cursor and camera helpers later snapshot that object through shell_input_snapshot_dispatch_state and gate world-relative interaction through shell_input_cursor_inside_active_view. Current grounded consumers around 0x00478cb0, 0x004e0780, 0x0053f450, and 0x0053fe90 still sit on the shell controller path and consult 0x006d4024 or the world owner at 0x0062be68, so there is still no evidence for a distinct gameplay-only input object after world entry. Instead, the first deeper world-mode interaction branch now looks like a shared world-view coordinator layered on top of the same shell-fed input state. Shell_transition_mode ensures the GameUppermost.win object at 0x006d0820; its message dispatcher game_uppermost_window_handle_message owns the narrow action band 0x7918 through 0x7921; and the recurring service helper game_uppermost_window_service_world_hotspot_band rate-limits those hotspot actions, rechecks shell_input_cursor_inside_active_view, and then pans the live world view through world_view_pan_relative_offset_in_camera_plane 0x0043d130. The same lower setter family is also reached from the cursor-drag path through world_view_apply_screen_delta_to_focus_position 0x0043d0c0. Above both of those sits the larger recurring service world_view_service_shell_input_pan_and_hover 0x0043db00, which now has one grounded keyboard branch beneath it: world_view_service_keyboard_turn_pan_and_zoom_bindings 0x0043d740. That helper resolves four binding-pair families from the shell input table via 0x0054e7d0, and the localized labels are now grounded from Data/Language/RT3.lng: Camera Forward and Camera Backward feed the first signed pan channel, Camera Left and Camera Right feed the second signed pan channel, Camera Zoom In and Camera Zoom Out feed the signed zoom-step channel that 0x0043db00 smooths into world_view_step_zoom_bucket 0x0043cc30, and Camera Rotate Left plus Camera Rotate Right feed the continuous heading-turn branch through 0x0043c810. The setup side is now better bounded too: world_view_seed_keyboard_binding_slot_pairs at 0x00439e40 seeds the eight slot pairs at [this+0x0a6] through [this+0x0e2] from the global action-binding registry through shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id 0x0045f370 using the distinct registry keys 0x0043d2a0 through 0x0043d310, and the registration block at 0x00460769 through 0x004608e7 plus the shared installer shell_input_register_action_binding_with_mode_specific_defaults 0x0045f6d0 show those roots are defaulted to the expected Up Down Left and Right virtual keys before runtime polling begins. The adjacent lookup strip is tighter now too: shell_input_binding_registry_resolve_entry_by_action_stem 0x0045ede0 resolves one action stem into the live binding registry, while shell_input_binding_registry_format_display_label_by_action_stem 0x0045f3d0 and shell_input_binding_registry_query_primary_code_by_action_stem 0x0045f400 are the small display-label and primary-code wrappers above that resolver. The camera-view modal family at 0x004408f0/0x004409c0 now uses that same strip directly when formatting the optional focus-label lines inside the assign/select camera-view confirmations. The lower label path is now bounded too: shell_input_binding_format_display_label_from_registry_entry 0x0045ea90 is the actual registry-entry formatter with the three localized prefix fragments 0xdef/0xdf0/0xdf1 plus the descriptor-table caption fallback at 0x005f0a34, and shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular 0x0045ed90 is the descriptor-side bucket-key helper used by the installer when the target mode mask is singular. The same local family now reaches one step further into the hotkeys sidecar: shell_input_binding_report_iterate_next_entry_in_sorted_priority_order 0x0045f250 builds a temporary sorted report queue over the live registry, shell_input_write_hotkeys_report_file 0x0045f550 writes the resulting table to hotkeys\hotkeys.txt, and the hotkey reassignment path uses the smaller helpers 0x0045ec00, 0x0045ec70, 0x0045ecd0, 0x0045ed70, 0x0045ef00, and 0x0045f8a0 to split imported foo+bar labels, recover one action id from the descriptor table, decode a compact modifier code, expand that code back into the live registry mask, and finally rebucket or replace the live binding entry. The surrounding registry lifecycle is tighter now too: shell_input_seed_default_binding_registry_entries_from_static_table 0x0045f9e0 seeds the fixed defaults from 0x005ecadc and then appends the smaller manual shell-command strip; shell_input_binding_registry_destroy_all_roots_and_reset_globals 0x00461070 is the hard reset that also flushes hotkeys\hotkeys.txt; and shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file 0x00461120 rebuilds the pool roots, reseeds defaults, and tail-jumps into shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels 0x0045f420 when the caller requests saved-hotkey import. Beneath that camera stack, the enclosing frame path now has one grounded non-view sidecar: after 0x0043db00 it reads the active controller-view object pointer at [0x006d4024+0x18]+0x366e, compares it against the latched target at [frame_owner+0x66a2], fires exit and enter-style vtable callbacks on pointer changes through slots +0x64 and +0x60, and only latches the new object when the object passes its own slot +0x1c availability test and shell detail control id 0x07d6 on 0x006d0818 has flag bit 0x4. That 0x07d6 gate is now more bounded than before: the dedicated TrackLay.win tool family rooted at 0x006d1a8c special-cases the same control id in both track_lay_window_service_frame and track_lay_window_handle_message, uses world hit tests through 0x00448ac0 to arm and release a drag latch on that surface, and routes the resulting command work through the shared track-lay mode state at 0x00622b0c. The surrounding track_lay_window_refresh_controls pass now shows that this is not just one isolated drag handler: the same tool family owns three mutually exclusive primary mode buttons at 0x985e 0x985f and 0x9860, and current primary evidence now bounds those values as Lay single track. 0x1, Lay double track. 0x4, and Bulldoze 0x40 from the localized strings 2054 2055 and 1721 plus the matching control-routing branches in track_lay_window_handle_message. The same family also owns the downstream route-entry policy bridge at 0x004955b0: current caller evidence says that helper maps the live TrackLay primary mode into endpoint-synthesis policy 1 or 4 before the tool re-enters 0x00493cf0, which is the strongest current bridge from the player-facing single-track versus double-track buttons into the lower route-builder policy bytes. The same family also owns a bridge-type preference selector rooted at 0x006cec74+0x138, two wrapped Never through Common frequency settings at 0x006cec74+0x140 and 0x006cec74+0x13c, two boolean track-lay preference toggles, and the electrify-all-track action path. Those last two toggles are now tighter than before: current evidence strongly aligns control 0x986e and state 0x006cec74+0x144 with Auto-Hide Trees During Track Lay from strings 1838 and 1839, while control 0x986d and state 0x006cec78+0x4c74 align with Auto-Show Grade During Track Lay from strings 3904 and 3905. That mapping is still evidence-backed rather than absolutely direct from a recovered resource table, but the state ownership and control order now make it the strongest current fit. That makes 0x07d6 look like the shared main-world interaction surface inside a broader TrackLay world-command subsystem, not an unrelated detail button. The neighboring StationPlace.win family is now grounded on that same surface too: the shell detail-panel constructor family allocates it through station_place_window_construct at 0x00509d80, publishes it at 0x006d1720, services it each frame through station_place_window_service_frame at 0x0050a530, and routes player-facing commands through station_place_window_handle_message at 0x005091b0. That dispatcher special-cases the same 0x07d6 control, and the shared helper station_place_world_surface_sync_and_dispatch at 0x00508bb0 either accepts that direct surface traffic or falls back to the same detail-panel control looked up through 0x006d0818, rechecks flag bit 0x4, hit-tests the world through 0x00448ac0, stages world coordinates into 0x006d1738/0x006d173c, refreshes the remaining preview metric field through station_place_refresh_preview_metric_control_0x6983 0x00508550, and updates the live station-placement selection state at 0x00622af0, 0x00622aec, and 0x006d1740. The tool-side save and restore choreography is tighter now too: station_place_window_release_cached_selection_handles_and_world_followons 0x005079c0 releases cached helper handles [this+0x7c/+0x80/+0x88/+0x84] through the matching global owners after re-entering world and placed-structure follow-ons, and the thin wrapper 0x00507a50 is the entry used by the broader save-load status-stack helpers. The category side of that state is now tighter too: the shared helper 0x0044bd10 quantizes the staged world coordinates into the current cell, resolves the mixed byte-or-word region id from [world+0x212d], looks up the owning city-or-region entry through 0x0062bae0, and returns [entry+0x272] with fallback 5; the StationPlace world-surface branches at 0x00508b80, 0x00508d59, and 0x0050a4e6 use that result directly to refresh the current selection category latch at 0x00622af0. Together with station_place_select_category_and_refresh 0x00508880, station_place_refresh_category_controls 0x00507b90, and station_place_format_preview_panel 0x00508730, that makes StationPlace a second grounded consumer of the shared main-world interaction surface rather than only a sibling constructor plus frame hook. The StationPlace control semantics are now tighter too: the top category strip at 0x697c through 0x6981 now grounds as small station, medium station, large station, service tower, maintenance facility, and non-station building from RT3.lng strings 2197 through 2202. For the three station categories only, the secondary strip at 0x6988 and 0x6989 plus display field 0x698c no longer looks like another placement mode family; it is a building-style scroller. The click handlers on 0x6988 and 0x6989 cycle the style override in 0x00622aec, and the display path builds the active style token from StationSml, StationMed, or StationLrg plus the localized architecture styles Victorian, Tudor, Southwest, Persian, Kyoto, and Clapboard from RT3.lng ids 2672 through 2667. One layer lower, the remaining opaque controls are now much tighter: 0x6985 and 0x6986 are no longer a generic assist toggle but the two station-rotation policy choices from strings 2207 and 2206, switching between auto-orienting the building to track or obstacles and strictly obeying the rotation specified by the circle above. The dedicated control at 0x6987 is the station-rotation circle itself, wired through station_place_rotation_circle_callback_publish_current_heading_widget 0x00507a90 and aligned with Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings. string 2208. The lower rotation strip is now grounded too: station_place_set_rotation_and_refresh_live_selected_site_pose 0x00507cf0 owns the write to 0x006d172c and the live selected-site pose refresh, station_place_window_drag_rotate_selected_site_toward_world_cursor 0x00507d80 is the drag-update branch under the dispatcher, and station_place_step_rotation_by_integer_notches 0x005086c0 is the discrete notch helper used by the neighboring StationPlace rotation-step branches. That matches the lower behavior too: when the strict-rotation choice is off, both preview and commit paths route staged coordinates through station_place_window_try_auto_orient_candidate_to_covering_route_entry_and_validate_placement 0x00508040, which performs the extra orientation search before validation by retrying a small orientation-mode set around the reusable covering-route-entry helper 0x00417b40; when strict rotation is on, that pass is skipped and the current angle in 0x006d172c is used directly. The preview strip is tighter now too: station_place_format_preview_panel 0x00508730 is the real owner for controls 0x6982/0x6983/0x6984, and the middle field 0x6983 is no longer anonymous. The paired description side is explicit now too: 0x00413bc0 is the formatter behind preview control 0x6984, starting from placement-record text at [record+0x40] and then appending rule-table driven explanatory lines after casefolded compares against [record+0x7c]. station_place_refresh_preview_metric_control_0x6983 0x00508550 resolves the staged world-cell category through 0x0044ad60, reads the linked profile scalar at [profile+0x22], chooses issue slot 0x3b or 0x3c from candidate subtype byte [candidate+0x32], folds that scalar through scenario_state_compute_issue_opinion_multiplier 0x00436590, and then passes it through the version-gated quantizer 0x005084a0 before formatting the visible text into control 0x6983. The singleton-side entry above that strip is explicit now too: station_place_format_preview_panel_if_live_singleton_and_valid_selection 0x00508860 only forwards non--1 selection ids into that refresh path when 0x006d1720 is live. One layer below preview versus commit, the shared gate is also tighter now: station_place_validate_current_selection_at_world_coords_and_optionally_format_status 0x00507e80 is the common validation-and-status path beneath the preview and commit branches, publishing red, yellow, or green feedback through 0x0040cb10 around the same placed_structure_validate_projected_candidate_placement 0x004197e0 core. The direct shell UI also exposes the same discrete view-step family through world_view_step_heading_quadrant 0x0043cb00 and world_view_step_zoom_bucket 0x0043cc30. The neighboring gating predicates world_view_should_drive_primary_pan_channel and world_view_should_drive_secondary_pan_channel test packed shell input bits 0x3, and shell_input_apply_window_key_transition now grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36. That means cursor drag, overlay hotspots, held Shift state, direct keyboard turn/pan/zoom bindings, the TrackLay and StationPlace world-command surfaces, and at least one frame-owned hover or focus-target branch all converge under the same shell-fed world-mode input path rather than a separate gameplay-input stack. The ownership seam is therefore closed at the current local level: the unresolved pieces are the exact per-tool or per-mode actions beneath that path, not whether a later non-cursor gameplay branch bypasses the shell controller input roots.

Evidence

Function-map rows for shell_controller_window_message_dispatch, shell_drain_pending_window_messages, shell_input_state_init, shell_input_apply_window_key_transition, shell_input_snapshot_dispatch_state, shell_input_cursor_inside_active_view, world_load_saved_runtime_state_bundle, world_runtime_serialize_smp_bundle, world_entry_transition_and_runtime_bringup, simulation_frame_accumulate_and_step_world, game_message_window_service_if_present, game_message_window_service_frame, shell_ensure_game_uppermost_window, game_uppermost_window_construct, game_uppermost_window_handle_message, game_uppermost_window_service_world_hotspot_band, world_view_set_focus_position_xyz, world_view_apply_screen_delta_to_focus_position, world_view_pan_relative_offset_in_camera_plane, world_view_seed_keyboard_binding_slot_pairs, world_view_service_keyboard_turn_pan_and_zoom_bindings, world_view_step_heading_quadrant, world_view_step_zoom_bucket, world_view_should_drive_primary_pan_channel, world_view_should_drive_secondary_pan_channel, world_view_service_shell_input_pan_and_hover, world_seed_default_chairman_profile_slots, world_build_chairman_profile_slot_records, world_conditionally_seed_named_starting_railroad_companies, profile_collection_count_active_chairman_records, profile_collection_get_nth_active_chairman_record, scenario_state_set_selected_chairman_profile, scenario_state_get_selected_chairman_profile_record, scenario_state_get_selected_chairman_company_record, start_new_company_dialog_open, start_new_company_dialog_commit_create_company, start_new_company_request_create_company, shell_company_list_format_company_or_start_row, shell_company_list_activate_or_shift_center_company, shell_company_list_window_refresh_rows, shell_company_list_window_handle_message, shell_company_list_window_construct, shell_company_detail_window_refresh_controls, shell_company_detail_window_construct, shell_company_detail_window_handle_message, shell_station_detail_window_construct, shell_station_list_window_construct, shell_station_list_window_handle_message, shell_station_pick_window_construct, shell_station_pick_window_populate_station_rows, map_editor_chairman_slot_panel_construct, map_editor_chairman_slot_panel_refresh_slot_list, map_editor_chairman_slot_panel_refresh_selected_slot, map_editor_chairman_slot_panel_refresh_slot_counters, map_editor_chairman_slot_panel_cycle_selected_slot_profile, map_editor_chairman_slot_panel_handle_message, map_editor_available_chairman_panel_construct, map_editor_available_chairman_panel_handle_message, map_editor_scenario_metadata_panel_refresh_briefing_mode, map_editor_scenario_metadata_panel_refresh_controls, map_editor_scenario_metadata_panel_handle_message, map_editor_scenario_special_conditions_panel_construct, map_editor_scenario_special_conditions_panel_handle_message, map_editor_economic_cost_slider_panel_construct, map_editor_economic_cost_slider_dispatch, station_place_refresh_category_controls, station_place_format_selected_site_summary, station_place_format_preview_panel, station_place_select_category_and_refresh, station_place_world_surface_sync_and_dispatch, station_place_window_handle_message, station_place_window_construct, station_place_window_service_frame, track_lay_window_refresh_controls, track_lay_window_construct, track_lay_window_service_frame, track_lay_window_handle_message, and simulation_service_periodic_boundary_work, plus the shell-input disassembly around 0x0054f290, 0x0054e880, 0x0054e9c0, 0x0054ea20, 0x0054eb10, and 0x0054ee50, the world-view setup and service branches around 0x00439e40, 0x0043d740, 0x0043db00, 0x0043cb00, and 0x0043cc30, the 319 setup-side branches around 0x004377a0, 0x00437220, 0x00477820, 0x00477860, 0x0047d440, 0x004c6c30, 0x004c6f30, 0x0047d080, 0x0047d120, 0x0047d320, 0x004c2ca0, 0x004c5540, 0x004c56a0, 0x005068c0, 0x005071e0, 0x005074c0, and 0x005076c0, the direct summary-field helpers around 0x00434870 0x00434890 and 0x004348c0, the company-link writers at 0x00427c70 and 0x00427d74, the company constructor at 0x00428420, the startup-company branch around 0x00470e48, the shell company-list strings 266 <<Start New Company>>, 267 You are the chairman of the %1!, 268 The %1 has no chairman at the moment., 269 %1 is the chairman of the %2., 270 Double-click for details., and 2992 Shift-Click to center on this company's primary station., the CompanyDetail.imb and CompanyDetail.win resource strings in .rdata, the StationDetail.imb, StationDetail.win, StationList.win, and StationPick.win resource strings in .rdata, the shell editor window branches around 0x004c9da0, 0x004ca010, 0x004ca1c0, 0x004ca540, 0x004ca670, 0x004ca790, 0x004ca980, 0x004cb2b0, 0x004cb4a0, 0x004cb6f0, 0x004cb8e0, 0x004cc250, 0x004cc2d0, 0x004ceb90, and 0x004cecc0, the localized chairman-slot strings 2997 through 3001 Optional Mandatory Human or Computer Computer and Human, the localized scenario-editor strings 1483..1492 Description: through Type the briefing for this map., the localized summary strings 1035 %1 out of %2 are selected. and 1053 Special Conditions In Effect, the 40-entry persona availability page under 0x5aa0..0x5b03, the 36-entry special-condition table at 0x005f3ab0 covering ids 2535..2563, 2874, 3722, 3835, 3850, 3852, and 3920, the static persona table at 0x005f2d28, the selector array at 0x006cec7c+0x87, the persona collection at 0x006ceb9c, the localized persona strings in Data/Language/RT3.lng including 2730 Unassigned, the named-chairman range 2731+, and the neighboring biography range 2495+, plus the seeded railroad-name strings 575 Missouri Pacific, 576 New York Central, and 577 Grand Trunk Railroad, the StationPlace.win constructor plus category, dispatcher, rotation-circle, shared-world-surface, preview-build, and recurring service branches around 0x00507a90, 0x00507b90, 0x00508550, 0x00508730, 0x00508880, 0x00508bb0, 0x005091b0, 0x00509d80, and 0x0050a530, the StationPlace string cluster Place a small station 2197 Place a medium station 2198 Place a large station 2199 Place a service tower 2200 Place a maintenance facility 2201 Place a non-station building 2202 Scroll through building styles. 2203 When placing the building, it will strictly adhere to the rotation specified by the circle above. 2206 When placing the building, it will rotate itself as needed to orient to track or avoid obstacles. 2207 Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings. 2208 and the architecture-style labels Clapboard 2667 Kyoto 2668 Persian 2669 Southwest 2670 Tudor 2671 and Victorian 2672, the TrackLay.win constructor and dispatcher family around 0x0050d2d0, 0x0050e400, 0x0050e070, 0x0050e1e0, and 0x0050e5c0, the localized Never through Common strings 615 through 618, the track-lay strings Bulldoze 1721 Lay single track. 2054 Lay double track. 2055 and 3114, and the deeper shared bulldoze helper at 0x0044b160. That helper is no longer just a vague proximity scan: it validates the active company unless editor mode is active, emits the exact RT3.lng bulldoze rejection ladder 419..424, reads company cash through 0x0042a5d0, debits approved bulldoze cost through 0x0042a080, and then scans nearby route entries, linked structures, city-or-region records, route blockers, and placed structures before committing the mutation. The nested tool-side entry is tighter now too: 0x0050e070 increments the TrackLay reentry guard, snapshots several live route-owner fields from 0x006cfca8 into the tool object, refreshes tool-local state through 0x0050dab0, and only then tails into the later restore or service branch 0x0050d1e0. That tail is now tighter too: 0x0050d1e0 resets the route-owner search state through 0x0049ad90/0x00495540, drops invalid cached route ids from the TrackLay tool or deletes non-admitted live entries when route latch [route+0x118] is set, clears [tool+0x78], and then conditionally refreshes shell presenter slot [presenter+0x3741] through 0x00523e20. The destructor side is tighter too: 0x0050db10 restores the TrackLay vtable, re-enters that same cleanup tail, runs the route-owner post-change sweep 0x004a3db0, clears singleton 0x006d1a8c, conditionally replays the shared world-side preview-mode clear owner world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched 0x00453510, and only then tails into the common shell destroy path 0x0053f7d0. Two smaller TrackLay-side helpers are tighter now too: 0x0050dc00 refreshes the version-gated action rows 0x986a..0x986c plus 0x9872 before re-entering the main control refresh, and 0x0050dc80 owns the active route-latch branch that either forwards into 0x004a00b0 or clears route latch [0x006cfca8+0x118] plus local byte [tool+0x82]. The broader shared route or hit-test owner under both message and recurring service is now tighter too: 0x0050dce0 first drops any cached tool route id, then either seeds or updates the current route-owner selection from a world-surface hit test through 0x00448ac0, 0x00493600, 0x0049ace0, and 0x0049b180, or refreshes the active route-owner path through 0x004955b0, 0x00493cf0, and 0x004a04c0, with the cleanup side posting the fixed shell payload and optionally deleting route ids [+0x125] and [+0x129]. The smallest active-route companion is tighter now too: 0x0050dab0 only runs when latch [0x006cfca8+0x118] and route id [+0x125] are both live, then resolves that entry, re-enters 0x0049afe0, 0x0048b660, and 0x0049b070, and returns. dispatching the selected delete branch through 0x004937f0, 0x004941a0, 0x0048abf0, or the surrounding placed-structure virtual slot +0x58. That makes the TrackLay Bulldoze mode tighter than before: the tool-side mode latch at 0x00622b0c == 0x40 is only the front-end selector, while the actual world-side bulldoze choice and failure policy sits under 0x0044b160 and is reused by neighboring world-surface callers beyond TrackLay itself. the TrackLay preference strings Auto-Hide Trees During Track Lay 1838 If 'Auto-Hide Trees During Track Lay' is checked, trees will automatically be reduced to small stumps whenever you are in track laying mode. 1839 Auto-Show Grade During Track Lay 3904 and If 'Auto-Show Grade During Track Lay' is checked, you'll see the grade number over the track while laying track - useful for trying to keep your slopes to a minimum. 3905, the electrify-all confirmation and failure strings 3083 3084 3837 and 3900, the binding-registry lookup path at 0x0045f370, the registration block at 0x00460769 through 0x004608e7, and the localized labels in Data/Language/RT3.lng ids 3466 through 3473.

Current Boundary

Current evidence grounds the shell-controller-backed input and frame path as the only coordinator after world entry; no separate outer gameplay loop or gameplay-only input object is grounded yet. The new setup-pipeline evidence also points the same way: the currently grounded chunked burst path at 0x00437b20 now looks subordinate to world_run_post_load_generation_pipeline rather than to the ordinary speed controls, and even there it still reuses the same lower stepper and pumps shell work between chunks instead of revealing a detached gameplay loop owner. The player-facing speed-control family is now cleaner too: world_set_game_speed_mode owns the bounded Paused through Very Fast ladder plus the hidden Ultra Fast 6..9 extension, world_toggle_pause_or_restore_game_speed uses [this+0x1d] as the resume slot, and the multiplayer host restriction now looks attached to that same setter family rather than to the setup-side burst helper. The frame-owned shell coupling is tighter now too: inside simulation_frame_accumulate_and_step_world itself, one direct branch opens or focuses LoadScreen.win through shell_open_or_focus_load_screen_page, and the post-step shell-window ladder also probes several sibling shell windows by the same presence-plus-dirty pattern, including the live LoadScreen singleton, the shared callback-driven custom modal, the shared file-options dialog, SettingsWindow.win, the now-grounded Overview.win and BuildingDetail.win singletons, the adjacent tool-window strip now grounded as Bulldoze.win, ChangeHeight.win, ChangeTrees.win, PaintRegion.win, PaintSound.win, PaintTerrain.win, PaintTerritory.win, and StockBuy.win, and now the shell-side Trainbuy.win singleton too. The SettingsWindow.win side is tighter now too: shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report 0x004fec60 rebuilds the hotkeys list control 0x757a from the same sorted binding-report iterator 0x0045f250, using the temporary 0x88-stride list model at 0x006d1354 before restoring the previous selection. The message owner above it is bounded now too: shell_settings_window_handle_message 0x004fede0 is the actual dispatcher for the singleton, and its currently grounded hotkeys cases are the reset-to-defaults path 0x00500147 -> 0x00461120(0) -> 0x0045f550 -> 0x004fec60 and the selected-row reassignment path 0x00500186..0x0050022b, which resolves one chosen hotkey row from control 0x757a, validates the destination bucket through 0x0045ed90, skips Enter and Escape, expands the compact modifier code through 0x0045ed70, commits the rebucket through 0x0045ef00, and then rewrites the same report file plus rebuilds the list. The page-refresh side is bounded now too: shell_settings_window_refresh_selected_page_controls 0x00500410 republishes the category strip 0x7533..0x7540, uses the local in-refresh guard byte 0x006d135d, and then dispatches the current page through the 0x005005e0 table; page 7 is now directly grounded as the hotkeys page because it dispatches into 0x004fec60. The category table at 0x00622870 now grounds the whole page order as Gameplay, Sound, Graphics, Model Detail, Draw Distance, Textures, Miscellaneous, Hot Keys, Scrolling, Camera Controls, Dialogs, Miscellaneous, and Sandbox Options, with only the second dword in each table row still unresolved as a small subgroup or style flag. Several page bodies are now grounded too: 0x004fda20 is the Gameplay refresh owner, 0x004fdb90 the Sound refresh owner, 0x004fe770 the top-level Graphics refresh owner, 0x004fe960 the Model Detail refresh owner, 0x004feb20 the Draw Distance refresh owner, 0x004febd0 the Textures refresh owner, 0x004fdd70 the first Miscellaneous refresh owner, 0x004fdf20 the Scrolling refresh owner, 0x004fdfd0 the Camera Controls refresh owner, 0x004fd940 the Dialogs refresh owner, 0x004fd730 the later Miscellaneous refresh owner, and 0x004fd8d0 the Sandbox Options refresh owner. The neighboring companion helpers are tighter now too: 0x004fd550 refreshes the Draw Distance companion strip under controls 0x7566/0x7596/0x7560/0x7562/0x7564, 0x004fd650 does the same for the Textures companion strip under 0x756e/0x756a/0x756c/0x7570, 0x004fe4c0 rebuilds the graphics custom-resolution list on 0x7553 from the live display-mode table filtered to 640x480 .. 1600x1200 and formatted through %1x%2, and 0x004fe6f0/0x004fe730 are the small primary-selector mirror helpers for Draw Distance 0x755f and Textures 0x7569. The Camera Controls page is stronger now too: 0x7587 is the day-night cycling selector rooted at Normal day/night cycling through Frozen at 11pm, while 0x7588 is the weather-cycling selector rooted at Normal weather cycling through Frozen at storms. The callback strip under the dispatcher is tighter now as well: 0x004fefb0 is the sound-backend selection-change owner for 0x7551/0x7550, 0x004ff070 is the custom-resolution selection owner, 0x004ff0d0 the top-level graphics selector-change owner, 0x004ff1b0 the main draw-distance selector-change owner, 0x004ff2e0 the textures selector-change owner, and 0x004ffbc0 the graphics custom-resolution or range-refresh branch that persists engine.cfg, rebuilds the custom list, and republishes 0x7555/0x7578. The small wrapper 0x00500620 is the nonreentrant if live, refresh page gate above that body. The tiny helper strip beneath those branches is at least bounded now too: 0x00531640/0x005316d0 query the selected Miles 3D provider index and preferred-flag from the shell audio service, 0x0053ef60/0x0053ef70 read the graphics-backend status slots used by controls 0x757c/0x759a, and 0x0051fd40/0x0051fd60 are the small graphics-range custom-mode flag and scalar queries behind 0x7555/0x7578. The next apply-strip under the same family is tighter now too: 0x004fe270 applies a changed custom-resolution tuple and persists it, 0x004fe2d0 applies the top-level graphics selector then republishes 0x757c/0x759a, 0x004fe3b0 applies the draw-distance selector then refreshes 0x004fd550, 0x004fe400 applies the textures selector then refreshes 0x004fd650, 0x004fe140 is the small composite backend-status predicate used by the timer-gated graphics service branch, and 0x004fe160 is the sound-backend follow-on refresh path. The graphics service tail is tighter now too: 0x004ffafb is the timer-gated backend-service-plus-graphics-page repaint branch using 0x0051d890 against deadline 0x006d136c, the follow-on calls 0x0053f170/0x0053f2c0, and a shortened 60 ms rearm after it repaints 0x004fe770, while 0x004ffb64 is the sibling backend-service branch that uses 0x0053f0f0/0x0053f210 and only raises the shell refresh latch without repainting the page directly. The same MouseCursor.cpp owner family is tighter now too: 0x0053f000 is the live cursor-shape selector that lazily loads native handles, updates the shell-side presentation payload, and toggles cursor visibility on the 0 <-> nonzero boundary; 0x0053f0f0, 0x0053f170, and 0x0053f210 are the three local hidden or release-transition branches that mirror shell latches [0x006d4024+0x11473a/+0x11473e]; 0x0053f2f0/0x0053f310 are the nested hold-counter helpers; 0x0053f330 is the constructor-side reset and latch-sync owner; 0x0053f400 is the coarse global-latch service; and 0x0053f450 is the inside-view watcher paired with shell_input_cursor_inside_active_view 0x0054f540. The same pair is now grounded on the heavier save/load paths too: world_entry_transition_and_runtime_bringup 0x00443a50 pushes the hold at 0x443b04 before the larger startup-dispatch and staged rehydrate work, then pops it at 0x444c03 after the late world or shell rebuild tail; the live .smp serializer world_runtime_serialize_smp_bundle 0x00446240 does the same thing through 0x446271 and 0x446d09 around its bundle-write and fixed status-publish span. The exact save/load-side status stack under those spans is tighter now too: 0x004422d0/0x00442330 push and pop the low bytes of shell lanes [0x006cec74+0x140/+0x13c/+0x138/+0x144] plus startup byte [0x006cec78+0x4c74] through 0x0062be90, with the restore side sign-extending the first three shell bytes and zero-extending the fourth before rewriting the wider dwords; 0x004423a0/0x004423d0 layer the same band under active TrackLay.win and StationPlace.win service. The per-frame tail is tighter now too: 0x0054f5b0 queues one 12-dword shell-input event record into the rotating ring at [input+0x128]; 0x0054f6a0 and 0x0054f6b0 are the two neighboring fixed-value seeders for shared phase scalar 0x00d93850 used by shell-side branches 0x00538b72, 0x0052819d, and 0x0052b9f8; and 0x0054f6c0, 0x0054f6d0, and 0x0054f6e0 are the tiny primary-motion scalar reset, snapshot, and restore leaves that 0x0053f4e0 uses around the later cursor-presentation pass. The graphics-range callback strip beneath that is bounded now too: 0x004ffd10 is the user-facing custom-mode toggle rooted at control 0x7555, using 0x0051fd00, 0x0051fd40, 0x00520fd0, and the localized dialog ids 0x0e16/0x0e17/0x0e93; 0x004ffe72 flips the graphics-range scalar through 0x00521030; and the adjacent display-runtime toggles 0x004ffea4, 0x004ffeff, 0x004fff2d, 0x004fff59, 0x004fff85, 0x004fffde, and 0x0050000a now bound a compact persisted graphics or model-detail option strip over controller fields [0x006d4024+0x1146eb], [+0x114697], [+0x1146e9], [+0x1146b8], [+0x1146af], [+0x1146a8], and [+0x1146e3] rather than one anonymous tail blob. The lower setter layer is tighter too: 0x0051fd00 is the current has live custom payload predicate for the graphics-range family, 0x00520fd0 stores the custom-mode flag and re-applies the current range when possible, 0x00521030 stores the scalar and re-applies it when the graphics mode is live, and 0x0051d890 is the shared elapsed-tick helper over the bootstrap-seeded tick count. The same local support strip is broader now too: 0x0051e1d0 is the mode-0 alternate sibling of the packed preview-color ramp at 0x0051dfc0; 0x0051e430/0x0051e480 are the shared path-openability and file-size probes; 0x0051e4e0/0x0051e560 are the bounded ASCII clipboard export and import helpers; 0x0051e6e0 is the nonempty digits-only predicate used by nearby text-entry validation branches; 0x0051e720/0x0051e740 own the active debug-log filename (rt3_debug.txt / language_debug.txt) and the one-time .\\data\\log\\%s separator write; and 0x0051e810 is now grounded as the MouseCursor.cpp ShowCursor refcount and live-position sync helper that the warning-modal strip also reuses. The immediate shell-controller strip under that is tighter now too: 0x0051ea80 is the small core-state reset plus default seeding path rerun by 0x0051ff90; 0x0051f000 registers the static World window class through wndproc 0x0054e3a0; 0x0051f070/0x0051f080 and 0x0051f090/0x0051f0a0 are the paired controller accessors and setters for the live presentation owner and world-basis owner; 0x0051f0c0, 0x0051f0d0, and 0x0051f0e0 are the small indexed input-subobject flag write or query helpers beneath the shell window-message path; 0x0051f100 materializes the active display-mode tuple from [controller+0x34] and selector [+0x11421e]; 0x0051f1a0 is the current graphics-mode-byte accessor over [controller+0x114226]. The wndproc itself is tighter now too: beyond the already-grounded key, command, and mouse ingress, one broader branch prepares subordinate layout-state [controller+0x2d] through 0x00547300, 0x0054bbf0, and 0x00545c00(0x96, [controller+0x75], 0), dispatches the local slot-band service owner 0x0054c900, re-enters 0x00545020, and when mode byte [controller+0x3692] is clear refreshes the current external record through 0x005545d0, 0x005543f0(0), and 0x00554450. So the same world-window dispatcher now has one grounded live layout-state service branch, not just shell input ingress. The nearby shared shell-presenter helper 0x00527de0 is now bounded as the common scalar-caption publisher reused by several tool windows. It scales one caller float through 0x005dd158, forwards that value into nested presenter field [this+0x364d] through 0x0052ea90, scales a second caller float through 0x005c8568, and stores that auxiliary caption-side weight in [this+0x3728]. Grounded callers now include Bulldoze.win, ChangeTrees.win, the world-surface brush ordinal setter, PaintRegion.win, PaintSound.win, PaintTerrain.win, and PaintTerritory.win, so this is the shared shell scalar-caption lane rather than a window-specific text formatter. The neighboring page-owned dispatcher leaves are tighter now too: 0x004ff58a, 0x004ff5b6, and 0x004ff5e6 are direct persisted toggles for the later Miscellaneous input page fields [0x006d4024+0x1146d7], [0x006cec74+0x28b], and [0x006cec74+0x283], with the last one also republishing a Game.win affordance through 0x004dd8d0; 0x004ff637, 0x004ff667, 0x004ff697, 0x004ff6c7, 0x004ff6f7, and 0x004ff727 are the page-owned toggle leaves for the Dialogs page fields [0x006cec74+0xf8] and [+0x26b/+0x26f/+0x273/+0x277/+0x27b]; and 0x004ff757, 0x004ff796, 0x004ff7c6, and 0x004ff84e are the remaining compact Gameplay page toggle leaves over [0x006d4024+0x114742], [0x006cec74+0x0a8], [+0x263], and [+0x309], with the +0x114742 path also nudging BuildingDetail.win and the +0x263/+0x309 paths triggering narrow live-tool follow-ons. The next tiny leaves are bounded now too: 0x00500036 is the direct apply leaf for the graphics-misc option family mirrored through 0x00484af0(0x0c) into control 0x7586; 0x0050006c/0x0050009c/0x005000cc are the shared setup-config toggles over [0x006cec74+0x247/+0x24b/+0x243] that persist the same three booleans later mirrored by Setup.win controls 0x0e88/0x0e89/0x0e8a; and 0x005000fc is the direct scrolling-page boolean-companion setter for [0x006cec74+0x120] and control 0x7585. neighboring stock-buy lane is tighter now too: 0x00433aa0 is the shared StockBuy.win availability gate, rejecting when scenario toggle [0x006cec78+0x4aa7] is set or when no selected-company id is present at [scenario+0x21]. The direct shell opener 0x00440660 and the page-side launcher 0x004de50f both use that gate before entering detail-panel mode 0x0c, whose same-mode refresh tail re-enters 0x00493150. The shell-side control strip under that window is tighter now too: 0x0050a660 is the raw selected-chairman-row setter for global 0x006d19f4, 0x0050a570 is the selected-company stock-data panel callback wired to control 0x3aa0 and feeding the shared stock formatter 0x004c0160, 0x0050a6d0 publishes the current selected company id into 0x00622b00 and restyles control 0x3a9b, 0x0050a670 is the shared live-window refresh wrapper hit by the buy/sell chairman mutators after they touch [profile+0x154] and the per-company holding band, 0x0050a5e0 is the constructor-wired invalidation callback for control 0x3a9a, and 0x0050a6a0 is the unconditional invalidation sibling used by the local in-window trade branches after they commit the rounded block. One level higher, 0x0050a730 is now bounded as the broad row/card refresh owner: it walks the active chairman profiles through 0x00477820/0x00477860, lays out the selected and unselected profile cards through the cached widget roots 0x006d19d8/0x006d19dc/0x006d19e8/0x006d19ec, resolves persona/name labels through 0x00476bb0, and pulls the same currently grounded metric lanes from 0x00476320, 0x00476780, and 0x00476c20. The selected-company panel under control 0x3a9a is separate and broader: 0x0050ae50 is now bounded as the main selected-company summary renderer, resolving the current company through 0x00518140, the current chairman row through 0x00477860, choosing one of panel roots 0x006d19e8/0x006d19ec, and then formatting a mixed text-plus-metric surface through helpers such as 0x00423eb0, 0x00426b10, and 0x00426ef0. The adjacent publish side is bounded too: 0x0050b910 formats the selected company ownership line through localized ids 0x0e10/0x0e11/0x0e12 plus the resolved company and owner labels, and 0x0050ba00 is the shared selected-company summary refresh tail over controls 0x3a9a/0x3a9b; 0x0050c130 is the narrow mode-0x0b refresh wrapper that re-enters that tail only when the current detail-panel object is actually StockBuy.win; and 0x0050c470 is the selected-company clamp/setter sibling that republishes 0x00622b00 before re-entering the same summary tail. The payload-driven trade commits are explicit now too: 0x0050c150 resolves one chairman record from payload [profile_id, company_id], derives the rounded buy block through 0x00476e50, and commits it through 0x00477110; 0x0050c1f0 is the same sibling for the rounded sell block and 0x00476460. Both also emit the local selected-chairman shell cue before the shared StockBuy.win refresh tail when the payload chairman matches the currently selected chairman in 0x006cec78. The message-owner and teardown side are bounded now too: 0x0050bbe0 is the real StockBuy.win dispatcher, with 0xcb control bands for chairman-row selection 0x3afc..0x3b5f, company-row selection 0x3d54..0x3db7, company wrap/step controls 0x3aa1..0x3aa3, and toggle-byte writes 0x3aad..0x3ab2, while 0xca owns the local buy row band 0x3c8c..0x3cef and sell row band 0x3cf0..0x3d53. The buy-side confirmation path now has one extra leaf too: 0x0050a600 is the callback-driven tutorial gate for the localized 0x0292 confirmation modal, opening the sibling tutorial modal 0x0e8c only on 0xcb control 0x03f4 while tutorial flag 0x006d3b4c is live. The destructor counterpart 0x0050bac0 releases the cached roots 0x006d19d8..0x006d19ec, frees the per-company cached stock-data handles in 0x006d1748, invalidates controls 0x3b60 and 0x3e4e, clears singleton 0x006d19f0, and then tails into the common shell-object teardown. The remaining adjacent detail-panel gates are now bounded tightly enough to carry by family: 0x00434db0 is the scenario-toggle-gated company-detail mode-0x0b availability gate, while 0x00434e20 is the selected-company-or-editor detail mode-0x06 availability gate that only hard-blocks when all three scenario toggles [+0x4ab3/+0x4ab7/+0x4abf] are set. The train-buy family is no longer just an unnamed probe pair either: the opener path is now grounded under the same shell-owned cadence through shell_can_open_trainbuy_window_or_warn and shell_open_or_focus_trainbuy_window, and its current family semantics already extend beyond a bare locomotive picker into selected-train upgrade summary and route-edit affordances. The direct shell opener 0x004406c0 now aligns with the page-side launcher 0x004de7d9: both use shell_can_open_trainbuy_window_or_warn 0x00433b00 before calling shell_open_or_focus_trainbuy_window 0x00512c50. The selected-train side is tighter now too: we have explicit query helpers for the selected train record, id, validity, and company ownership, plus one explicit ownership-mismatch warning modal. That same pass also clarified one boundary we should not conflate: the neighboring shell family rooted at 0x006d3b20 is now grounded separately as TrainDetail.win. It reuses the same selected-train context and some of the same helpers, but it is not the same Trainbuy.win singleton family. The TrainDetail.win side now has its own constructor, opener, refresh path, and message owner above the broader train-command strip. Its inner 0xcb strip is tighter now too: one bounded branch is the selected-train engine-replacement or trainbuy handoff lane using warning ids 593/594, and another is the selected-train retirement lane using 595/596/597 with either a local teardown path or multiplayer opcode 0x37. The remaining train-command family is narrower too: the shared 0x33-stride helper trio at 0x004b2f00, 0x004b3000, and 0x004b3160 now looks like a real train route-stop or waypoint list rather than a generic row buffer, and route-entry flag byte +0x28 now has one grounded top-level split: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side. The helper train_route_list_count_live_site_reference_entries 0x004b2b80 now counts the first family explicitly. One deeper lower-bit result is grounded too: both train_route_list_insert_staged_entry_at_index and the auxiliary finalize helper train_finalize_aux_route_entry_buffer_preserving_subflags 0x004a94b0 explicitly preserve bits 0x40, 0x20, and 0x10 in the same flag byte during route-entry rewrites. Those bits are also no longer copy-only: the neighboring shell helper shell_building_detail_refresh_flagged_service_capability_rows 0x004b9a20 now consumes them to restyle the BuildingDetail.win row bands 0x7d07..0x7d1c and 0x7f58..0x801f. The important boundary is tighter now too: the 0x7d07..0x7d1c band is a style-only indicator family in current disassembly, not a hidden text-publishing row family with missing captions. The grounded player-facing text sits elsewhere: the fixed express-side triplet 0x7f58..0x7f5a is table-fed from RT3.lng 494/497/498, and the sibling special service rows still align to Dining Car and Caboose. So the subflags now have one real shell-side consumer instead of only preservation logic, and the old “missing label” seam on the indicator rows is gone. The broader BuildingDetail.win refresh family is tighter too: shell_building_detail_refresh_subject_cargo_and_service_rows 0x004ba3d0 now clearly owns the selected subject rows around 0x7d06, 0x7d96.., and 0x7d0e, resolving ordinary ids through the live candidate collection and the special express-side ids through the embedded AnyCargo.imb, AnyFreight.imb, and PassMail.imb paths. The first fixed triplet is now table-grounded instead of only inferred: 0x00621df8 seeds the short-label controls 0x7dc8..0x7dca with RT3.lng 494..496 Any Cargo, Any Freight, and Any Express, while 0x00621e10 seeds the adjacent 0x7e90..0x7e92 icon-name triplet with AnyCargo, AnyFreight, and PassMail before %1.imb formatting. RT3.lng also tightens the longer popup side now: 0x00621e04 feeds the first clickable selector triplet 0x7f58..0x7f5a with 494/497/498, so the help text there is Any Cargo, Any Freight\n(Freight is everything but Passengers, Mail, and Troops), and Any Express\n(Express is Passengers, Mail, and Troops). The sibling special service rows still align to Dining Car and Caboose. The extracted BuildingDetail.win blob now sharpens the resource boundary too: its embedded text table is currently sparse rather than rich, exposing the help line for 0x7d01, repeated BuildingDetail.imb asset strings, and one standalone caption entry Cargo. That makes Cargo the strongest current resource-side anchor for the row header around 0x7d06. The ordinary deeper rows are tighter now too: they do not look like hidden caption-table entries, but like live candidate-derived rows. The current path validates each ordinary id through indexed_collection_entry_id_is_live 0x00517d40, resolves the concrete candidate record through indexed_collection_resolve_live_entry_by_id 0x00518140, and then reuses candidate field [record+0x04] as one shared stem for both the row asset %s.imb path and the neighboring display-label lookup through localization_lookup_display_label_by_stem_or_fallback 0x0051c920. That lookup is now bounded too: it scans the static stem table at 0x006243c8, already grounding entries such as Alcohol, Aluminum Mill, Automobiles, Bauxite, and Big Boy against RT3.lng 3202..3220, and only falls back to localized id 3866 when no table entry matches before the fixed 0x384..0x386 express-side triplet takes over. One neighboring candidate-side helper is tighter now too: structure_candidate_query_route_style_or_local_availability_metric 0x0041e650 shares the same route-style byte at [candidate+0x46], returning the cached local float at [candidate+0x5a] for ordinary candidates but switching route-style rows to one normalized count over the world-side route-link collection 0x006ada90 keyed by candidate class [candidate+0x3e]. That collection is tighter now too: it is constructed during world bring-up by placed_structure_route_link_collection_construct 0x00468110, and current grounded creation flow through placed_structure_route_link_allocate_site_pair_for_candidate_class 0x00467f50 seeds class byte +0x10, a masked initial state template, and the strongest current creation-side site-pair fields at +0x0c and +0x0e before placed_structure_route_link_attach_site_owner 0x00467eb0 links the new route-link record into the placed-structure-owned chain at [site+0x272]. The owner-side split is tighter now too: route-link field +0x08 is the separate route-node-style owner anchor used by placed_structure_route_link_attach_route_node_owner 0x00467f20, while +0x0a/+0x0c/+0x0e now read as the site-reference triple matched by placed_structure_route_link_collection_remove_links_touching_site_id 0x004681f0. Creation flow now sharpens that further: +0x0c is the strongest current candidate for the stable first-site field seeded before owner attachment, +0x0a is the mutable owner-site anchor installed by the attach helper, and +0x0e is the stable second-site field. One more split is tighter now too: placed_structure_route_link_recompute_endpoint_pair_state 0x00467c30 currently uses +0x0a and +0x0e as the active endpoint site pair while recomputing state byte +0x12. The load/save boundary is tighter now too: package save currently persists only the direct indexed-collection header band of 0x006ada90 through 0x00517d90, world-entry bring-up mirrors only that header refresh through 0x00518680, and the live endpoint or grid state is then regenerated later through placed_structure_route_link_collection_recompute_all_endpoint_pair_state 0x004682c0 and placed_structure_route_link_collection_rebuild_route_style_grid_counters_and_endpoint_state 0x00468300 rather than through a separate tagged per-record payload lane. byte +0x12; +0x0c is still not directly read there. The family also has a clearer release and refresh side now: placed_structure_route_link_release_and_detach 0x004680b0 rolls back the class counters and then tails into placed_structure_route_link_detach_current_owner_chain 0x00467df0, while placed_structure_route_link_collection_recompute_all_endpoint_pair_state 0x004682c0 explicitly reruns the per-record endpoint-pair reconciler across the whole live route-link collection. One layer above that, placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state 0x00468300 now looks like the full-family refresh owner: it clears three route-style class lanes in the world-grid tables rooted at [0x0062c120+0x2129], then clears bit 0x2 across the live route-link records and reruns the endpoint-pair reconciler. That now lines up with the visible shell split: non-route candidates keep the richer local metric and price lane, while route-style candidates use one world-side route-link family instead. The emission side is tighter now too: placed_structure_try_emit_best_route_style_peer_link_for_candidate_class 0x0040fef0 scans the live placed-structure collection for one best peer site by class-specific weight, distance window, and type gate, then only creates a new route-link through placed_structure_route_link_allocate_site_pair_for_candidate_class 0x00467f50 when placed_structure_endpoint_pair_has_shared_route_entry_key 0x0040fbe0 says the chosen site pair does not already share a route-entry key. One layer above that, placed_structure_rebuild_route_style_candidate_scores_and_peer_links 0x004101e0 now reads as the broader per-site owner of this lane: it computes per-class route-style score scalars from local site state and scenario multipliers, drives the first three route-style emission attempts, and then continues into a larger descriptor-driven scoring phase. Inside that larger pass, placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link 0x0042cab0 now cleanly shows the split between ordinary candidates, which add directly into the local route-style grid lane at [site+candidate*4+0x103], and remapped route-style candidates, which re-enter the peer-link emitter. One layer above that, the broader post-create or post-edit site rebuild placed_structure_finalize_creation_or_rebuild_local_runtime_state 0x0040ef10 conditionally re-enters 0x004101e0 with stack flag 1 when its local latch at [site+0x29e] stays clear, so the route-style lane is no longer floating under an unnamed single-site caller. The placement side is tighter now too: the direct constructor placed_structure_collection_allocate_and_construct_entry 0x004134d0 is the shared allocator immediately beneath the current placement-side callers before they hand the new site into 0x0040ef10, and the lower constructor placed_structure_construct_entry_from_candidate_and_world_args 0x0040f6d0 now bounds the actual field-seeding layer beneath that allocator. The old unresolved higher placement chooser is bounded more cleanly now too: the 0x00403ed5 and 0x0040446b direct-placement commits sit inside one larger helper, city_connection_try_build_route_with_optional_direct_site_placement 0x00402cb0. That shared heavy builder is now the common target of the compact wrapper 0x00404640, the peer-route candidate builder 0x004046a0, the region-entry pair wrapper city_connection_try_build_route_between_region_entry_pair 0x00404c60, and the direct retry paths inside simulation_try_select_and_publish_company_start_or_city_connection_news 0x00404ce0. Internally it now has three bounded lanes: an early route-entry search or synthesis attempt through route_entry_collection_try_build_path_between_optional_endpoint_entries 0x004a01a0, a single-endpoint direct-placement lane that scans Maintenance and ServiceTower candidates and commits through 0x00403ed5 -> 0x004134d0 -> 0x0040ef10, and a later paired-endpoint fallback lane that seeds two endpoint candidates from the same stem family, walks a temporary route-entry list, and commits through 0x0040446b -> 0x004134d0 -> 0x0040ef10. That early lane can now be described more concretely: it can reuse supplied route-entry endpoints, synthesize a missing leading endpoint from the caller's coordinates, seed the route-store builder-state block, and then hand off to the deeper path-search core without placing a new site. The previously vague side family at 0x006cfcb4 is tighter too: current evidence now bounds it as a small auxiliary route-entry tracker collection with an allocator at 0x004a42b0, a refcount or destroy path at 0x004a4340, a direct route-entry group-id setter at 0x00489f80, an endpoint-membership probe at 0x00494ed0, a boolean-latch refresh or owner-notify path at 0x00494fb0, and a two-endpoint merge or bind helper at 0x00494f00. One smaller constructor-side ownership split is tighter now too: the cached u16 chain fields [site+0x26e], [site+0x270], and [site+0x383] are no longer free-floating. Constructor-side helper 0x0041f7e0 prepends one new peer into that chain by storing the old head from [this+0x383] into [peer+0x270] and then replacing [this+0x383] with the peer's own placed-structure id [peer+0x2a4]; the direct resolver 0x0041f810 turns the cached head id back into one live record through 0x0062b26c; and the removal-side companion 0x0041f850 removes one peer from the same chain before clearing [peer+0x26e/+0x270]. That caller split is now strong enough to treat this as one cached single-link or predecessor-chain family beneath placed-structure construction and rebuild rather than as unrelated scratch words. That bind side is tighter now too: the trackers group route entries only when a route-key-like value from 0x0048aa70, the route-entry signature word +0x22e, and the boolean latch derived from byte +0x44 all agree. The deeper handoff under that lane is no longer anonymous either: route_entry_collection_search_path_between_entry_or_coord_endpoints 0x0049d380 is now bounded as the internal search core that runs the first candidate sweep, quality gates, and the later route-extension fallbacks before returning one resolved route-entry id or -1. The first sweep now has a bounded owner at 0x0049bd40, and the two later fallback helpers are bounded as the route-entry point-window coverage query 0x00494cb0 and the frontier-extension helper 0x0049c900. The math side is bounded more cleanly now too: the family reuses math_measure_float_xy_pair_distance 0x0051db80 for its direct point-to-point scalar, math_compute_quadrant_adjusted_heading_angle_from_xy_pair 0x004952f0 for heading-angle construction, math_normalize_subtracted_angle_delta_and_report_wrap 0x004953c0 for wrapped angle deltas, and now one tighter visual-side strip too: 0x00539230 applies one local float-preset layout from state byte [entry+0x218], 0x00539380 loads the matching table-driven profile bands and optional display latch [entry+0x44], 0x005394b0 exports four consecutive 3*dword triplet bands from the entry into caller buffers, and 0x005391b0 releases one optional world-space attachment before the entry's vtable slot +0x00 teardown fires. The adjacent publish side is bounded too: 0x00539580 broadcasts one caller-supplied three-scalar packet across the optional attached-handle list at [entry+0x08], and 0x005395d0 ensures that same list, adds one new handle, and immediately republishes one aggregate scalar derived from local bands [+0x18/+0x24/+0x30/+0x3c] together with head lanes [+0x0c/+0x10]. The next owner layer is tighter now too: 0x00539640 is the heavy derived-band rebuild that turns those four triplets plus profile weights [entry+0x1f5/+0x1f9/+0x1fd] into the larger scalar bands rooted at [entry+0x63] through [entry+0x1d3], refreshes center scalars [entry+0x0c/+0x10], re-enters root query 0x00534490 several times, and conditionally maintains the optional 0xc0-byte display buffer at [entry+0x1e3] according to display-state byte [entry+0x44]. The surrounding wrappers are coherent with that same ownership split: 0x0053a740 copies caller triplets into [entry+0x14/+0x20/+0x2c/+0x38], refreshes optional attachment id [entry+0x55] through 0x00533e00/0x00533dd0, and republishes center lanes [entry+0x1ed/+0x1f1]; 0x0053a890 reprojects the stored triplets through 0x00534490 and rebuilds; 0x0053a920 fills all four triplets from one uniform scalar before rebuilding; 0x0053ac40 rebinds the root pointer, clears attachment state, and optionally rebuilds from the current triplets; 0x0053aca0 is the concrete default constructor for the same route-entry object family; and 0x0053ae10 is the construction-time root-bind plus state-profile-and-triplet initializer. The attachment manager beneath that strip is tighter too: 0x0053a5b0 is the tiny broadcast wrapper over current head lanes, 0x0053a5d0 is the heavier ensure-and-clone path that seeds one new attached handle from the first live entry when a list already exists, and 0x0053a6d0 tears that attached-handle list back down. The collection side is tighter too: 0x00491af0 constructs the indexed 0x006cfca8 owner beneath the world bundle-load path, and the later post-load 319 lane now uses 0x00491c20 as a dedicated collection-wide refresh pass that re-enters 0x00539640 on every live route entry. That keeps the route-entry visual or presentation side grounded as a real sibling strip to the search and regrouping code, not loose per-caller scratch fields. angle-delta checks, and math_abs_double_with_crt_special_case_handling 0x005a152e for the absolute-value side of the quality gates. Current evidence also bounds the threshold shape a little more tightly: the initial sweep and later extension path both reuse one signed angle-bias term +/-0.181000038854627, and the first sweep switches between a looser 1.4 and stricter 1.8 quality multiplier depending on route-policy byte 4 or the broader display-runtime preference [0x006cec78+0x4c74], already grounded elsewhere as Auto-Show Grade During Track Lay. The small policy-byte semantics are still not fully closed, but current evidence is tighter than before. Literal byte 1 is now the strongest current match for direct linked-site endpoint-anchor creation or replacement, because the linked-site constructor and neighboring repair branches around 0x00480463, 0x00480a77, and 0x00480b69 all feed that byte into 0x00493cf0 before rebinding one chosen route-entry anchor through 0x0048abc0. Literal byte 2 now looks broader: the later world-side caller at 0x00480cd0 and the linked-site refresh helper placed_structure_refresh_linked_site_display_name_and_route_anchor 0x00480bb0 both reach 0x004a01a0 with both optional endpoint-entry ids unset and that byte, so the strongest current read is a full linked-site route-anchor rebuild between optional endpoint entries rather than the narrower direct creation lane. The TrackLay side now gives one tighter user-facing anchor too: the live mode field 0x00622b0c is already grounded as Lay single track. 0x1 versus Lay double track. 0x4, and the small mapper 0x004955b0 collapses that state into the endpoint-policy bytes later passed to 0x00493cf0, so the strongest current read is policy 1 = single-track endpoint synthesis and policy 4 = double-track endpoint synthesis. Bytes 1/2 are still the ones that enable the auxiliary tracker lane in 0x004a01a0, while byte 4 now reads more narrowly as the larger company-side endpoint-synthesis charge inside 0x00493cf0, because that helper feeds -1 versus -2 into the saturating company counter helper 0x00423ec0 on [company+0x7680] rather than skipping the company branch entirely. That counter is tighter now too: nearby company initialization seeds it to 50 when scenario byte 0x4aaf is enabled and to sentinel -1 otherwise, while the companion getter 0x004240a0 returns either the live counter or fixed fallback 29999. Current language-table correlation also gives 0x4aaf a stronger player-facing meaning: it is the live gate behind Company track laying is limited... and the event variable label Company Track Pieces Buildable. So the current strongest read is available track-laying capacity, not an abstract company route-budget. That site-side helper also closes one adjacent ownership gap: beneath placed_structure_finalize_creation_or_rebuild_local_runtime_state 0x0040ef10, it rebuilds one linked site's route-entry anchor and display-name buffer. That path is tighter now than just “bind anchor then touch 0x006cfcb4”: after the literal-policy-2 rebuild succeeds it re-enters aux_route_entry_tracker_collection_refresh_route_entry_group_membership 0x004a45f0, which can now be described more concretely. Its early prepass at 0x004a4380 can split one mismatching adjacent subchain into a fresh tracker group; its later helper at 0x004a4ce0 can transfer one compatible adjacent chain between neighboring groups; and the repair-side helper at 0x004a4ff0 can reseed a whole route-entry component into a fresh tracker when the old group id is missing or invalid. The regrouping pass also still rewrites compatible endpoint slots through 0x004950f0 and refreshes one nearby cached-match payload band through 0x00495020 before the helper resumes the name-buffer work. The remaining display-name side still matches the earlier grounded text family: copy the resolved city name when available, append civic suffixes Township, New, Modern, or Renaissance, append Service Tower or Maintenance Facility on the linked-instance class branches, and otherwise fall back through the older Junction..Center and Anytown text families. The higher owner-refresh side of that same tracker family is tighter now too. The reusable gate at 0x004a4c00 no longer looks like a stray predicate: it explicitly requires both route-entry trackers to keep matching cached fields +0x18/+0x1c/+0x1d/+0x1e and both route entries to keep their special side fields +0x20e/+0x222 unset before adjacent-chain transfer is allowed. The collection-wide traversal sweep at 0x004a5fc0 is bounded now as the connected-component refresh owner over tracker field +0x0c, with a temporary queue at [this+0x94] and direct fallback into the reseed helper 0x004a4ff0 whenever one neighboring route entry has lost valid tracker ownership. Above both of those sits aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links 0x004a6360, which now reads as the owner-side latch-change refresher invoked from 0x00494fb0: it starts from one owner route-entry id, confirms both bound endpoint entries agree on the boolean class state implied by route-entry byte +0x44, and then probes both endpoint sides for adjacent route-entry groups that can be absorbed through the 0x004a4c00 -> 0x004a4ce0 gate-and-transfer pair. The sibling query side is bounded now too: aux_route_entry_tracker_collection_query_component_label_by_tracker_id 0x004a6320 is the dirty-aware accessor for tracker field +0x0c, while aux_route_entry_tracker_dispatch_route_entry_pair_metric_query 0x004a65b0 is the remaining mode-switched lower metric dispatcher beneath the heavier chooser at 0x004a6630, forwarding fixed route-entry-pair candidate sets into either 0x004a5280 or 0x004a5900 depending on the shared hundredths-scaled build-version query runtime_query_hundredths_scaled_build_version 0x00482e00 over 0x006cec74. The current caller thresholds >= 0x67, >= 0x68, >= 0x69, and >= 0x6a now line up with executable build values 1.03, 1.04, 1.05, and 1.06, and the version source itself can come from the multiplayer companion path as well as the local executable, so this split is no longer best-read as a time- or era-side cutover at all. It now reads more cleanly as a pre-1.03 versus 1.03+ route-metric compatibility dispatcher. That lower split is tighter now too: 0x004a5280 is the weighted recursive branch with heuristic ordering, per-tracker best-cost cache 0x006cfcac, and prune threshold 0x006cfcb0, while 0x004a5900 is the alternate recursive neighbor-walk branch that stays within compatible component labels through 0x004a62c0 and accumulates step and mismatch penalties over route-entry links +0x206/+0x20a/+0x20e. Above both of them, aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks 0x004a6630 is now bounded as the real chooser: direct fixed-pair query when both entries pass 0x0048b870, otherwise endpoint-pair fallback across the two tracker groups. The adjacent route-style rebuild side is tighter now too: the same build-version family reaches placed_structure_rebuild_route_style_candidate_scores_and_peer_links 0x004101e0, where build 1.04+ keeps one Recycling Plant stem-specific compatibility branch alive and build 1.05+ skips one older descriptor-side attenuation fallback. There is also one neighboring world-side compatibility lane now bounded below the same family: placed_structure_collect_connected_component_tile_bounds_with_version_gate 0x004160c0 skips one older recursive component-bounds walk through 0x00415f20 on build 1.03+ when scenario field [0x006cec78+0x46c38] is already active. The wrapper above that path is bounded now too: placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh 0x00416170 walks the caller rectangle, maps tile keys into the component table rooted at 0x0062ba7c, and only re-enters 0x004160c0 when the current owner still has no cached bounds and the local world or scenario suppressors stay clear. The higher neighboring raster side is tighter too. world_grid_refresh_projected_rect_sample_band_and_flag_mask 0x00418610 is the shared projected-rectangle helper above world_grid_refresh_flagged_region_float_extrema_and_mean 0x00415020: it refreshes the temporary sample band at 0x0062b7d0, publishes the surviving rectangle through 0x0044d410, and on the single-sample path re-enters world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples 0x004185a0 to flip mask bit 0x01 for the corresponding non-sentinel cells. Current grounded callers for 0x00418610 are the neighboring placed-structure local-runtime helper 0x00418be0 and the heavier placement validator 0x004197e0, so this adjacent family now reads more like projected placement or local raster prep than an unowned generic world-grid scan. One neighboring caller into the same height-support band is tighter now too: the world-side branch at 0x00419070..0x004190f0 walks one admitted local window, dispatches the acceptance-gated relaxer 0x0044d6e0 once per cell with a one-cell radius and no immediate tail refresh, and only after that outer loop completes re-enters 0x0044d410 on the full surviving rectangle. The higher owner split is tighter now too. placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch 0x00418be0 is the broader construction or rebuild lane: resolve one candidate id from a stem, build projected scratch through 0x00416ec0, then publish the projected rectangle and validate its side windows through placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows 0x00416620. That publish pass is bounded now too: it stages 0x0062b308/0x0062b30c/0x0062b310, validates the rectangle against route-entry coverage through route_entry_collection_query_rect_window_passes_entry_type_gate 0x00494240, can branch into the special projected-slot picker placed_structure_try_select_projected_rect_profile_slot 0x00415570, and refreshes the compact per-cell side tables through world_grid_refresh_projected_rect_surface_and_region_byte_tables 0x00414e10 before the finished scratch is copied into one queued runtime record and the new record re-enters 0x00416170 when its rectangle is valid. The smaller sibling strip under that projected-slot family is tighter now too. The shared probe projected_rect_profile_slot_probe_template_cells_and_height_span 0x004153f0 tests one fixed 8x8 template from 0x005edd30 against the current projected rectangle, rejecting on out-of-bounds cells, occupied cells already marked in 0x0062b300, or the paired world-grid gates 0x00448af0(mode 0) and 0x004499c0, then sampling 0x00448aa0 and requiring enough local height span. The selector 0x00415570 now reads as a three-path owner over that probe: reuse cached slot 0x005ee030, try the localized-id-11 default, then scan slots 0..11 until one passes. Once a slot is live, placed_structure_build_projected_rect_profile_mask_bands_from_selected_slot 0x004156b0 expands the same template family into the four mask bands [record+0xcf/+0xd3/+0xd7/+0xdb], setting per-plane presence flags at [record+0x177/+0x17b/+0x17f/+0x183] and freeing any empty plane buffer. The packed-cell and bounds side beneath the same family is tighter too: projected_rect_packed_cell_list_try_append_unique_xy_with_optional_highbit_flag_and_expand_quarter_bounds 0x00413df0 appends unique packed cells into 0x0062b318 while expanding the quarter-scale bounds at 0x0062b7a8..0x0062b7b4, and the adjacent helper strip 0x00414270/0x004142c0/0x004142d0/0x004142e0 now reads as replaying those packed cells into compact-grid mode 2 plus the shared bounds extractor for the same sentinel-terminated list. The smaller sibling 0x00419200 is now bounded beneath that same projected-rectangle family too: it is the tiny getter over the temporary dword cell-value bank at 0x0062b300, flattening one caller cell through live world width [0x0062c120+0x2155] and returning the corresponding dword when the bank exists, else 0. Current grounded caller is the later world-side branch at 0x0048af99. The smaller sibling placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds 0x00418a60 now reads as the current-subject clone path above the same connected-component and mask-refresh helpers, returning the cloned local runtime record later stored into [site+0x24e] by placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem 0x0040e450. The higher wrapper above that clone path is bounded now too: placed_structure_collection_refresh_local_runtime_records_and_position_scalars 0x004133b0 first drains the temporary site-id queue rooted at 0x0062ba64/0x0062ba6c/0x0062ba70 through placed_structure_local_runtime_site_id_queue_count 0x00414480 and placed_structure_local_runtime_site_id_queue_pop_next 0x00413f50, rebuilding one cloned local-runtime record per queued placed structure through 0x0040e450, and only then sweeps all live placed structures through the side refresh helper placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon 0x0040ee10. The constructor or ownership split beneath that family is tighter now too. The shared allocator placed_structure_collection_allocate_and_construct_entry 0x004134d0 no longer just reaches an anonymous 0x3e1-byte scratch object: it first constructs one concrete placed-structure specialization through placed_structure_construct_concrete_specialization_vtable_5c8c50 0x0040c950, which calls 0x0045b680 to seed the common base table 0x005cb4c0, clear the derived field band [this+0x23a..+0x26a], and re-enter the older base initializer 0x00455610, then installs the specialization table 0x005c8c50. The paired cleanup path at 0x0040c970 now reads like the matching teardown thunk: it briefly reinstalls 0x005c8c50, then immediately demotes the record back to the base table through 0x0045b040 -> 0x00455650 before the stack object is freed or unwound. The corresponding serializer entry 0x0040c980 is equally tight now: it simply tails into 0x0045b560, which first re-enters the base serializer 0x004559d0 and then emits the derived payload bracketed by tags 0x5dc1 and 0x5dc2 over [this+0x23e], [this+0x242], [this+0x246], [this+0x24e], and [this+0x252]. One nearby string clue is useful but narrower than it first looked. The specialization table at 0x005c8c50 is immediately followed by RadioStation and Radio Station, but the local member method 0x0040ce60 now shows why: it compares site stem [this+0x3ae] against Radio Station, canonicalizes that stem to RadioStation on match, and then re-enters 0x0040cd70 plus 0x0045c150. So those adjacent strings ground one stem-normalization lane inside the specialization, not the specialization name by themselves. The small virtual-slot and cached-id side is tighter now too. The same 0x005c8c50 table carries three literal-false stubs 0x0040cc10/0x0040cc20/0x0040cc30, one literal-true stub 0x0040ccc0, and the narrower linked-site-id presence predicate 0x0040ccb0, which simply returns whether [this+0x2a8] is nonzero. Beneath the stem-normalization path, 0x0040cd70 is now bounded as the common cached source/candidate resolver: it clears [this+0x3cc] and [this+0x3d0], scans source collection 0x0062b2fc for a stem match against [this+0x3ae], stores the matched source id into [this+0x3cc] plus the linked candidate/profile id from [source+0x173] into [this+0x3d0], and when no match exists formats localized id 0x00ad through 0x0051e980 with the current stem buffer. That warning path is tighter now too: 0x0051e980 is the guarded warning-modal publisher that forces cursor visibility through MouseCursor.cpp before showing the shared warning box. The two tiny followers 0x0040cec0 and 0x0040cee0 then resolve those cached ids back into concrete source and candidate records through 0x0062b2fc and 0x0062b268 respectively. The derived payload and transient family under that same table is tighter now too. 0x0045c150 is the clear payload-loader counterpart to 0x0045b560: it reinitializes the derived field band, opens the 0x5dc1/0x5dc2 payload bracket, restores the two payload strings into [this+0x23e] and [this+0x242], clears the transient roots [this+0x24e], [this+0x256], [this+0x25a], and [this+0x25e], and then rebuilds follow-on specialization state through 0x0045b5f0 and 0x0045b6f0. The neighboring builder pair is coherent too: 0x0045b210 formats amb_%1_01.wav, allocates a 0x141-byte transient object, stores it at [this+0x24a], and registers it through 0x0052da00, while 0x0045c310 allocates the separate primary transient handle at [this+0x246] from payload strings [this+0x23e] and [this+0x242], then publishes it through 0x00530720 and 0x0052d8a0. The next rebuild layer is tighter now too. 0x0045b5f0 resolves one current world-position tuple through 0x0052e720 -> 0x0051f090 -> 0x00534490, then uses that derived scalar to refresh the ambient-side transient again through 0x0045b210. Above that, 0x0045b6f0 clears the optional handles at [this+0x25a] and [this+0x25e], then probes and materializes a larger named variant family rooted in [this+0x23e] through strings such as %1_, %1_Upgrade1, %1_Anim%2.3dp, %1_Upgrade1Anim%2.3dp, and %1_Upgrade1Light%2.3dp, looping across numbered variants and publishing surviving records through 0x0052d8a0. One higher timed branch is bounded now too: 0x0045baf0 advances the two timer-like fields [this+0x26a] and [this+0x266], gates on nearby world-distance and candidate-side checks, and then formats one output around rnd_%1_%2.wav plus the same anim or light string family before dispatching through 0x00531e50 under owner 0x006d402c. Their release-side companions 0x0045b160 and 0x0045c3c0 tear down those same transient roots and payload strings again, and the recurring service slice 0x0045be50 updates the derived scalar triplet [this+0x22e], [this+0x232], and [this+0x236] before republishing it through 0x00530720. The string literals amb_%1_01.wav, %1_Anim%2.3dp, %1_Upgrade1Anim%2.3dp, %1_Upgrade1Light%2.3dp, and rnd_%1_%2.wav therefore ground the derived band [this+0x23e..+0x26a] as one payload-plus-transient owner family with ambient, animation, light, and random-sound components, rather than more linked-site or route-entry ids. One broader specialization-side build pass under that same family is bounded now too. 0x0045b760 first scans one base-or-upgrade descriptor family rooted in [this+0x23e] through %1_ or %1_Upgrade1, probing each numbered hit through 0x0053c930 and dispatching every accepted one through vtable slot +0x7c. It then builds the matching attached-emitter list through 0x0045e940, ensures the shared %1_Anim.3dp payload root exists through 0x0045ae80, and finally scans the paired animation family through %1_Anim%2.3dp or %1_Upgrade1Anim%2.3dp, materializing each accepted hit into a 0x206 record through 0x00530640, publishing that record through 0x0052d8a0, hashing the generated name through 0x0053d810, and forwarding the result into [this+0x256] through 0x0045a7f0. So that specialization side now has one explicit base-or-upgrade descriptor and animation-record build pass above the later timed anim/light/random-sound service slice, not just the narrower %1_Anim and %1_Upgrade1Light helpers. The shared %1_Anim.3dp collection under that build pass is tighter now too. 0x0045ae80 formats literal %1_Anim.3dp, probes the named-bank owner 0x006d4020, reads the matched payload bytes, and lazily allocates the intrusive shared list root 0x006acd5c, so this is the bootstrap for the specialization-side shared animation payload family rather than just another bank-read leaf. 0x0045a7f0 then acts as the keyed replace-or-publish helper over that same family: it rewrites matching keys across the current 0x006acd50/0x006acd4c row collection, mirrors the replacement into the per-row four-lane pointer bands, inserts newly active rows into the intrusive list rooted at 0x006acd5c, and when selector table 0x006acd44 is live it allocates one selector-0 effect slot through 0x00475ed0 before forwarding it into 0x00475240(-1,0). The smaller helper 0x0045a700 is the keyed three-float accumulator beneath that same path: it scans the live 0x168-byte rows in 0x006acd50, filters on one key dword plus row flag bit 0x400, and accumulates one output anchor delta from the shared basis bands in 0x006acd4c+0x04/+0x34 or +0x40/+0x70. The service side above the collection is also bounded: 0x0045af50 clears globals 0x006acd44/48/54, publishes the current row collection into 0x006acd50/0x006acd4c, releases oversize selector roots through 0x00475100, and prunes every intrusive active record in 0x006acd5c whose owner pointer at [record+0xf0] matches the current collection owner. The heavier per-record body is 0x0045a9c0: it honors the current controller gates in 0x006acd48/58, clears and re-arms the selected effect-slot band in 0x006acd44, optionally mirrors one caller dword into row field [row+0x80], updates timing and mode fields across every matching shared row, derives local scalar deltas through 0x0045a280, optionally subtracts keyed anchor deltas through 0x0045a700, and republishes the finished two owner triplets through 0x0052e8b0 and 0x00530720. 0x0045ade0 seeds cursor 0x006acd60 from [0x006cec78+0x15], then services the intrusive list in 0x0f-tick windows by dispatching the heavier per-record body at 0x0045a9c0(owner, cursor, 0) for every linked record whose owner pointer at [record+0xf0] is live. So the specialization transient family now includes a concrete shared %1_Anim.3dp payload root, keyed record replacement, keyed anchor accumulation, and a bounded 15-tick shared service loop, not just the base builder at 0x0045b760. The low-side leaves under that same family are tighter now too. 0x0045b050 is the explicit field reset for payload roots [this+0x23e/+0x242], transient handles [this+0x246/+0x24a/+0x24e], selector slot [this+0x262] = -1, timer fields [this+0x266/+0x26a], and the packed flag band [this+0x23a..+0x23d], with an optional tail into 0x00455610 when the caller requests a broader base clear. 0x0045b0b0 is the paired integer-triplet publish leaf: it forwards one caller triplet through 0x0052e680 on the specialization owner and, when present, repeats that same publish into the primary transient [this+0x246]. 0x0045b0f0 is the neighboring packed RGB-triplet forwarder into vtable slot +0x58. The two tiny wrappers around them are now explicit too: 0x0045b040 demotes the specialization straight back to base vtable 0x005cb4c0 before tailing into the common cleanup body 0x00455650, while 0x0045b110 is just the direct wrapper into the shared world-anchor triplet publisher 0x00455660. One intermediate transient build layer is bounded now too. 0x0040cf00 first requires creation-mode byte [this+0x3d4] == 1 and live seed handle [this+0x24e], re-enters 0x0045b370(1), derives one scaled float from current local geometry through [this+0x14], [this+0x21], [this+0x3a], and 0x005c8cf4, and then allocates a second transient handle into [this+0x25a] through 0x00475ed0. It follows that with one current world-position resolve through 0x00414450 and 0x0052e720, several local offset-triplet writes through 0x00475010, and four numbered channel updates through 0x00475030 with selector ids 1..4. That is enough to bound it as another specialization-side transient-handle builder beneath the same payload family as 0x0045c310 and 0x0045b210, without yet over-naming the user-facing subtype or effect semantics of the built handle. The adjacent data-loading strip under that same transient family is tighter now too. 0x00474700 reloads particles.dat into global root 0x006cea5c and then registers literal ParticlesTexture through owner 0x006d4030; 0x00474790 reloads emitters.dat into global root 0x006cea60; 0x00474820 hashes one caller-supplied emitter name and resolves the first matching entry out of that emitters.dat table; 0x00474860 is the adjacent formatted-variant iterator that walks the same table through %s%s%i.3dp, saving the selected row root into 0x006cea90 and the generated variant name into 0x006cea94; 0x00474970 is the small handle-array release helper used by the same emitter-template teardown side; and 0x004749a0 is the tiny exact-compare predicate for literal steam. The lower definition-to-handle materialization body is bounded now too: 0x004749d0 copies scaled float and packed dword bands from one emitter-definition row into the attached emitter handle, resolves the named particle row from particles.dat through 0x0053d810, and mirrors that particle row into [handle+0x10c..] before returning the live handle. The higher creator above that materializer is tighter now too: 0x00474e20 first strips special high bits for CargoMoney_DollarSign, clears incoming flag 0x400 when definition gate [def+0xb8] is zero, and then either hashes the definition name plus owner token and clones one owner-side template through 0x00556ce0, or allocates a fresh 0x1fd runtime emitter through 0x00556920 before re-entering 0x004749d0. On success it publishes that emitter through 0x0052d950, stores the definition owner pointer into [emitter+0x60], and when final flags carry 0x02000000 it forces persistent flag dword [emitter+0xbc] = 1. One larger owner-stem branch above that iterator is bounded now too: 0x0045e940 rejects Stadium, clears caller flag bit 0x10 for ParticleCar, repeatedly pulls formatted variants through 0x00474860, instantiates each accepted variant through 0x00474e20, sets emitter flag 0x02 for Nuclear, and optionally returns the created emitter list through the caller array. So the 0x00474e20/0x00475010/0x00475030 emitter builders are now sitting on top of a grounded pair of particle and emitter data tables plus one concrete owner-stem-driven variant-list builder, not just anonymous global payload roots. The small shared slot utilities under those builders are tighter now too: 0x00474fe0 is the shared per-slot flag broadcast into [emitter+0xbc]; 0x00475010 caches one shared anchor triplet into globals 0x006cea68/0x006cea6c/0x006cea70, 0x00475030 republishes that cached triplet into either all emitters in one slot container or one selected emitter index at [emitter+0x1b0..+0x1b8], 0x00475240 toggles the per-emitter enable byte [emitter+0x1d8] for either all or one selected emitter, and 0x004752b0 is the paired boolean query that reports true only when that same byte is zero. The update side is explicit too: 0x00474f70 runs 0x00555e50(0) across either one supplied slot container or every slot in the global linked list rooted at 0x006cea74. The release side is explicit too: 0x00475100 tears emitter slots down, optionally unlinks them from the global active list 0x006cea74/0x006cea78/0x006cea7c, and then either recycles or frees the slot depending on whether it falls inside the pooled descriptor rooted at 0x006cea58. Two named bundle builders are grounded now too: 0x004752d0 builds the three-emitter BrokenDown_Steam + FlamespoutB + Crash_SmokeA bundle, while 0x00475550 builds the two-emitter BrokenDown_Steam + BrokenDown_Smoke bundle. The next owner layer above those helpers is grounded now too. 0x00474ce0 is the global particle/emitter bootstrap: it reloads emitters.dat, reloads particles.dat, publishes the mode-1 ratio labels through 0x00474690, lazily allocates pooled slot root 0x006cea58, allocates backing slab 0x006cea54, seeds that slab into the pooled descriptor through 0x0053dcf0(0x38, 0x2710, 1), clears the global linked-slot heads and shared anchor globals, rebuilds the flagged templates through 0x00474c60, and finally publishes enable-state 1 through owner 0x006d4030. 0x00474db0 is the teardown-side companion that frees 0x006cea54, 0x006cea5c, 0x006cea60, and then resets and frees the pooled slot root 0x006cea58. That makes the effect-slot builders a real subsystem rooted at 0x006cea54..0x006cea98, not just a loose string-and-handle utility strip. The named bundle surface is broader now too: 0x00475420 selects one Volcano_BlackSmoke* + Volcano_Lava* pair from the caller float tier 0.5/0.75/1.0/1.5/2.0 and builds the two-emitter volcano bundle; 0x00475650 builds the three-emitter ServiceTower_Water2 + ServiceTower_Water + ServiceTower_Water3 water bundle from the paired ServiceTower_Anim2#water.3dp, ServiceTower_Anim3#water.3dp, and ServiceTower_Anim4#water.3dp definitions; 0x004757b0 builds the three-emitter Rocket_Flame + Rocket_Smoke + Rocket_Sparkle fireworks bundle from the paired Fireworks_Anim2/3/4#water.3dp definitions; 0x00475910 is the adjacent randomized one-emitter fireworks builder that rotates among Fireworks1/2/3, uses Fireworks_Anim5#water.3dp, and writes fixed dword 0x3c into [emitter+0xbc]; 0x004759f0 and 0x00475b30 build the one-emitter CargoMoney_DollarSign and SpendMoney_DollarSign bundles; 0x00475a90 builds the one-emitter SelectObject bundle; 0x00475bd0 builds the five-emitter directional construction bundle from Construct_Pos, Construct_Left, Construct_Right, Construct_Back, and Construct_Forward; 0x00475dc0 selects between one-emitter Mist and MistSmall; and 0x00475e30 builds the one-emitter Vent bundle. The next local owner above that catalog is grounded too: 0x00475ed0 is the selector-driven named-bundle dispatcher that chooses one of those builders from the caller selector, mirrors the first emitter's attachment token into [slot+0x04], stores caller mode into [slot+0x34], and when that mode equals 1 links the finished slot into the global active list 0x006cea74/0x006cea78/0x006cea7c. So that specialization-side transient path now has a much broader data-backed effect catalog and a concrete selector-driven bundle owner above it, not just the earlier broken-down bundles. One adjacent train-side effect strip is bounded now too, and it should stay separate from the concrete placed-structure specialization family. 0x0045d130 resolves one owner profile through 0x006ada84, allocates a 0x141-byte handle, initializes it through 0x00554830 using one mode-selected train sound stem from the tiny selector at 0x0045d22e, applies two fixed parameter writes through 0x00554340 and 0x00554450, stores the result at [this+0x336], and registers it through 0x0052da00. 0x0045d260 is the paired live-handle updater: it clamps one caller-scaled rate into 0x1f40..0xac44, forwards that through 0x005542c0, pushes the caller gain through 0x00554450, and when the current handle mode at [handle+0x138] equals 1 also forwards zero through 0x005543f0. The broader owner above both helpers is 0x0045d2e0: it republishes the current world anchor through 0x0052e720, updates an existing live sound handle at [this+0x346] when one exists, or otherwise selects one new sound stem from fixed Train_Burning.wav, fixed Train_Breakdown_loop.wav, or one dynamic table-driven name after the 0x0041b8f0 -> 0x004a8840 branch, then creates the fresh sound handle through 0x00531e50, stores it at [this+0x346], sets fixed flag bits 0x18, seeds two scale fields from the chosen mode factor, and clears the three train-state latches [this+0x33a/+0x33e/+0x342] again. So the neighboring 0x0045d130/0x0045d260/0x0045d2e0 family is now bounded as a train breakdown-or-burning sound/effect handle strip rather than more placed-structure emitter state. The larger owner above that train-side strip is bounded now too. 0x0045d4b0 optionally clears prior state through 0x00455610, copies the caller primary and secondary stems into [this+0x32e] and [this+0x332], probes the named-bank owner 0x006d4020 for the secondary stem, then falls back through the primary stem and the suffixed _C.tga form. It resolves one ServicePoint.3dp payload into [this+0x23e/+0x23a], one Body.3dp payload into [this+0x242/+0x246], counts existing %1_Truck%2.3dp variants into [this+0x31a], allocates the larger per-variant table at [this+0x316], and then enters the later subloops that fill the cargo-icon, bogie, drivewheel, piston, connecting-rod, coupling-bar, body, and track-point bands. That keeps the 0x0045d130/0x0045d260/0x0045d2e0 sound helpers nested under a broader train visual/profile preload owner rather than floating as an isolated sound-only strip. The release and load sides of that same train family are bounded now too. 0x0045e390 drops the optional sound handle [this+0x346] through 0x00531ef0 plus the mode-gated 0x005317b0 path, clears the live train-effect handle root [this+0x336] by re-entering 0x0045cc90(0) and 0x0045cf40(0), iterates the variant table at [this+0x316] to free per-row pointer arrays, two heap buffers, and any nested owned list rooted at [row+0x0c]->[+0x75], then frees the main table and the two payload strings [this+0x32e] and [this+0x332]. 0x0045e530 is the load-side owner: it opens tags 0x61a9 and 0x61aa, reads two heap strings, optionally rewrites the first string by scanning the live collection at [0x006d4020+0x429b8], rebuilds the train visual family through 0x0045d4b0 with unit scale, republishes the early per-row handles through 0x005548d0, and under scenario latch [0x006cec78+0x46c34] > 0x2585 also enters the optional child-record branch under tag 0x61b2 before closing 0x61ab. That makes the train-side strip a real payload-owned family with explicit preload, service, load, and teardown phases rather than a one-off visual helper. Two shared selector-slot toggles under that same family are bounded now too. 0x0045cc90 owns the three selector-driven effect slots at [table+0x34], [table+0x38], and [table+0x3c]: in build mode it allocates selectors 1, 2, and 3 through 0x00475ed0, reseeds their shared anchors through 0x00475010/0x00475030, and then enables every live emitter in the main row-object list by writing byte 1 into [emitter+0x1d8]; in release mode it tears those same three slots down through 0x00475100, clears the table fields again, and disables the same emitter list by writing byte 0. 0x0045cf40 is the same pattern for selector 5 into [table+0x40]. So the train visual family now has one explicit selector-slot toggle layer above the named 0x00475ed0 bundle catalog, rather than touching those effect slots only through the broader load and teardown owners. One smaller service leaf under that same family is grounded now too. 0x0045e8c0 walks the fixed 32-entry row-object strip rooted at [this+0x277] and dispatches vtable slot +0x10 on every live row object. When the caller supplies a valid selected row index instead of -1, it re-enters that selected row through vtable slot +0x0c, and when the paired per-row flag byte in the neighboring strip is nonzero it also pushes 0,0,1.0f,1.0f through 0x0052eab0 on that selected row object. The current grounded callers at 0x0041c680 and 0x0041c69a derive the selected row from byte [cargo+0x20], so this is best read as the row-object service plus selected-entry refresh leaf under the train visual family, not a generic object-list sweep. One adjacent helper block is tighter now too, and it should stay separate from the concrete 0x005c8c50 vtable rather than being folded into it. The small predicates 0x0040cc40/0x0040cc60/0x0040cc80 all follow the same [this+0x173] -> 0x0062b268 chain into one linked candidate/profile record. 0x0040cc40 returns whether candidate subtype byte [candidate+0x32] equals 1, 0x0040cc60 returns raw candidate byte [candidate+0xba], and 0x0040cc80 returns the stricter conjunction subtype == 1 && class == 3 using class byte [candidate+0x8c]. The current grounded caller for all three is world_grid_refresh_projected_rect_sample_band_and_flag_mask 0x00418610, where they derive the two boolean mode inputs for 0x00415020; that makes them a shared candidate-profile helper cluster adjacent to the specialization family, not direct overrides in the 0x005c8c50 table. The neighboring 0x0040ccf0 stays on the same “adjacent but not the same vtable” side of the boundary: it resolves one linked instance through 0x0047de00, follows that instance's vtable +0x80 owner chain, and returns candidate class byte [candidate+0x8c]. Current grounded callers at 0x00480fb5 and 0x004b03ce compare that returned class against 3 and 4, so the current safest note is simply “linked-instance candidate-class reader.” One gated collection-side scan in the same neighborhood is bounded now too. 0x0040cd10 first requires shell latch [0x006cec74+0x1c3] and creation-mode byte [this+0x3d4] == 1, then resolves the current subject's center world-grid cell through 0x00455f60, reads the local site roster count and id list at [cell+0xeb] and [cell+0xef], and resolves each listed placed-structure id through 0x006cec20. Its current grounded caller is the broader collection sweep at 0x00413860, so the strongest current read is a gated center-cell site-roster scan rather than one more direct specialization override. One small neighboring world-grid helper is grounded cleanly enough to keep too. 0x0040ccd0 takes one live world root, one X-like index, and one Y-like index, multiplies the Y-like term by world width [world+0x2145], adds the X-like term, scales the resulting slot by fixed cell stride 0x1d7, and returns the corresponding cell pointer under base [world+0x2129]. Current grounded callers include the placed-structure cargo-service bitset sweep around 0x0042c386 and several world-grid overlay passes in the 0x004525bc..0x00452bb2 range, so that helper is now best read as the shared (x,y) -> world-cell* resolver rather than another object-specific method. The next sibling table at 0x005c9750 is tighter now too, though still not fully decoded. The structural anchor is city_database_entry_collection_refresh_records_from_tagged_bundle 0x00474540: that load-side owner stages bundle tags 0x61a9..0x61ab, iterates one collection, and dispatches each entry through vtable slot +0x40. In 0x005c9750, that same slot resolves into the sibling record family beside 0x0041ab70/0x0041ab80, which is enough to treat the table as the city-database entry family rather than a generic unresolved runtime object. The small load-side slot 0x0041ab70 simply jumps into 0x0045c6f0, which restores two strings into [this+0x32e] and [this+0x332], stages the same 0x61a9/0x61aa/0x61ab tag family, and iterates the child runtime band rooted at [this+0x316]. The one real behavioral slot we recovered there is 0x0041ab80: it refreshes one named handle through owner 0x006d4020, writes the resulting handle into [this+0x1c], queries three base floats through 0x0045c480, and returns one scaled float derived from the first queried component. That method is currently called from later world-side branches at 0x0046e4f7, 0x004aafee, and 0x004ab020. The exact user-facing semantic of the handle still is not grounded, but the leftover rows in the same table are now bounded as low-value constant-return stubs rather than a meaningful unresolved behavior seam. The family boundary is therefore no longer arbitrary: this is now the current city-database entry vtable cluster, not another placed-structure specialization. One correction matters here too: the lower 0x00455660/0x00455800/0x00455810/0x00455930 helpers are no longer city-only. Local .rdata now shows the same shared slots under both the city-entry table 0x005c9750 and the sibling Infrastructure table 0x005cfd00, whose constructors at 0x0048a240/0x0048a2dc/0x00490a3c all re-enter 0x00455b20, install 0x005cfd00, and seed the same scalar-band family through 0x00455b70 with the literal stem Infrastructure. So the safest current family name for those low helpers is the broader 0x23a runtime-object band rather than city-entry-only. 0x00455800 and 0x00455810 are simply the paired normalized coordinate getters over [this+0x1e2] and [this+0x1ea], which explains why they recur all over the city-side, route-link, and placed-structure placement code. The narrower helper 0x00455660 sits above those getters: it scales the caller-supplied normalized coordinate pair, converts it through 0x006d4024 -> 0x0051f090 -> 0x00534490, adds a caller-supplied integer height bias, optionally rounds that height through 0x005a10d0 when the auxiliary-preview gate 0x00434050 is active, and finally publishes the resulting world-anchor triplet through 0x00530720. One serializer-side sibling is bounded too. 0x00455930 queries two triplet-like scalar bands through 0x0052e720 and 0x0052e880 and writes the resulting six dwords through 0x00531030; its load-side stream counterpart 0x00455870 reads the same six four-byte lanes back through 0x00531150, republishes the first triplet through 0x00530720, republishes the second through 0x0052e8b0, and returns the summed byte count. The neighboring tagged string-triplet serializer 0x004559d0 is now no longer reversed either: it writes bracket tags 0x55f1/0x55f2/0x55f3 through 0x00531340, emits the three string lanes [this+0x206/+0x20a/+0x20e] through 0x00531410, dispatches vtable slot +0x4c, then re-enters 0x0052ec50 before the closing tag.

Shared Runtime-Object and Support Families

The low helper strip beneath that shared family is tighter now too: 0x0052ecd0 is the common local-state reset that clears the list and handle roots, resets the string/scalar side bands, preserves only selected low bits of [this+0x20], and reseeds the recurring default 1.0f lanes; 0x0052ebd0/0x0052ec50 are the load/save companions for the two flag bits stored in that same byte; 0x0052eb90 releases every entry hanging from list root [this+0x79] through 0x00554d50; and 0x0052eca0 is the grouped-table cursor over [this+0x14], [this+0x21], and [this+0x3a] that returns the next 0x45-byte subrecord in the current group when one exists. The next shared initializer 0x0052edf0 then binds caller pointer [this+0x04], resolves optional handles into [this+0x10] and [this+0x1c], copies one anchor triplet into [this+0x1e2/+0x1e6/+0x1ea], sets bit 0x08, and seeds packed color [this+0x43] = 0x007f7f7f; its release-side siblings 0x0052eeb0 and 0x0052ef10 clear the two owned list roots [this+0x79] and [this+0x7d] through distinct per-entry destructors before freeing the list roots themselves. The broader release body 0x0052ef70 sits above that strip: it clears the active shell preview-owner latch when it still points at this, drops the dependent handle at [this+0x0c], recursively tears down the nested object list [this+0x75], clears sibling owned list [this+0x81], detaches any world binding rooted at [this+0x04/+0x08], and finally frees the optional handles at [this+0x10] and [this+0x1c]. The next shared dirty-bit helper 0x0052f120 is now bounded too: when byte [this+0x20] still carries bit 0x02, it rebuilds the cached 16-dword transform-style block at [this+0x14e] from scale [this+0x36], anchor triplet [this+0x1e2/+0x1e6/+0x1ea], and either the live local vector lanes [this+0x4b/+0x4f/+0x53] or the stored fallback block at [this+0x18e], then flips the dirty bit over to the cached-ready bit 0x04. The next two adjacent helpers are bounded too: 0x0052f1e0 is a pure five-vec3 boolean geometry predicate built from signed-volume or separating-plane style tests, and 0x0052f370 is the quantized selector that rounds world coordinates, folds them through table 0x006d9098, samples one grouped metric through owner [this+0x04], updates byte [this+0x5c], and then chooses the active 0x45-byte subrecord by storing index [this+0x21] and pointer [this+0x18]. The adjacent emission owner 0x0052f500 is tighter now too: it starts from that selected grouped subrecord, snapshots the global packet write pointer and remaining count at 0x00cc3b64/0x00cc3b5c, optionally refreshes the cached transform block and applies the five-vec3 predicate when state bit 0x01 is active, and then hands off to the concrete emitters 0x0052dd00 and 0x0052e060. Those two helpers are no longer best read as shell-only batch expanders. 0x0052dd00 emits the materialized group packet rows as one 0x20-byte segment-record window for the layout-state presentation owner 0x005490b0, while 0x0052e060 emits the same row family as one 0x18-byte vertex24 window for the shell-side presentation branch 0x00528821. The next shared helpers under that emission band are now bounded too: 0x0052d8a0/0x0052d950/0x0052d9a0 are the three owned-list registration helpers for child objects and copied-anchor records on [this+0x75], [this+0x79], and [this+0x7d]; 0x0052daa0 is the explicit grouped-subrecord selector; 0x0052db10 materializes the current group's packet rows after storing scalar [this+0x69]; and 0x0052dc00 then buckets those materialized rows by four float thresholds. A concrete owner above that strip is grounded now too: vehicle_visual_build_exhaust_running_gear_track_and_mantlet_attachment_children 0x004858e0 uses those same registration and grouped-row helpers while building %1_ExhaustSmoke.3dp, %1_MuzzleFlash.3dp, %1_RoadWheelL%2.3dp, %1_RoadWheelR%2.3dp, %1_IdlerWheelL.3dp, %1_IdlerWheelR.3dp, %1_DriveWheelL.3dp, %1_DriveWheelR.3dp, %1_TrackL.3dp, %1_TrackR.3dp, and %1_MantletLight1.3dp child records under the broader vehicle-visual owner 0x00485760. The next shared helpers under that emission band are now bounded too. 0x0052fb70 is the packed-color propagation helper over [this+0x43/+0x47]: when shell gate [0x006d4024+0x114742] is live it combines stored high-byte state with either dim RGB 0x003c3c3c or full-bright RGB 0x00ffffff, pushes the same dim-or-bright triplet into the child list [this+0x75] through 0x0052e680, and optionally recurses that update over the whole child tree; when the shell gate is absent it instead stores the raw byte into [this+0x47] and only recurses that byte state. 0x0052fd60 then republishes current anchor triplet [this+0x1e2/+0x1e6/+0x1ea] into every attached entry hanging from list root [this+0x81] through 0x005545d0. The heavier relocation sibling 0x0052fdc0 marks the object dirty, adds a caller-supplied triplet delta to the same anchor, quantizes old and new X/Z lanes against the live world grid, rebinds world handle [this+0x08] through 0x00533c20/0x00533bf0 when the quantized cell changes, and on success re-enters 0x0052fd60; out-of-bounds moves restore the prior anchor and fail. One more adjacent rotation-side helper is now bounded too: 0x0052ffb0 converts the current local 4-dword orientation block at [this+0x1ce..+0x1da] into a temporary axis-angle representation, scales the recovered angle by the caller float, and rebuilds the stored orientation block by re-entering 0x0052e9f0. The immediate anchor-publish sibling 0x00530720 is now explicit too: it is the absolute-triplet form of the same relocation family, storing one caller-supplied anchor directly into [this+0x1e2/+0x1e6/+0x1ea], optionally rebinding world handle [this+0x08] when the quantized X/Z cell changes, and then re-entering 0x0052fd60. The adjacent packet-side query 0x00530030 is bounded as well: it starts from the currently selected grouped 0x45-byte subrecord, snapshots the same global packet source span as 0x0052f500, lazily refreshes cached basis lanes when needed, transforms one caller-supplied input triplet through that basis, and then walks the remaining packet span until 0x0052f1e0 reports one overlap or the span is exhausted. One sibling-table strip is now explicit too. Table 0x005dd1f0 has the tiny wrappers 0x00530640, 0x00530670, and 0x00530680 as its shared seeded-constructor, reset, and release thunks over 0x0052edf0, 0x0052ecd0, and 0x0052ef70, while 0x005305c0 is the small list-bit propagator that sets or clears bit 0 in [entry+0xb0] across owned list [this+0x79]. The first heavier body under that same table is now bounded too: 0x00530690 copies one pair of 16-dword cached blocks from a source object into [this+0x10e] and [this+0xce], refreshes local cached transform [this+0x14e], and recurses the same copy into child list [this+0x75]. The Infrastructure side is tighter now too. The optional child The next adjacent field-accessor strip is explicit too: 0x00533100/0x00533120 are the indexed float set/get helpers for [this+0x14e4 + index*4]; 0x00533130/40, 0x00533150/60, 0x00533170/80, and 0x00533190/a0 are four direct dword set/get pairs over [this+0x1534], [this+0x1540], [this+0x153c], and [this+0x1544]; 0x005331b0/c0 are the float set/get pair for [this+0x14e0]; and 0x005331d0 is the direct getter for [this+0x1548]. The important caller-side grounding is narrow but real: 0x0052f370 samples one indexed float through 0x00533120 while choosing the active grouped subrecord, and shell_emit_ranked_overlay_cell_items 0x00524780 reads the current threshold pair through 0x00533160 and 0x00533180. So this strip is now bounded as a genuine shared field-accessor family under the same runtime-object owner, even though the exact high-level meanings of those fields remain open. attach helper 0x0048a1e0 allocates and seeds one fresh Infrastructure child and, when the owner already has more than one child, clones the first child's two triplet bands into that new child before attaching it. The looped rebuild 0x0048dd50 then rebuilds the owner-visible Infrastructure children one ordinal at a time, tears down the higher extras above ordinal 5, refreshes cached primary-child slot [this+0x248] when needed, and finishes with the same world-cell and route-side follow-on family around 0x00448a70, 0x00493660, and 0x0048b660. The outer owner above that loop is bounded now too: 0x0048dcf0 reads a child count plus one optional primary-child ordinal from the tagged stream through 0x00531150, zeroes [this+0x08], dispatches each fresh child through 0x00455a50 -> vtable slot +0x40, culls ordinals above 5, and restores cached primary-child slot [this+0x248] from the saved ordinal. So the rebuild strip is consuming an already-materialized child stream rather than parsing the compact side buffer directly. The upstream handoff is explicit now too: 0x00493be0 is the tagged collection load owner over 0x38a5/0x38a6/0x38a7, and it feeds each live infrastructure record straight into 0x0048dcf0 after restoring one shared owner-local dword into the 0x90/0x94 lane. That means the 0x38a5 side-buffer seam is now a proven direct upstream feed into the child-stream restore owner rather than only a candidate cache or serializer-side neighbor. The collection helpers above that handoff are bounded now too: 0x00518140 resolves a non-direct live entry through the tombstone bitset and returns the first dword of a 12-byte row from [collection+0x3c], while 0x00518680 loads the non-direct collection header, tombstone bitset, and live-id-bound-scaled 12-byte tables before 0x00493be0 starts iterating. So the remaining infrastructure mapping problem is no longer “which generic collection helper is involved?” but how those helpers compose in the actual load loop: 0x00493be0 now reads as an ordinal-to-live-id-to-payload-pointer walk through 0x00518380(ordinal, 0) then 0x00518140(live_id). That narrows the remaining infrastructure mapping problem further: the first dword of each 12-byte live-entry row is already spoken for as the per-entry payload pointer, and 0x005181f0/0x00518260 now also read as the live-entry unlink/link owners that use the same rows as (payload pointer, previous live id, next live id) directory triplets. So the next unknowns are no longer inside that row layout itself; they are in the payload streams those rows point at, and how those streams align with the save-side 0x55f1 name-pair groups and compact prefix regimes. The shared child payload callback is tighter now too: 0x00455fc0 zeroes the route-entry and cached bridge bands, opens 0x55f1, parses three len-prefixed strings through 0x00531380, opens 0x55f2, seeds the child through 0x00455b70, dispatches slot +0x48, runs the local follow-on 0x0052ebd0, and then opens 0x55f3. The widened save-side probe currently still sees only two embedded 0x55f1 strings on grounded q.gms, but 0x00455b70 now makes that result much less mysterious: it stores the three payload strings into [this+0x206/+0x20a/+0x20e], defaulting the second lane through a fixed literal when absent and defaulting the third lane back to the first string when absent. So the remaining payload question is no longer “where is the third string hiding?”; it is how the current dual-name save-side rows align with the full payload-stream grouping and the later tagged value roles. That trailing-value strip is tighter now too: direct disassembly of the post-+0x48 helper pair 0x0052ebd0/0x0052ec50 shows two serialized single-byte lanes folded into bits 0x20 and 0x40 of [this+0x20]. Grounded q.gms side-buffer probes now show that all embedded rows sit inside complete 0x55f1 -> 0x55f2 -> 0x55f3 envelopes, every embedded 0x55f2 chunk is the fixed 0x1a bytes that 0x00455870 expects, and the dominant short trailing 0x55f3 span is the 0x06-byte form with flag pair 0x00/0x00 across 72 rows. So the next remaining infrastructure question is no longer whether a short trailing lane exists; it is how those compact-prefix regimes and short flag-byte pairs feed the child-count / primary-child restore state above 0x0048dcf0. The fixed policy lane is tighter now too: direct disassembly of 0x00455870/0x00455930 shows the +0x48/+0x4c strip loading and serializing six u32 lanes from the fixed 0x55f2 chunk, forwarding them through 0x00530720 and 0x0052e8b0. Grounded q.gms save-side probes now show every embedded 0x55f2 row using the same trailing word 0x0101 while the six dword lanes vary by asset row. So the remaining infrastructure question is no longer whether 0x55f2 is a fixed-format child lane; it is which of those two dword triplets correspond to the later child-count / primary-child restore state and which only seed published anchor or position bands. That split is now explicit too: direct disassembly of 0x00530720/0x0052e8b0 shows the first restored triplet landing in [this+0x1e2/+0x1e6/+0x1ea] while the second lands in [this+0x4b/+0x4f/+0x53], with the companion setter forcing bit 0x02. So the remaining infrastructure question is no longer whether the fixed 0x55f2 row hides the child count or saved primary-child ordinal at all. Those values now have to live outside the fixed row, most likely in the surrounding payload-stream header or compact-prefix regime above 0x0048dcf0. The child loader family is explicit now too: local .rdata at 0x005cfd00 proves the Infrastructure child vtable uses the shared tagged callback strip directly, with +0x40 = 0x00455fc0, +0x48 = 0x00455870, and +0x4c = 0x00455930. So the remaining infrastructure problem is row-to-record mapping inside the 0x38a5 stream, not identifying the per-child loader family. The smaller attach helper 0x00490a3c is now bounded too: it conditionally allocates one Infrastructure child from a caller-supplied payload stem, attaches it to the current owner, and then seeds three caller-supplied position lanes through 0x00539530 and 0x0053a5b0. The direct disassembly now makes that strip more concrete than the earlier structural note alone: 0x0048a1e0 really does clone the first child through paired triplet readers 0x0052e880/0x0052e720, destroys the prior child through vtable slot +0x18(0), allocates the new 0x23a object, seeds it through 0x00455b70 with literal payload seed 0x005c87a8, and then republishes the two sampled triplet bands through 0x0052e8b0 and 0x00530720 after attaching through 0x005395d0. The non-clone branch still seeds the same literal Infrastructure child but attaches through 0x0053a5d0 instead. That means the next unknown is no longer whether this strip owns the child/rebuild seam at all, but which exact 0x38a5 rows or compact-prefix regimes map to the child count, saved primary-child ordinal, and per-child +0x40 payload callbacks inside that direct load path, and which restored child fields still retain those embedded name-pair semantics before the later route/local-runtime family runs. The remaining closure target above the grounded 0x38a5 side-buffer seam is therefore narrower now: the next safe static pass should start at this exact attach/rebuild strip, not at the whole placed-structure family. The key open questions are whether the compact-prefix/name-pair groups feed the first-child triplet clone lane, the caller-supplied payload-stem lane, or only the later route/local-runtime follow-on family; whether cached primary-child slot [this+0x248] becomes the first owner-visible bridge between those side-buffer groups and route-entry rebuild; and which child fields or grouped rows absorb the side-buffer payload before 0x00448a70/0x00493660/0x0048b660 become relevant. That keeps the top-ranked next mapping target explicit as 0x0048a1e0, 0x0048dd50, and 0x00490a3c, with the serializer/load companions and route/local-runtime follow-ons staying secondary until one concrete child-consumer bridge is grounded. The direct route-entry side of the same family is no longer anonymous either: 0x0048e140, 0x0048e160, and 0x0048e180 are the three direct resolvers over owner fields [this+0x206/+0x20a/+0x20e] into the live route-entry collection 0x006cfca8. Another shared sibling family is tight enough now too: the real packed-byte-triplet owner is 0x0052e680, and the two local wrappers 0x00455820 and 0x00455840 both force its recursion flag on. 0x00455820 forwards three explicit byte arguments, while 0x00455840 unpacks one packed u24-style dword into three byte lanes first. The downstream setter writes packed byte-triplet lane [this+0x43], defaults that lane to 0x007f7f7f when all three bytes are zero, and when recursion is enabled it walks child list [this+0x75] through 0x00556ef0/0x00556f00 and re-applies the same packed update recursively to every child. The shared formatter thunk 0x00455860 is no longer a blind jump target either: 0x00530820 now reads as the common group-selection status-label formatter over the same 0x23a family. It only answers when shell gate [0x006d4024+0x1146be] is live, state bit 0x10 is clear, vtable slot +0x14 says the current object should answer, and the owned-entry bit propagator 0x005305c0 succeeds. Under that gate it formats one caller-owned text buffer from either a fixed fallback block, a simple mode-1 X or index form, or a grouped-table form built from the current 0x45-byte subrecord's float lane plus current index [this+0x21]. The sibling Infrastructure table 0x005cfd00 also still carries three tiny fixed-return slots after that shared formatter path: two return literal 0x46, and one returns fixed float 1.25f, so those slots are now bounded as small table constants rather than as missing behavior. One nearby global helper family is bounded enough too: 0x005309d0 lazily clears and arms the indexed table rooted at 0x00ccb880, 0x00530a00 services or releases one slot in that table according to its local state dword, 0x00530b70/0x00530b90/0x00530c10 query one slot's primary handle metric, primary handle, and payload-length lanes, and 0x00530ba0 performs the release-side cleanup for one slot's owned buffers. Current callers are broad enough that the table's exact resource type still stays open, but the init/service/query/cleanup split is now grounded. The broader bundle or stream slot layer under that same table is bounded now too: 0x00530c80 is the common open-or-reuse entry for named slots, 0x00531030 and 0x00531150 are the shared write and read byte pumps, 0x00531340 and 0x00531360 are the four-byte tagged-header wrappers used all over map, setup, world, and runtime bundle code, and 0x00531380/0x00531410 are the shared variable-length heap-string load/save helpers built on top of those byte pumps. The immediate neighbors are bounded too: 0x00531490 writes one raw NUL-terminated string without the length prefix, 0x005314b0 is a callback-driven selector over global 0x00ccba08, and 0x00531500 is the small override-active gate for the neighboring audio owner family: it only returns true when [this+0x04] == 1 and global 0x00ccb9f4 is nonzero. That gate is no longer owner-unknown either, because 0x00531a10 raises it before the shutdown or fade loop and clears it again on exit, while most of the adjacent wrappers require the inverse state 0x00ccb9f4 == 0. The next adjacent strip is now bounded as one audio-service gate strip rather than anonymous wrappers: 0x00531520..0x005317b0 mostly share the inverse gate [this+0x04] == 1 && 0x00ccb9f4 == 0, then forward into one of three global owners 0x00ccba00, 0x00ccb9f8, or 0x00ccb9fc. The clearest member of that strip is still 0x005315c0, a plain 3x4 affine point transform over three caller-supplied float pointers, but the adjacent wrappers are tighter now too: 0x00531520 now clearly gates the primary owner 0x00ccba00 through status-code predicates 0x00557c90/0x00557cb0 and then clears the current handle through 0x00557cd0, which unregisters it from global slot table 0x00d973b8 and optionally notifies callback 0x00d973e0; 0x00531620 queries the current selected Miles 3D provider-name pointer or fixed fallback pointer 0x00ccba0c; 0x00531640/0x005316d0 query the selected Miles 3D provider index and preferred-flag by callback-selected provider name; 0x00531710/0x00531730 forward listener position and orientation into the Miles 3D service; 0x00531750/0x00531770 set and query the active Miles 3D speaker type; 0x00531790 forwards keyed non-3D sample-volume refresh; and 0x005317b0 selects keyed sample-record release across the non-3D and Miles 3D owners. The next adjacent owner strip is bounded enough now too: 0x00531800/0x00531840 are the null-0x00ccb9f4 guarded wrappers that mark pending flag 0x100 on keyed non-3D and Miles 3D sample records through 0x0056ae80(0x00ccb9f8) and 0x00569cf0(0x00ccb9fc) with scoped reentrancy counter 0x00ccb9f0; 0x00531880 releases optional handle [this+0x4c] through two function-pointer calls when global 0x00624d58 == 1; 0x005318b0 spin-waits for that same reentrancy counter to drain; 0x005318c0 picks between owners 0x00ccb9f8 and 0x00ccb9fc from global selector 0x00ccba04; and 0x005318f0 is the shared constructor that allocates and initializes globals 0x00ccb9f8, 0x00ccb9fc, and 0x00ccba00, then arms mode flag [this+0x04] = 1 when all three are live. The next owner block is no longer just a loose cluster either: 0x00531a10 is the full teardown path for that same family, first raising 0x00ccb9f4, optionally fading scalar lanes [0x00ccba00+0x104] and [0x00ccb9fc+0x58] through 0x00557d90/0x00569ae0/0x00569ca0 plus a 0x10-tick sleep, then spin-waiting on 0x005318b0, releasing optional handle [this+0x4c], shutting the three globals down, and clearing [this+0x04] again. 0x00531c00 is the symmetric rebuild side: it force-calls 0x00531a10(this,1), reconstructs the family through 0x005318f0, and seeds the default live state through 0x005696b0, 0x00569660, 0x00557d90, 0x0056a8e0, and 0x00569ae0 from shell-owned scalars. The smaller strip between them is bounded structurally too: 0x00531d30 refreshes the primary scalar and dispatches 0x00557e50; 0x00531dc0 is the dual-scalar idle predicate over [0x00ccb9f8+0x20] and [0x00ccb9fc+0x58]; 0x00531e50 is the string-driven sibling of 0x00531e10, tail-jumping into 0x0056a520 when the same family is ready; 0x00531e90 stages one 16-dword local payload block into [this+0x08..+0x44] and forces [0x00ccb9fc+0x60] = 2; 0x00531ed0 and 0x00531ef0 are the small active-mode field and selected-hash-root queries; 0x00531f40 services 0x00ccb9f8/0x00ccb9fc and clears staged flag [this+0x48]; 0x00531f90 registers one of the guarded callbacks 0x00531800/0x00531840; and 0x00531fd0 is the timed primary-scalar transition service that coordinates 0x00ccba00 with globals 0x00624d58/0x00624d60 under the same reentrancy counter 0x00ccb9f0. The local controller layer above that family is bounded now too: 0x00532150/0x00532200 are the construct/destruct pair for the controller object itself, 0x00532230 rebuilds from one callback-selected entry through 0x005314b0 -> 0x00531c00, and 0x00532260 rebinds primary handle [this+0x4c] while registering transition callback 0x00531fd0 and seeding selector [this+0x50]. The subordinate Miles 3D provider strip under those owners is now grounded too: 0x00569400 enumerates providers into the global 0x00d97bc0 table and marks only the names Miles, Dolby, and RAD as preferred, 0x005694f0 resolves one enumerated entry by name, 0x00569380 opens the selected provider, caches room-type capability in 0x00625c7c, tests speaker-type support, and seeds fixed distance factor 0x3e806d98, 0x00569540/0x005695d0 are the setter/getter for global speaker-type selection 0x00625c78, 0x00569660 and 0x005696b0 lazily open the listener and push the live position/orientation basis through _AIL_set_3D_position and _AIL_set_3D_orientation, 0x00569720/0x00569730 expose the selected provider's name pointer and preferred-flag field, 0x00569830 tries the fixed fallback order Creative Labs EAX (TM), DirectSound3D 7+ Software - Pan and Volume, Miles Fast 2D Positional Audio, then Miles, and 0x005698a0 is the broader bootstrap owner that enumerates, binds the requested or fallback provider, and allocates the local provider-side state tables only when a live Miles 3D provider actually comes up. The next local seam is grounded too: 0x00569990 allocates the current-provider 3D sample-handle pool, building the free-pool hash at [this+0x04], the active-list owner at [this+0x08], and one 0x5c-byte record slab for up to 0x20 sample handles; 0x00569750 pops the oldest live sample record from the active list and refreshes global serial 0x00625c80; 0x005697d0 returns tracked sample handles to the free pool or releases untracked ones directly; 0x00569d20 tears the local free-pool and active-list tables down; and 0x00569d90 is the broader shutdown side that drains the live sample state, closes the listener, releases the pool tables, restores the room-based speaker type when needed, and finally closes the provider. The last clean local edge in that sample branch is 0x00569ea0, which explicitly drains every tracked sample handle through _AIL_release_3D_sample_handle and then clears the pool count and table fields. The next broader service layer is now bounded too: 0x00569f30 is the sample-command dispatcher over request types 0..8, combining the local record helpers with the Miles sample controls for volume, stop/resume, position, distances, effects level, occlusion, playback rate, and the orientation-side call at 0x001c83f8; 0x0056a330 is the acquire-or-evict owner that either recycles one free sample record or reclaims a lower-priority live one; 0x0056a520 is the configure-and-optionally-start owner that binds the file payload, loop count, world position, range scalars, callback, and initial playback state; and 0x0056a6e0 is the clean constructor that seeds the sample-service object defaults before the later destructor-side tail at 0x0056a740+. The adjacent non-3D Miles sibling is now bounded too: 0x0056a770 opens the digital driver and seeds the keyed owner table, 0x0056a7c0 allocates the non-3D sample-handle pool and record tables, 0x0056a880 resets the active-sample registry, 0x0056a8e0 updates the non-3D master scalar and refreshes active samples, 0x0056a970 is the non-3D sample-record dispatcher over release, volume, stop/resume, pan, playback-rate, and deferred-start paths, 0x0056abe0 is the small pool acquire helper with optional payload attach, 0x0056ad20 is the configure-and-optionally-start owner for one non-3D sample record, 0x0056acd0 is the keyed volume-level refresh helper, 0x0056ae30 dispatches selector 3 over the active registry, 0x0056ae80 marks pending flag 0x100 by key, 0x0056aeb0 closes the digital driver, and 0x0056aee0/0x0056af20 are the constructor/destructor pair for that sibling service object. One other sibling table is no longer anonymous either: local .rdata at 0x005c9a28 is the actual world-region record-family vtable root, while the smaller collection table at 0x005c9ae0 is the live region manager stored at 0x0062bae0. The same root now also resolves the restore-side virtual strip precisely: 0x0041f5c0 is slot +0x40, 0x0041f650 is slot +0x44, 0x00455870 is slot +0x48, and 0x00455930 is slot +0x4c. Constructor-side evidence is the anchor here. 0x00421660 allocates one 0x389-sized region row, resolves the new record, and forwards into 0x00421200, which seeds region id [region+0x23a], class [region+0x23e], profile collection [region+0x37f], name buffer [region+0x356], shell gate [region+0x385], and the default Marker09 stem before re-entering world_region_rebuild_profile_collection_and_seed_class_split_default_weights 0x00420ed0. The small manager-side constructor 0x00421430 is the matching 0x0062bae0 collection owner. That family split also makes the behavioral overrides read cleanly: 0x0041f680 first refreshes the current global preview/helper owner through 0x00455de0 and then forwards mode 1 plus region id or preview handle [region+0x23a] into 0x004cf830; 0x0041f720 formats [region+0x356], publishes the resulting shell text, and conditionally enters preview mode through world_switch_preview_or_tool_mode_and_seed_parameter_block 0x00452fa0 with action 0x12 when world state [0x0062c120+0x2175] is 0 or 0x15; 0x0041f7b0 publishes one fixed shell payload and only then clears that preview path through world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched 0x00453510 when the same world state is 0x12. The same table also has a tighter adjacent helper strip now: 0x0041f6a0 is the direct [region+0x37f] -> 0x00517cf0 profile-slot-count query, 0x0041f6b0 is the rounded normalized-coordinate world-scalar query above 0x0044afa0, and that deeper helper is no longer opaque: it first computes one distance-like term from the current cell to global preview-anchor fields [0x0062be68+0x24/+0x1c] through the precomputed radial helper 0x0051dc00, samples the companion float raster [world+0x1605] at the current cell plus two 8-direction rings, keeps the strongest local rise above the center sample, adds one thresholded preview-scalar bias from [0x0062be68+0x20], and then adds 0x32 more when the small global gate 0x0041fff0 passes. That gate itself now reads as a shared shell/preview threshold test: it returns true when [0x006cec74+0x2bb] == 2, or when the same mode dword is merely nonzero and preview scalar [0x0062be68+0x20] exceeds the float threshold at 0x005c9a9c. 0x0041f6e0 resolves the current center world-grid cell and checks one packed u16 token through 0x0042b2d0, and 0x0041f6f0 is the raw byte getter over [this+0x42]. One nearby mode-gated flag reader is bounded too: 0x0041f910 returns literal 1 when shell mode gate 0x004338c0 is inactive or the object class dword [this+0x23e] is nonzero, and only on the class-0 path does it return the same byte [this+0x42]. That gate itself is tighter now too: 0x004338c0 is just the normalized boolean wrapper over 0x004d4150, which returns nonzero when the shell-side owner field at 0x006d07b4 is live. The release side under that same sibling family is bounded too: 0x00420650 lazily seeds [this+0x317] from shell-profile word [0x006cec78+0x0d] before re-entering 0x00420350, and that body is now bounded as the local scalar refresh over [this+0x31b]: it compares the seeded word against the current shell-profile word, maps the delta through one bounded piecewise float curve, and applies one extra affine adjustment when [this+0x23e] is nonzero. The current split is tighter now: zero seed yields 1.0f, deltas 0..2 rise above the base through the (3-delta) branch, deltas 3..5 stay flat at 1.0f, and deltas 6+ taper back down through the scaled (delta-6) path after clamping at 0x14. 0x00420670 then frees the optional dynamic payload at [this+0x37f], clears the cached u16 link chain through 0x0041f8d0, and tails into base cleanup 0x00455d20; and the small collection-side wrapper 0x00421700 simply resolves one entry id, re-enters 0x00420670, and erases that id from the owning collection. The city-entry family also now has one tighter helper-object branch. 0x00474030 switches over mode enum 0..10, maps those cases into 0x00475ed0 with selector families 4/0xd/0xe and fixed scalar presets 0.5/0.75/1.0/1.5/2.0, and on success publishes the caller-supplied world triplet through [helper+0x4]. The refresh helper 0x00474260 first reloads payload through 0x00455fc0, then samples the current normalized coordinates plus one world-height scalar from 0x00448bd0, and rebuilds [this+0x23a] through that same mode-selected helper builder using mode [this+0x242]. The surrounding collection-side and teardown helpers are tight enough now too. 0x004743d0 and 0x00474400 are the two release siblings over the same helper field [this+0x23a]: both destroy that helper through 0x00475100 when live and clear the field, but 0x004743d0 tails into the smaller base cleanup 0x00455650, while 0x00474400 tails into the heavier dynamic-payload cleanup 0x00455d20. The small predicate 0x00474430 simply returns 1 unless shell mode gate 0x004338c0 is active, in which case it returns byte [this+0x42]; the mode-gated query itself is now bounded as one runtime enable byte on that local object family. One level higher, 0x00474450 constructs the collection rooted at vtable 0x005ce4a8 with fixed parameters (0,0,0,0x14,0x0a,0,0), and bootstrap caller 0x004487a9 stores that collection into global 0x006cea50. The collection's entry path is also bounded now: 0x004744a0 seeds a stack-local temporary entry through 0x00474110, allocates one 0x250-byte live record, resolves it, constructs it through 0x00474130, and then tears the temporary entry down through 0x004743d0; 0x00474510 resolves one entry id, releases it through 0x00474400, and removes it from the collection. The collection-owned load loop at 0x00474540 now has a direct save-side companion too: city_database_entry_collection_serialize_records_into_tagged_bundle 0x00474610 opens the same 0x61a9/0x61aa/0x61ab bracket through 0x00531340, forwards collection metadata through 0x00517d90, and dispatches each record through vtable slot +0x44. The refresh side binds the selected path context, iterates the current collection, dispatches each record through vtable slot +0x40, accumulates the returned byte counts, and tears down the temporary entry after each record. That still leaves broader semantic questions open, but the current static edges around the city-entry family are now largely exhausted. The adjacent scaffolding is bounded too. Base helper 0x00455b20 initializes the shared 0x23a-sized record family by installing base vtable 0x005cb1c0, clearing the scalar bands [+0x206/+0x20a/+0x20e/+0x22e/+0x232], zeroing the seven-dword block [+0x212..+0x22a], and re-entering 0x0052ecd0; that is why it shows up not only in the city-entry temporary constructor 0x00474110, but also in several later object construction paths outside the city family. The city collection itself now has a bounded teardown side too: 0x00474480 is the small release-and-free wrapper for the collection rooted at 0x005ce4a8, and teardown caller 0x004492c3 uses it before freeing the global collection pointer at 0x006cea50. On the save side, 0x00445713's broader package branch re-enters city_database_entry_collection_serialize_records_into_tagged_bundle 0x00474610 on that same global 0x006cea50 collection. Outside the city-specific branch, the two tiny dispatch wrappers 0x00455a40 and 0x00455a50 are also now bounded as raw vtable-slot helpers: the first jumps through entry slot +0x44, while the second pushes one caller argument into slot +0x40 and then clears the global roots 0x006acd38/0x006acd3c/0x006acd40. Finally, 0x00455a70 is now bounded as the generic current-position triplet publisher that queries 0x0052e720, converts through 0x006d4024 -> 0x0051f090 -> 0x00534490, adds a caller-supplied height bias, optionally rounds under 0x00434050, and publishes through 0x00530720. The temporary-entry constructor and live entry constructor are bounded now too. 0x00474110 is the tiny stack-local initializer: it re-enters shared base init 0x00455b20, clears helper fields [+0x23a] and [+0x242], installs vtable 0x005ce428, and returns. 0x00474130 is the real live-entry constructor: it stores the entry id into [+0x23e], clears the trailing helper payload block [+0x246..+0x24e], stores mode [+0x242], derives one world-height scalar from the supplied coordinate pair through 0x00448bd0, builds helper field [+0x23a] through 0x00474030, and then seeds the remaining default scalar or flag tuple through 0x00455b70 using the fixed defaults at 0x005ce49c/0x005ce4a0/0x005ce4a4. That broader helper is no longer city-specific either: 0x00455b70 is now bounded as the shared scalar-band initializer that clears the same [+0x206/+0x20a/+0x20e/+0x22e/+0x232] family, optionally copies up to three caller-supplied strings into [+0x206/+0x20a/+0x20e], synthesizes one default local token buffer when the middle string is absent, chooses one effective mode string from the third or first input, derives one owner handle or transform token through 0x0051f090 unless the caller suppresses that path, and then seeds the remaining scalar band through 0x0052edf0 and 0x0052e670. The same specialization also now has one tighter UI-facing side. The override trio 0x0040e4e0, 0x0040e880, and 0x0040e9d0 all sit in the same 0x005c8c50 table and reuse the linked-site-capable vtable +0x70 latch together with creation-mode byte [this+0x3d4]. 0x0040e4e0 is the strongest current owner for contextual status text: it branches across linked-peer checks, world-mode fields [0x0062c120+0x2171/+0x2175/+0x2179/+0x2181], current owner state, and candidate or linked-peer display labels, then formats localized ids such as 0x00af, 0x00b0, 0x00b1, 0x00b2, 0x00b3, and 0x0afd before pushing the result through shell presenter 0x00538c70. 0x0040e880 pairs with that publisher on the action side: it first resets the same presenter through the fixed token at 0x005c87a8, then dispatches several world-side follow-ons through 0x00413620, world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched 0x00453510, world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active 0x00452db0, and world_switch_preview_or_tool_mode_and_seed_parameter_block 0x00452fa0 under the same linked-peer and world-mode gates. 0x0040e9d0 is the narrower query-style formatter: when shell branch [0x006cec74+0x74] is live it formats one localized label with the fixed suffix \nAbsIndex %d, otherwise it can return one company-side owner label through 0x00426b10, and only then falls back to 0x00455860. So the current best read is that this concrete specialization owns both the ambient or animation transient family and one linked-peer status or action UI surface, without yet proving the user-facing subtype name. One smaller subtype hook cluster is tighter now too. The concrete table also carries 0x0040d170 and 0x0040d1b0, both of which resolve the current candidate through cached stem id [this+0x3cc] and then test candidate dword [candidate+0x4b]. When that flag is nonzero, 0x0040d170 tail-calls the primary transient builder 0x0045c310 and 0x0040d1b0 tail-calls the matching release path 0x0045c3c0. The same neighborhood now also gives direct cached-record resolvers instead of more anonymous pointer math: 0x0040d1f0 returns the linked peer from [this+0x2a8] through 0x006cec20, while 0x0040d210 returns the owner-side record from [this+0x276] through 0x0062be10. That makes the specialization-side ownership split cleaner: the 0x005c8c50 family is not only formatting labels and driving side effects, it also has a direct candidate-flag hook for building or dropping the primary transient handle. The last lower side reads are tighter now too. 0x0040e450 first seeds the projected-slot cache through placed_structure_cache_projected_rect_profile_slot_id 0x00414470 before it re-enters 0x00418a60, and the broader stem-based builder at 0x00418be0 now has one named optional side renderer instead of an anonymous callsite: placed_structure_render_local_runtime_overlay_payload_from_projected_bounds 0x00418040. The side refresh split is bounded now too. 0x0040ee10 publishes one local position or scalar triplet through the shared setter 0x00530720, then tails into placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime 0x0040e360; that smaller follow-on only runs on the current subtype-1, class-3, linked-site branch, and recomputes one local-runtime triplet from the linked peer's route-entry anchor when that anchor is still live. The heavier sibling above that side refresh is bounded now too: placed_structure_set_world_coords_and_refresh_local_runtime_side_state 0x0040eba0 is the world-coordinate mutation helper that recomputes [site+0x388] and [site+0x38c], rewrites the world-grid owner mapping through 0x0042c9f0 and 0x0042c9a0, updates the subtype-4 proximity-bucket family when needed, rebuilds the same local position or scalar triplet, and then tails into the linked-site anchor follow-on at 0x0040e360. One later caller into that same side-refresh family is bounded now too: 0x00419110 clamps a caller rectangle to the live world bounds, resolves one per-cell bucket chain through the hashed map at [arg0+0x88] and 0x0053dae0, and then re-enters 0x0040eba0 for every bucketed site in that rectangle using the stored per-entry coordinate pair plus two zero flags. Current grounded caller is the edit-side branch at 0x004bc851, immediately after the neighboring nibble and companion-float mutations, so this now looks like a bucket-map-driven local-runtime side-state refresh wrapper rather than another broad site sweep. The sibling policy-1 side is tighter now too. The constructor lane no longer stops at “one linked site id at [site+0x2a8]”: the subtype-1 branch in placed_structure_construct_entry_from_candidate_and_world_args 0x0040f6d0 now clearly allocates that linked record through placed_structure_collection_allocate_and_construct_linked_site_record 0x00481390, whose lower constructor is placed_structure_construct_linked_site_record_from_anchor_and_coords 0x00480210. That lower constructor seeds the linked record's own id and anchor-site id, clears the local route-anchor and display-name fields, projects the anchor footprint into world space, and then either binds an already-covered route entry through route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading 0x00417b40 or falls through into the neighboring policy-1 route-entry synthesis family around 0x00493cf0 before rebinding the chosen route entry through 0x0048abc0. The cleanup side is tighter now too. Linked-site removal now has a bounded owner at placed_structure_collection_remove_linked_site_record 0x004813d0: it resolves the linked record through 0x006cec20, runs the per-record teardown placed_structure_teardown_linked_site_runtime_state_before_removal 0x00480590, removes the live entry from the collection, and only then re-enters the still-bounded company-wide follow-on at 0x00429c10 when the removed record passed the narrower transit-like latch. That per-record teardown is no longer just “clear some scratch fields.” It now clearly clears the route-style scratch lane, clears the five proximity buckets at [site+0x590..0x5b8], detaches or invalidates the current route-entry anchor, frees the three per-site byte arrays at [site+0x24..0x2c], clears this site's indexed byte from the corresponding arrays of later placed-structure records, and then re-enters 0x00436040 with the current site id. That company-side follow-on is no longer just one opaque callback either. It is now bounded as company_collection_refresh_active_company_linked_transit_site_peer_caches 0x00429c10, which walks the active company roster and re-enters company_rebuild_linked_transit_site_peer_cache 0x004093d0 on each company. That per-company fast pass stamps a refresh tick at [company+0x0d3e], clears and repopulates the placed-structure-side cache cells addressed through [site+0x5bd][company_id], marks the eligible linked transit sites for that company, allocates one 0x0d-stride peer table for each eligible site, and fills those peer rows from aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks 0x004a6630. That helper no longer reads as one anonymous route sweep: it either uses the fixed pair directly or falls back across tracker endpoint combinations before returning the winning route-entry id, one route-step count, and one companion mismatch count. The fast cache now reads more cleanly too: peer-record dword +0x05 stores that step count, while float +0x09 stores the normalized continuity share derived from (steps - mismatches) / max(steps, 1), not a raw delta-per-step ratio. The adjacent timed wrapper company_service_linked_transit_site_caches 0x00409720 now shows the cadence too: 0x004093d0 is the shorter-interval refresh, while the older heavier sibling at 0x00407bd0 was only revisited on the longer interval. That heavier sibling is now bounded too: company_rebuild_linked_transit_autoroute_site_score_cache 0x00407bd0 no longer looks like a generic tail refresh. It reuses the fast peer tables, rebuilds candidate-local amount bands plus normalized issue-opinion scales, and then folds the peer-side route metrics back into three per-site cache floats with a cleaner split: +0x12 is the raw surviving site-score total, +0x0e is the continuity-and-step-weighted companion total, and +0x16 is the promoted final site-ranking lane chosen from the strongest grouped candidate bands. That also closes most of the cross-version impact question: the pre-1.03 versus 1.03+ tracker metric split now looks like it mainly perturbs the weighted +0x0e lane and the promoted +0x16 lane, not the raw +0x12 total. That final lane then feeds the neighboring selectors company_select_best_owned_linked_transit_site_by_autoroute_score 0x00408280 and company_build_linked_transit_autoroute_entry 0x00408380. That makes the company-side follow-on read more like a linked-transit autoroute cache family than a generic company maintenance pass. The neighboring reachability gate is tighter now too: company_query_cached_linked_transit_route_anchor_entry_id 0x00401860 caches one company-side route-entry anchor, and placed_structure_is_linked_transit_site_reachable_from_company_route_anchor 0x004801a0 uses that anchor to decide whether a foreign linked transit site can still participate in the current company's fast peer cache. The first direct train-side consumer above that cache family is bounded now too: train_try_append_linked_transit_autoroute_entry 0x00409770. After servicing the owning company's caches, it asks 0x00408380 for one staged 0x33-byte route entry using the train's current anchor site, then either appends that entry through 0x004b3160 and refreshes the new trailing selection through 0x004b2f00, or rotates one existing slot in place when the local two-entry cap has already been reached. So this edge now reaches an actual train-side autoroute append lane rather than stopping at anonymous company-side cache cells. The weighted cache lanes still do not escape that route-choice family directly: this train-side append path only inherits the weighted site and peer choice by calling 0x00408380, not by reading cache +0x0e/+0x16 itself. The train-side follow-on above that seed path is bounded now too. The owning company can count its live roster through company_count_owned_trains 0x004264c0, measure one aggregate linked transit site pressure through company_compute_owned_linked_transit_site_score_total 0x00408f70, and then rebalance that roster through company_balance_linked_transit_train_roster 0x00409950. The aggregate helper no longer reads as a raw sum either: it starts from the site-cache +0x12 totals, converts that into one tentative roster target through year and site-count ladders, and on build 1.03+ adds one special distance-side scaling branch when exactly two eligible linked transit sites survive. Because it consumes +0x12 rather than +0x0e or +0x16, current evidence now says the tracker compatibility split is more important for seeded route choice and ranked site choice than for the final company train-count target itself. The local linked-transit chain is now bounded enough to say that directly: weighted cache lanes feed 0x00408280 -> 0x00408380 -> 0x00409770/0x00409830, while the separate pressure or roster lane feeds 0x00408f70 -> 0x00409950 from raw +0x12. The balancer then applies two age bands to company-owned trains: very old trains are removed when the roster already exceeds target or upgraded when it still needs capacity, while the mid-age band can trigger one narrower upgrade pass. After that it fills any remaining deficit by either packaging multiplayer opcode 0x75 or locally re-entering company_try_add_linked_transit_train_and_publish_news 0x00409830. The two visible news helpers under it are bounded too: 0x00409830 emits RT3.lng 2896 for a newly added train, while company_publish_train_upgrade_news 0x00409300 emits RT3.lng 2897 for the upgrade branch. The subtype-4 sibling side is bounded now too. The nearby-site bucket family now has: placed_structure_append_nearby_transit_site_distance_bucket_entry 0x0047fdb0, placed_structure_remove_site_id_from_proximity_bucket_lists 0x0047dd10, and placed_structure_clear_proximity_bucket_lists 0x0047dcd0, plus the two collection sweeps placed_structure_collection_append_site_into_all_proximity_bucket_lists 0x00481480 and placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists 0x004814c0. Current evidence says those five buckets store (peer site id, distance) pairs for nearby station-or-transit peers, grouped through the five-way classifier at 0x0040d350. The older stream-backed side is bounded too: placed_structure_collection_load_dynamic_side_buffers_from_stream 0x00481430 walks the live placed-structure collection and re-enters placed_structure_load_dynamic_side_buffers_from_stream 0x0047d8e0, which repopulates the route-entry list, the three per-site byte arrays, the five proximity buckets, and the trailing scratch band from the caller-supplied persistence stream. The linked-site route-entry list itself is tighter now too. The refresh or teardown branch at 0x0040e102 re-enters placed_structure_remove_route_entry_key_and_compact 0x0047d810, which removes one matching u16 key from the six-byte list rooted at [site+0x462]/[site+0x466], compacts the surviving entries into a replacement buffer, and decrements the stored route-entry count. The broader linked-site mutable runtime strip is tighter now too. placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch 0x0047f320 is no longer just a teardown-side stub: it resolves an effective comparison mode from the linked candidate class byte [candidate+0x8c] unless the caller overrides it, derives one radius threshold from current world coordinates [site+0x4a8/+0x4ac], frees the prior sampled-cell buffer at [site+0x34], always clears the route-link scratch pair [site+0x462]/[site+0x466], and then scans one bounded world-grid rectangle through [0x0062c120+0x2129] with per-cell distance measured by 0x0051db80. For accepted cells it emits temporary twelve-byte (grid x, grid y, sampled score) rows through 0x0042b190, 0x0042c530, and 0x0042c580; when caller arg0 is zero it compacts one representative subset of those temporary rows into the persistent list at [site+0x34]/[site+0x38], while nonzero arg0 callers use the same helper as a clear-and-scan companion without the final materialization step. Current grounded callers are the linked-site refresh and teardown strip 0x00480542/0x004805c2/0x00480727/0x004807e2. The proximity-bucket rebuild side above that list is tighter now too. placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells 0x0047fef0 first requires the current record to pass the narrower station-or-transit class gate 0x0047fd50, quantizes the current site position through 0x00455800/0x00455810, walks the surrounding live cell window through [0x0062c120+0x2129], follows each cell's linked placed-structure chain through word field [cell+0x0d6] plus next-id [peer+0x2a2], keeps only peers whose resolved candidate subtype byte [candidate+0x32] equals 4, and appends the surviving (peer site id, distance) pairs into the same five bucket arrays rooted at [site+0x590..+0x5a4]. So the narrower one-peer append helper 0x0047fdb0 now has a real broader owner rather than only collection sweeps. The whole linked-site refresh owner is correspondingly clearer now too. placed_structure_refresh_linked_site_runtime_side_buffers_and_route_entry_anchor 0x00480710 first clears the current proximity buckets through 0x0047dcd0, runs 0x0047f320(1,arg1) against the pre-update state, republishes the current site position into the world-grid owner map through 0x0042bbf0/0x0042bbb0, reruns 0x0047f320(0,-1) to materialize the current sampled-cell list, and then rebuilds the nearby-transit buckets through 0x0047fef0. After that it either reuses a still-valid route-entry anchor through route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading 0x00417b40 and placed_structure_rebind_route_entry_anchor_to_site_id 0x0048abc0, or synthesizes a replacement through 0x00493cf0 before rebinding it the same way; when an old anchor survives but now points at a different owner, the helper clears the prior [entry+0x222] back to -1. The world-cell owner and route-gather helpers beneath that strip are bounded now too. Word [cell+0xd4] is the head of one placed-structure owner chain: 0x0042bbb0 prepends the current site id into that chain by writing the previous head into [site+0x3c] through the tiny setter 0x0047d6f0, while 0x0042bbf0 removes one site id from the same chain by walking the linked [site+0x3c] next pointers until it can splice the requested site out. The sampled-cell rebuild also now has its lower route-gather leaf: 0x0042c530 walks one world cell's linked-site chain from word [cell+0xd6] through next-id [site+0x2a2] and appends each visited site id plus the caller payload into the six-byte route-entry list helper 0x0042b190. That same compact list now has its two local companions bounded too: 0x0042b230 removes one row by leading u16 key, and 0x0042b2d0 is the shared contains-key predicate over the same [...+0xeb]/[...+0xef] list. The neighboring [cell+0xd6] linked-site chain is bounded now too. 0x0042c9a0 prepends one site id into that chain by writing the previous head into [site+0x2a2] through the tiny setter 0x0040cb00, storing the new head back into [cell+0xd6], and then re-entering the paired rebuild helpers 0x0042c690 and 0x0042c8f0. 0x0042c9f0 is the remove companion over the same chain: it walks the linked [site+0x2a2] next pointers until it can splice the requested site id out of the [cell+0xd6] head chain, then reruns the same two rebuild helpers. The two remaining numeric leaves under this strip are bounded now too. 0x0042c580 accumulates the directional word fan from [cell+0xf3 + dir*2] while stepping toward one caller-supplied grid target through the fixed offset tables at 0x00624b28/0x00624b48, and that is the floating sampled-score source later stored by 0x0047f320. 0x0042c960 is the shared rounded issue-opinion-scaled word-lane query: it multiplies one local word lane [this+index*2] << 4 against the scenario-side scale returned by 0x00437d20(index) and rounds the result through 0x005a10d0. The broader company-side owner above these pieces is tighter now too. The periodic service pass company_service_periodic_city_connection_finance_and_linked_transit_lanes 0x004019e0 now reads as the current outer owner for this branch: it sequences the city-connection announcement lanes, the linked-transit train-roster balancer, the acquisition-side sibling company_try_buy_unowned_industry_near_city_and_publish_news 0x004014b0, the annual finance-policy helper company_evaluate_annual_finance_policy_and_publish_news 0x00401c50, and the shorter-versus- longer linked-transit cache refresh tail through 0x004093d0 and 0x00407bd0. That outer pass also has one tighter temporary-state role now: it clears company bytes 0x0d17/0x0d18/0x0d56, mirrors 0x0d17 into scenario field 0x006cec78+0x4c74 only while the earlier route-building side runs, and restores the original scenario value on exit. Current evidence now ties 0x0d17 to the shared preferred-locomotive chooser 0x004078a0: the override is only armed when that helper picks one locomotive whose engine-type dword is 2. That engine-type lane now best reads as electric rather than an unnamed class slot, because the linked approval helper around 0x0041d550 now reads as a real locomotive-era and engine-type policy gate, dispatching the same 0/1/2 field across three scenario-opinion lanes while the local player-facing engine-type family is explicitly Steam / Diesel / Electric. That same gate also now ties the later scenario bytes 0x4c97..0x4c99 back to the editor-side Locomotives page rather than treating them as anonymous availability flags: they are the live All Steam Locos Avail., All Diesel Locos Avail., and All Electric Locos Avail. policy bytes behind 0x004cd680 / 0x004cf0d0. The current logic is also tighter than a plain override tier: a positive engine-family opinion result can carry the gate by itself only while none of those three editor bytes is enabled; once any of them is nonzero, 0x0041d550 instead requires one matching intersection between the record-local family bytes and the enabled editor family bytes. The WhaleL carveout is narrower now too: current data-file correlation ties that stem to the Orca NX462 / WhaleL_NE locomotive family, and it explicitly zeros that positive-opinion result before the later family-availability checks, so it loses the shortcut rather than gaining a special approval path. The same chooser now also has a bounded fallback below it, locomotive_collection_select_best_era_matched_non_electric_fallback_id 0x00461cd0, which explicitly skips engine-type 2 and chooses the lowest-penalty remaining locomotive by era mismatch and approval gates. The route-search side is tighter too: this electric-only override now clearly feeds the first path-sweep branch in 0x0049bd40, forcing the larger 1.8 initial quality multiplier instead of 1.4, which is the same branch otherwise chosen by explicit route-policy byte 4. The neighboring 0x00442a40..0x00442ae1 helper strip is tighter now too: it is not generic issue math, it is the forward and inverse mapper between two compact locomotive engine-family index spaces and the raw issue bands 0x0f1..0x15f / 0x1c9..0x1da plus 0x160..0x1c4 / 0x1db..0x1f6, and the same strip is reused by both the stream save/load pair 0x0042ddd0/0x00430feb and the shell-side issue-row resolvers 0x00462449/0x004624ae over the fixed table at 0x00610398. So the later annual finance helper is reading same-cycle side-channel state from the earlier city-connection and linked-transit branches, not unrelated long-lived finance fields. The inner finance helper is not debt-only either. Current grounded outcomes include bankruptcy news 2881, the debt restructure family 2882..2886, a later share-repurchase headline 2887, and the dividend-side adjustment branch. The main commit verbs under that helper are now grounded too: company_repay_bond_slot_and_compact_debt_table 0x00423d70, company_issue_bond_and_record_terms 0x004275c0, company_repurchase_public_shares_and_reduce_capital 0x004273c0, and company_issue_public_shares_and_raise_capital 0x00427450. The threshold side is tighter now too. The earliest creditor-pressure lane requires scenario mode 0x0c, the bankruptcy toggle [0x006cec78+0x4a8f] to be clear, at least 13 years since [company+0x163], and at least 4 years since founding year [company+0x157]; it then scans the last three years of the derived net-profits and revenue lanes 0x2b and 0x2c, chooses one negative pressure ladder -600000 / -1100000 / -1600000 / -2000000 from the current slot-0x2c bands around 120000 / 230000 / 340000, requires the broader support-adjusted share-price or public-support scalar at least 15 or 20 depending on whether all three sampled years failed, checks the current fuel-cost lane in slot 0x09 against 0.08 times that ladder, and requires the three-year slot-0x2b total to clear one final -60000 gate before it falls into the bankruptcy commit and RT3.lng 2881 headline. The middle debt-capital layer is split more clearly now too. With [+0x4a8b] clear, one annual bond lane first simulates full repayment through company_repay_bond_slot_and_compact_debt_table and then uses the post-repayment cash window with fixed -250000 and -30000 thresholds plus the broader linked-transit train-service latch [company+0x0d56] to decide whether to append one or more 500000 principal, 30-year bonds. The repurchase lane is separate again: when the city-connection announcement-side latch [company+0x0d18] is set, growth setting 2 does not suppress it, and [+0x4a87] is clear, it starts from one 1000-share batch, can replace its default 1.0 factor with one linked-chairman personality scalar, scales that by 1.6 when growth setting 1 is active, and then runs one 800000 stock-value gate plus one support-adjusted-share-price-times-factor-times-1000-times-1.2 affordability gate before the repeated 1000-share buyback commits behind RT3.lng 2887. The ordering above this helper is tighter now too: company_service_periodic_city_connection_finance_and_linked_transit_lanes clears those latches first, runs the city-connection and linked-transit branches, and only then enters the annual finance helper, so these look like same-cycle reaction gates rather than long-lived balance-sheet flags. After the earlier debt or bankruptcy outcomes stay inactive, the later stock-capital lane also has a tighter bounded shape now too: it only opens on build 1.03+, only after the earlier bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles [+0x4a8b] and [+0x4a87] clear, at least two bond slots live, and at least one year since founding. It derives one issue batch from outstanding shares rounded down to 1000-share lots with floor 2000, trims that batch until the broader support-adjusted share-price scalar times batch no longer exceeds the 55000 gate, recomputes the pressured support-adjusted share-price scalar and the paired price/book ratio, then tests the remaining gates in a fixed order: share-price floor 22, proceeds floor 55000, current cash from 0x2329/0x0d against the chosen highest-coupon bond principal plus 5000, one later stock-issue cooldown gate that converts the current issue mixed-radix calendar tuple at [company+0x16b/+0x16f] through calendar_point_pack_tuple_to_absolute_counter 0x0051d3c0 and compares the result against the active world absolute calendar counter [world+0x15], and only then the coupon-versus-price-to-book approval ladder 0.07/1.3 -> 0.14/0.35. The issue mutator preserves the previous tuple in [company+0x173/+0x177] and refreshes the current tuple from [world+0x0d/+0x11] on the derived-pricing lane. On success it issues two same-sized tranches through repeated company_issue_public_shares_and_raise_capital calls and publishes a separate equity-offering news family rooted at localized id 4053, not the earlier debt or buyback headline family. The dividend side is bounded too: it requires the dividend toggle [0x006cec78+0x4a93] to be clear, mode 0x0c, at least 1 year since [company+0x0d2d], and at least 2 years since founding, then averages the last three years of the net-profits lane 0x2b, folds in the unassigned-share pool and the current 0x0d band, applies the map-editor building-growth setting [0x006cec78+0x4c7c], treats growth setting 1 as a 0.66 scale-down and setting 2 as a zeroing pass on the current dividend, quantizes surviving adjustments in tenths, and finally clamps against company_compute_board_approved_dividend_rate_ceiling 0x00426260. The linked-transit route-seeding side has one tighter sibling now too: company_reset_linked_transit_caches_and_reseed_empty_train_routes 0x00401940. It clears the two company-side linked-transit cache timestamps, forces one immediate cache rebuild through 0x00409720, strips route lists from company-owned trains in modes 0x0a/0x13, and then re-enters train_try_append_linked_transit_autoroute_entry 0x00409770 only when a train's route list has become empty. On the wider chooser question, the current evidence is also tighter than before: every recovered external owner of 0x00402cb0 is still in the city-connection family, so the two later direct placement lanes currently read as city-connection fallback behavior rather than a broadly shared world placement service. It can still unwind through route-state cleanup without committing new placed structures, so the exact lower helper semantics are not fully closed, but the broader chooser is no longer anonymous and its main policy split is now visible. The two lower helpers directly under those commit lanes are bounded now too: placed_structure_project_candidate_grid_extent_offset_by_rotation 0x00417840 is the shared projected-footprint offset helper over candidate bytes [candidate+0xb8] and [candidate+0xb9], and placed_structure_validate_projected_candidate_placement 0x004197e0 is the shared go-or-no-go validator that checks company, territory, world-tile, and footprint occupancy state before either direct-placement commit is allowed to fire. Its strongest current subtype branch is a station-attachment or upgrade-style lane keyed by [candidate+0x32] == 1, which now has the concrete failure family 2901..2906: blocked upgrade footprint, ground not flat enough, not your track, insufficient track-laying capacity, cannot connect to existing track, and ground too steep. That tightens the chooser materially without yet proving that the validator is station-only for every caller. The recurring outer owner is tighter now too: placed_structure_collection_refresh_quarter_subset_route_style_state 0x00413580 walks every fourth live placed structure from a scenario-time-derived offset and re-enters the per-site rebuild with stack flag 0, giving the route-style lane a concrete recurring maintenance sweep under simulation_service_periodic_boundary_work rather than only a floating caller note. One neighboring helper is now bounded on the message side too: shell_building_detail_handle_subject_value_row_band_action 0x004ba270 switches over the clicked row family 0x7d07..0x7d14, treats subject bytes +0x21/+0x22/+0x23 as one current selection plus one bounded low/high pair, increments the family dirty latch at 0x006cfe0c on change, and republishes the refreshed value through the shared shell control helper on code 0x66. One neighboring helper is now bounded on the side-list path too: shell_building_detail_propagate_selected_subject_state_into_side_list 0x004b9ec0 walks the sibling list owner at 0x006cfe08, copies the active subject state into each side-list record, mirrors the current service or capability id at +0x24, and preserves the 0x40/0x20/0x10 subflags from the active subject. That means the value-row actions and later selector rows now read as propagating one shared building-detail state across the sibling list rather than only mutating one isolated subject record. One neighboring helper is now bounded separately too: shell_building_detail_refresh_subject_pair_value_rows 0x004bad20 owns the mutually exclusive value-row pairs 0x7d07/0x7d08, 0x7d11/0x7d12, and 0x7d13/0x7d14, choosing among them from the same selected-subject flag byte and payload fields at +0x22/+0x23, while the larger cargo-or-service row owner also gates the extra visual lanes 0x7d6a, 0x7d6b, and 0x7d9d from that same subflag family. The asset-string block is tighter too: that branch family now explicitly uses AnyCargo.imb, AnyFreight.imb, PassMail.imb, Caboose.imb, and Dining.imb, with the bit-0x20 special lane already aligned to Caboose.imb and the sibling bit-0x10 special lane now aligned to Dining.imb. The larger 0x7f58..0x801f band is no longer just a styled row family either: shell_building_detail_present_flagged_service_capability_popup 0x004b9fd0 is now grounded as its explanatory popup callback. It resolves either one fixed express-side row from 0x00621e04 or one active candidate or service id from [subject+0x24], then formats one popup through the shell message-box path. The neighboring refresh helper shell_building_detail_refresh_flagged_service_capability_rows 0x004b9a20 is tighter now too: 0x7d07..0x7d1c is not one anonymous block, but a real mask partition over subject bits 0x20 and 0x10, with one zero-mask pair, one bit-0x20-only pair, one exclusive-or pair, and later one-bit and two-bit indicator rows. RT3.lng now closes the fixed popup text family too: the single-line branch uses 3922 %1\nLoads available at %2: %3, while the richer ordinary-candidate branch uses 2981 %1\nLoads available at %2: %3 Current Price: %4 and can append 2982 Price at next station, %1: %2 (%3%4). The selector band is narrower too: current refresh-side evidence shows 0x7f58..0x801f as one selected-ordinal highlight family over the three fixed express rows plus the ordinary active-candidate rows, not as a generic unstructured list. The neighboring 0x8020..0x8051 band is tighter too: it is primarily the matching remove-entry family for the selected subject's live id list, with two special row indices re-routing into the 0x7d0f/0x7d10 subflag-clearing path instead of ordinary list compaction when the current 0x20/0x10 service-bit combination demands it. That means the exact captions are no longer broadly open across the whole selector family: the fixed express-side rows, the mask partitions, and the add/remove structure are grounded, and the remaining caption gap is mostly the ordinary candidate rows further down the same band. The top-level toggles are tighter now too: the paired 0x7d02/0x7d03 controls are the real mode switch over subject bit 0x40, choosing between the bounded pair-value branch and the current-selection/status branch around 0x7d0d/0x7d0e, while the smaller 0x7d0f/0x7d10 controls flip the same special-service subflags later rendered as Caboose and Dining Car. One adjacent control is tighter now too: the extracted BuildingDetail.win resource contains the plain-English line Set the initial cargo amount for 'Disable Cargo Economy' scenarios., and the 0x7d01 plus 0x7d09/0x7d0a message-side branch can mirror the current subject or selection through shell_building_detail_submit_aux_owner_subject_sync_request 0x004b9e10 into the auxiliary owner queue at [0x006cd8d8+0x8f48], with side-owner presence now explicitly grounded through shell_has_auxiliary_preview_owner 0x00434050. That queued request is tighter too: both current callsites forward the same side-list mirror latch at [0x006cfe08+0x0c], so the auxiliary owner now clearly sees not just the staged subject but also whether the local BuildingDetail side-list is in mirrored-subject mode. The same 0x7d01 lane also now has one clear rejection note: localized id 3587 This option is only available by following the tutorial. now sits behind the active tutorial flag at 0x006d3b4c and the cached previous tutorial expected-control id at 0x00622b38, while the neighboring tutorial helper tutorial_advance_step_and_refresh_expected_control_ids 0x00516be0 now grounds 0x00622b34/0x00622b38/0x00622b3c as the current and previous expected-control cache rather than anonymous globals. The last field is tighter now too: 0x00622b3c is currently best read as the active tutorial step's alternate-accepted companion control id, because the generic shell control path compares clicked control ids against it directly and suppresses the 3587 tutorial rejection when they match. That does not fully close the player-facing caption bind for every control, but it does bound the neighboring side-owner sync and tutorial-rejection lane instead of leaving it as anonymous glue. The extra pre-insert gate is narrower than it first looked. It is now grounded as tutorial-only: tutorial_validate_train_route_station_indicator_step 0x00516d00 checks the current tutorial step from the shell tutorial descriptor table at 0x00622b48 before a live station-or-transit site id can be committed into the staged route entry, and the currently accepted steps align with localized prompts 3777 and 3778, the two train-routing tutorial instructions that tell the player to click the Milan and Turin station indicators. Outside that tutorial state family, the route-entry insertion path is not gated there. The adjacent validator is tighter now too: train_route_list_validate_reachability_and_station_pair 0x004b2c10 walks that same route list, resolves placed-structure-backed entries through the live placed-structure and route-node collections, uses the direct route-node payload branch for the remaining entry family, and fails with 3089..3091 when the resulting route cannot be traversed or does not preserve a valid terminal station pair. The post-validation follow-on is bounded too: train_current_route_context_uses_strict_reachability_mode 0x004a9460 is now the small shared gate above the stricter branch, keyed off the current linked route object's downstream class type, and train_set_route_operating_mode_and_scalar 0x004ab980 now reads as the shared train mode setter beneath route editing, with the local and multiplayer insertion paths choosing mode 0x13 only when that stricter second validation succeeds and mode 0x0a on the looser fallback path. The first deeper world-mode interaction branch is now better bounded: GameUppermost.win hotspots, cursor drag, held Shift state, discrete shell view-step commands, direct keyboard turn/pan/zoom bindings, the TrackLay.win and StationPlace.win world-command surfaces, and a frame-owned hover or focus-target transition branch all feed the same shell-controller-backed path. The remaining uncertainty has moved farther from basic ownership only in the per-tool sense: the hover-target branch clearly exists, 0x07d6 now looks like the shared main-world interaction surface rather than a generic detail button for one tool family only. One more shell-side consumer is bounded now too: 0x004bc350 is a world-surface brush handler over that same 0x07d6 control plus the adjacent mode family 0x0faa..0x0faf and ordinal strip 0x0fa0..0x0fa7. That family is no longer just a generic unlabeled brush owner: the detail-panel manager now grounds the sibling tool-window strip immediately above it as Bulldoze.win, ChangeHeight.win, ChangeTrees.win, PaintTerrain.win, PaintRegion.win, PaintSound.win, and PaintTerritory.win, each with its own constructor, refresh pass, and message owner beneath the same controller rooted at 0x006d0818. Once its local drag latch is active it dispatches the current mode dword at [0x006d0818+0x8c] into the companion-float helpers 0x0044d4e0, 0x0044d880, and 0x0044da70, or into the secondary-raster nibble path 0x00448e20 -> 0x00419110, so the remaining uncertainty has narrowed from ownership to the exact one-to-one mode-button mapping inside that grounded tool-window strip. The PaintTerrain.win side is tighter now too: constructor 0x004f7ce0 seeds shell singleton 0x006d1304, callback root 0x006d1334, a constructor-time bulk-update latch at 0x006d1330/0x006d1331, and the broader terrain mode or scalar state from 0x00622748..0x00622788 plus 0x006d1308..0x006d1324; it then registers the callback strip 0x004f5960, 0x004f59f0, 0x004f6070, and 0x004f69e0 through 0x00540120. The direct message owner under that same family is no longer just a loose branch fan-out either: 0x004f6f50 owns messages 2/0xca/0xcb, keeps control 0x07d6 as the live world-surface drag latch, routes explicit undo control 0x2775 into 0x004f5c30, maps the selector and mode strips 0x2711..0x2730, 0x27d9..0x27df, 0x283d..0x2843, 0x28a1..0x28e6, 0x2915..0x291e, 0x2964..0x2967, and 0x29cd.. into the cached terrain lanes, and then fans the active drag path into preview helpers 0x004f6930, 0x004fb5e0, 0x004fc280, 0x004fc4d0, and 0x004fc630 depending on the current terrain mode. Inside that same family 0x004f5a80/0x004f5c30 are now the bounded local undo snapshot pair, 0x004f5dd0 is the tiny active-scalar-group selector, 0x004f6b50 owns the ten-entry mode strip rooted at 0x28dd, 0x004f6390 is the broad mode-panel repaint owner, 0x004f6250 is the mode-dependent world-dispatch bridge, 0x004f6930 samples the current preview raster at world coordinates, and 0x004fb5e0 is the heavier preview-raster rebuild and shell-surface publish worker. The next local helpers under that same family are tighter now too: 0x004f5ea0 and 0x004f5ec0 are just the two tiny special-mode predicates (mode 5, variant 2) and (mode 4, variant 2), 0x004f8770 is the weighted RGB sampler over the current preview or undo-backed raster neighborhood, 0x004f89b0 is the local byte-grid connected-component grower over the eight-neighbor tables 0x00624b28/0x00624b48, and 0x004f8bb0 is the main drag-path preview compositor that consumes the drag sample strip [this+0xf0/+0xf4/+0xf8], allocates temporary float or byte grids, and then rasterizes the surviving preview rectangle through the current terrain descriptor tables at 0x005f3500, the weighted color sampler 0x004f8770, the component grower 0x004f89b0, and several live world samplers before writing final RGBA pixels back into the preview surface. The late tail under that same compositor is tighter too: the mode-4, variant-2 path toggles secondary-raster byte-2 bit 0x20 by comparing current and previous cells through 0x00534f40; the broader mode-4/5 world-facing branch samples class set 2/4/5 through 0x00534ec0, re-enters 0x0044de30 and 0x0044df10, latches pending world coordinates into [0x006d1304+0x78/+0x7c], and rewrites the low nibble plus the signed overlay-vector planes through 0x00448df0, 0x00448e20, 0x00448ec0, 0x00448ee0, 0x00448e60, and 0x00448e90. After the optional mode-5 smoothing sweep through 0x004f8370, the publish tail either materializes one shell preview surface through 0x0051f090 -> 0x00534730 or, for the mode-4/5 world-facing variants, converts the surviving preview rectangle back into world-space bounds and re-enters 0x0044e940, world_refresh_active_preview_mode_from_four_dword_parameter_block 0x00452f20, and 0x0044d410. The companion preview-rebuild owner 0x004fb5e0 is tighter on entry, too: 0x004f726c is the early rebuild path that first copies the live preview raster into [this+0x118] and snapshots undo state through 0x004f5a80, while 0x004f7ada is the later drag-active path that first allocates a temporary occupancy mask before rebuilding and then conditionally mirrors that mask through world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds 0x00450520 on the world-mode-0x17 side path. The remaining local lanes can therefore be carried conservatively as PaintTerrain per-mode scalar and token bands beneath that already- grounded mixed shell/world ownership strip, not as another ownership seam.

330 KiB Raw Blame History Unescape Escape