rrt/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md

## Multiplayer Session and Transport Flow

- Roots: `multiplayer_window_init_globals` at `0x004efe80`, `multiplayer_window_service_loop` at
  `0x004f03f0`, the Multiplayer.win session-event callback table built by
  `multiplayer_register_session_event_callbacks` at `0x0046a900`, the active session-event transport
  object at `0x006cd970`, the Multiplayer preview dataset object at `0x006cd8d8`, and the lower
  pending-template and text-stream helpers around `0x00597880..0x0059caf0`.
- Trigger/Cadence: shell-owned Multiplayer.win frame service plus event-driven session callbacks and
  repeated transport pump steps.
- Key Dispatchers: session-event wrappers for actions `1`, `2`, `4`, `7`, `8`;
  `multiplayer_register_session_event_callbacks`; `multiplayer_dispatch_requested_action`;
  `multiplayer_reset_preview_dataset_and_request_action`;
  `multiplayer_preview_dataset_service_frame`; `multiplayer_load_selected_map_preview_surface`;
  `multiplayer_flush_session_event_transport`; `multiplayer_transport_service_frame`;
  `multiplayer_transport_service_worker_once`;
  `multiplayer_transport_service_route_callback_tables`;
  `multiplayer_transport_service_status_and_live_routes`;
  `multiplayer_transport_text_stream_service_io`;
  `multiplayer_transport_dispatch_pending_template_node`;
  `multiplayer_transport_service_pending_template_dispatch_store`.
- State Anchors: live session globals at `0x006d40d0`, active session-event transport object at
  `0x006cd970`, status latch at `0x006cd974`, session-event mode latch at `0x006cd978`, retry
  counter at `0x006cd984`, preview dataset object at `0x006cd8d8`, preview-valid flag at
  `0x006ce9bc`, staged preview strings at `0x006ce670` and `[0x006cd8d8+0x8f48]`, Multiplayer.win
  backing block at `0x006d1270`, selector-view store root at `[transport+0xab4]`, selector-view
  generation counters at `[transport+0xab8]..[transport+0xac0]`, selector-view backing arrays around
  `[transport+0xad0]..[transport+0xae4]`, selector-view entry probe-request id at `[entry+0x50]`,
  live-state gate at `[entry+0x58]`, third-slot flag word at `[entry+0x64]`, probe-schedule tick at
  `[entry+0x68]`, last-success tick at `[entry+0x6c]`, pending-probe latch at `[entry+0x74]`,
  success generation at `[entry+0x78]`, consecutive-failure counter at `[entry+0x7c]`, rolling
  average at `[entry+0x80]`, recent sample window at `[entry+0x84..]`, bounded sample-count at
  `[entry+0x94]`, total-success count at `[entry+0x98]`, pending-template list at
  `[transport+0x550]`, dispatch store at `[worker+0x54c]`, and text-stream buffers rooted under
  `[worker+0x1c]`.
- The worker-owned text-stream seam is tighter now too: `0x59c670` constructs the two growable
  text buffers, `0x59c6c0` resolves the remote host and opens one keepalive TCP socket into
  `[worker+0x1c]`, `0x59cbd0` formats transient command lines through the shared static builder at
  `0x00db8dd0`, `0x59caf0` appends those lines plus CRLF, and `0x59cad0` services the resulting
  send/recv socket state. The current worker bring-up at `0x58f110` now reads cleanly through that
  strip: after store construction it opens the text stream, connects it to the caller host/port,
  and then emits either `CRYPT des 1 %s` or the fallback `USRIP` command into the send buffer. The
  mode-`3` transport-text pair setter is tighter now too: `0x59ae20` takes the two payload strings
  under `[msg+0x20]`, XORs each of them in place against the fixed repeating key band
  `[transport+0x564]` through `0x5a1050`, seeds the paired RC4-style `0x102`-byte stream-cipher
  states at `[transport+0x242]` and `[transport+0x140]` through `0x5a0d00`, marks `[transport+0x13c]`
  active, and then refreshes the status line through `0x59caf0`. The
  receive side is tighter now too: `0x59d210` peels one complete CRLF-delimited line out of the
  receive buffer, `0x59cec0` decodes that isolated line into the transient field band rooted at
  `[worker+0x328..+0x344]`, `0x59cc30` splits any `nick!user@host`-style prefix into owned
  subfields, `0x59cdf0` tokenizes the later fields into the transient vector at
  `[worker+0x348..+0x34c]`, and `0x59d400` returns the transient band only when one full line was
  successfully decoded.
- Subsystem Handoffs: the Multiplayer.win initializer seeds the backing block at `0x006d1270`, later
  reset paths construct the separate preview dataset at `0x006cd8d8`, and the shell-owned
  active-mode frame services that dataset every frame through
  `multiplayer_preview_dataset_service_frame`. That preview side publishes roster and status
  controls through the Multiplayer window control paths, loads `.gmt` preview surfaces through
  `multiplayer_load_selected_map_preview_surface`, and is even reused by the map/save coordinator’s
  mode-`11` `.gmt` path when the dataset already exists. The preview owner now has a tighter
  internal request split too. The fixed selector-descriptor list at `[0x006cd8d8+0x8f28]` is built
  through `multiplayer_preview_dataset_append_named_callback_descriptor` `0x00469930`, whose
  current grounded owner is the fixed registration block
  `multiplayer_preview_dataset_register_fixed_named_callback_descriptors_1_to_10` `0x00473a60`;
  the variable-size named UI-request list at `[0x006cd8d8+0x8f2c]` is built through
  `multiplayer_preview_dataset_append_named_ui_request_record` `0x00469a50`; and the staged
  profile/path strings live at `[0x006cd8d8+0x8e10]` and `[0x006cd8d8+0x8f48]`, with the broader
  action-`2` staging path now bounded by
  `multiplayer_preview_dataset_stage_profile_text_selected_path_and_sync_session_state`
  `0x0046a030`. The companion action-`3` commit path is tighter too:
  `multiplayer_preview_dataset_match_named_field_slot_copy_profile_text_and_probe_selection`
  `0x0046a110` now sits directly above the lazily initialized `0x80 * 0x11c` field-slot table at
  `[0x006cd8d8+0x10]`, whose owner is
  `multiplayer_preview_dataset_ensure_field_slot_table_initialized` `0x0046a1a0`. The shared
  submitter above those lists is now explicit too:
  `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` accepts the caller’s
  request-id, selector, payload pointer and length, flag word, and optional auxiliary pointer,
  optionally allocates one sidecar object, and then either sends the request directly through the
  session-event transport or takes the slower packed branch through `0x00553000/0x00552ff0` into
  `0x00521dc0`. One shell-side prompt owner above that submitter is now explicit too:
  `shell_command_prompt_for_text_and_submit_selector1_multiplayer_transport_request_when_auxiliary_preview_ready`
  `0x00441690` requires active scenario state, the auxiliary-preview-owner gate
  `shell_has_auxiliary_preview_owner` `0x00434050`, and one live queued-preview record at
  `[world+0x66ae]`, then opens prompt `0x0b6d` and forwards the returned text through
  `0x00469d30` with selector `1`, request id `0`, flag `1`, and a null auxiliary payload while the
  shell-global modal latch `0x0062be80` is held around the prompt. The constructor and teardown
  side are tighter now too.
  `multiplayer_preview_dataset_construct_reset_globals_and_seed_callback_owners` `0x0046be80`
  is the real reset owner above the action-`2/3` branches in
  `multiplayer_dispatch_requested_action`: it re-enters the paired release body
  `multiplayer_preview_dataset_release_owned_lists_transients_and_session_side_state`
  `0x0046bc40`, clears the surrounding launcher globals, allocates the field-slot table and the
  keyed request/descriptor owners, seeds the render target and staging buffers, and then calls
  `multiplayer_preview_dataset_reset_global_callback_state_and_register_selector_handlers`
  `0x00473280` plus the smaller fixed-name block
  `multiplayer_preview_dataset_register_fixed_named_callback_descriptors_1_to_10` `0x00473a60`.
  That broader registration pass `0x00473280` now bounds the selector-handler family too: it
  zeroes the global scratch bands `0x006ce808..0x006ce994` and `0x006ce290`, seeds default
  callback root `[0x006cd8d8+0x08]` with `0x0046f4a0`, and populates the keyed selector table at
  `[0x006cd8d8+0x04]` through
  `multiplayer_preview_dataset_register_selector_callback_if_absent` `0x00468b10` for selectors
  `1..0x83`. The concrete callback bodies under that table are tighter now too. The small split is
  real rather than guessed: `0x0046c390` is the direct control-`0x109` publish leaf through
  `0x00469d30`; `0x0046c3c0` is the fixed-session-token plus launch-latch arm path; and the large
  sibling `0x0046c420` is the real apply-owner for one incoming session payload slab copied into
  `0x006cec74` before the shell-refresh follow-ons. A second callback cluster now owns live
  session-entry flags instead of just relaying transport payloads: `0x0046c7c0` rewrites the
  elapsed-pair dwords `[entry+0x54/+0x58]`, `0x0046c840` sets bit `0x08` in `[entry+0x5c]`,
  `0x0046c870` toggles bit `0x01` from payload byte `[msg+0x08]`, `0x0046cf10` sets bit `0x04`,
  and `0x0046cf70` is the list-wide clear of that same bit-`0x01` lane across every live session
  entry. The broader callback `0x0046c8c0` sits above those single-field leaves and applies either
  one or many embedded session-field update records before republishing the list. The pending-state
  side is separated now too: `0x0046cce0`, `0x0046cd10`, `0x0046ce90`, and `0x0046d230` are the
  current small latch/state owners under `0x006cd91c`, `0x006d1280`, `0x006d1284`, and
  `0x006ce9c8`, while `0x0046cd30` and `0x0046ce10` are the paired current-session string/scalar
  submit-and-apply handlers over `[entry+0x258c/+0x268c/+0x2690/+0x2694]`. One neighboring
  cross-subsystem callback is tighter now too: `0x0046cf40` mirrors one remote late
  setup-preview/status payload block into `[world+0x66be]`, the same world band later serialized
  and restored under bundle chunk ids `0x2ee0/0x2ee1` and re-normalized after restore through
  `0x0047bc80`. The same callback table
  also owns one small fixed transfer-progress family rooted at `0x006ce2e8`: `0x0046cfe0`
  allocates the first free `0x5c` slot and optionally formats one label string, `0x0046d090`
  appends progress payload into the matched slot while publishing one percent string through
  `0x005387a0`, and `0x0046d1d0` clears the finished slot and frees that optional label. On the
  release side, `0x0046bc40` now clearly owns the request-list,
  descriptor-list, semicolon-name, pooled-span, render-target, and auxiliary-owner teardown, while
  `multiplayer_shutdown_preview_dataset_session_object_and_global_helper` `0x0046c230` is the
  final wrapper that additionally drops the live session object at `0x006d40d0` and the shared
  helper at `0x00d973b4`. The small tuple staging below that family is bounded too:
  `multiplayer_preview_dataset_touch_current_session_year_bucket_and_return_staged_tuple`
  `0x0046b6d0` now owns the keyed session-bucket touch under `[session+0x2580]` for the staged
  tuple at `[0x006cd8d8+0x9048]`, and the companion
  `multiplayer_preview_dataset_stage_optional_selected_token_from_source_ptr` `0x0046d610` writes
  the optional derived token into `[0x006cd8d8+0x8f38]`. The next service layer under the same
  owner is tighter too: `multiplayer_preview_dataset_prune_session_buckets_below_current_year_key`
  `0x0046b910` now bounds the older keyed-bucket drain under `[session+0x2580]`, while
  `multiplayer_preview_dataset_service_current_session_buckets_and_publish_selector0x67`
  `0x0046b9f0` owns the current-bucket walk, the local counters `[+0x987c/+0x9890]`, and the
  later selector-`0x67` publish branch back through `0x00469d30`. Its local batch-publish child
  `multiplayer_preview_dataset_publish_accumulated_selector0x71_record_batch` `0x00473bf0` is now
  bounded too: it packages the fixed-width records at `0x006cd990`, prefixes `(0, count)`, sends
  them as selector `0x71`, and then clears the live record count `0x006ce9a0`. The immediate local
  helpers under that same band are now explicit too: `0x0046d260` is the fixed-record append
  primitive that grows `0x006cd990` up to `0x80` entries, while `0x0046d240` is the paired release
  of the optional selector-`0x71` staging blob at `0x006ce994`. The first fixed named-descriptor
  block under `multiplayer_preview_dataset_register_fixed_named_callback_descriptors_1_to_10`
  `0x00473a60` is tighter in the same way now. Its concrete roots `0x0046db10`, `0x0046db50`,
  `0x0046db90`, `0x0046dbd0`, `0x0046dd10`, `0x0046de40`, `0x0046de80`, `0x0046e030`, and
  `0x0046e250` all return small static records rooted at `0x006ce9dc..0x006cea3c`; each record
  carries a leading tag byte plus the same derived world-year key from `[0x006cec78+0x0d]`, while
  the heavier siblings add collection-backed totals from `0x0062be10`, `0x006ceb9c`, `0x0062b26c`,
  `0x006cfca8`, or `0x006cfcbc` together with local overlay, geometry, or object-metric sample
  paths. The immediate helper strip beneath that same first named block is tighter now too.
  `0x0046d980` is the direct `0x006ceb9c` name-to-index lookup over `[entry+0x08]`, while
  `0x0046d9e0` is the heavier companion that first resolves the current live session from
  `0x006d40d0`, matches that session-side string against the same `0x006ceb9c` table, and returns
  the matching entry index or `0xff`. Above those, `0x0046f8f0` resolves and validates one
  `0x0062be10` entry, then keeps it only when its profile-index field `[entry+0x3b]` equals the
  live-session-backed `0x006ceb9c` index from `0x0046d9e0`; and `0x0046f870` is the paired
  rounded-delta leaf that takes one float plus one collection byte index and writes the rounded
  positive/negative pair into metric ids `0x0f` and `0x0d` through `0x0042a040`. So this first
  descriptor band is no longer just a bag of static record roots: it also owns a real local helper
  family for `0x006ceb9c` name matching, live-session profile matching, and one narrow metric-pair
  apply path beneath the higher callback bodies. The next selector layer above that helper strip is
  tighter now too. Selector `0x12` is the small validate-or-error wrapper above selector `0x13`,
  and selector `0x13` body `0x004706b0` resolves the same live-session company match, attempts the
  placed-structure apply path through `0x004197e0`, `0x004134d0`, `0x0040eba0`, `0x0052eb90`, and
  `0x0040ef10`, and otherwise falls back to a hashed selector-`0x6e` publish over the first
  `0x1c` payload bytes. The same pattern appears again one pair later: selector `0x16` is the
  thin validate-or-error wrapper above selector `0x17`, and selector `0x17` consumes a count plus
  `0x33`-stride adjunct record band, resolves one live train-side entry under `0x006cfcbc`,
  re-enters `0x004a77b0`, `0x0052e720`, `0x0040eba0`, `0x0052eb90`, and `0x0040ef10`, and again
  falls back to hashed selector `0x6e` publish when the live apply path does not land. The later
  status pair is bounded too: selector `0x19` is another thin wrapper, and selector `0x1a` either
  derives a status code from `0x0046ed30` and current live-session name matching or treats the
  four-byte payload directly as that status code before publishing localized status text
  `0x0b7f/0x0b80`. One selector-pair above the metric leaf is now explicit too:
  the earlier front edge of the same callback table is tighter now too. Selector `0x02` compares
  staged profile text against the shell profile band at `[0x006cec7c+0x11]`, can advance the
  requested-action fields `0x006d1280/0x006d1284`, can queue selector `0x53`, and on the success
  path syncs the larger shell profile block rooted at `[0x006cec7c+0x44]`. The next small strip is
  also grounded: selector `0x0a` clears `[world+0x19]`, seeds `[world+0x66ae]`, mirrors peer byte
  `[peer+0x2690]` into named-profile byte `[entry+0x15c]`, refreshes `0x006ce98c`, and optionally
  republishes one local status path. Selector `0x0b` is then the small token-staging wrapper above
  selector `0x0c`, and selector `0x0c` itself forwards one signed byte pair into `0x00434680`
  before adjusting dataset counter `0x006cd8e8`. The other small early leaves are now bounded too:
  selector `0x0f` pops one node from the current session queue at `[session+0x64]`, publishes that
  node through `0x00469d30`, and releases it; selector `0x10` looks one payload key up in the
  session-side store `[session+0x60]` and forwards the result plus dataset string root
  `[0x006cd8d8+0x8f48]` into `0x00521790`. One selector-pair above the metric leaf is now explicit too:
  selector-`0x15` body `0x00470950` consumes the same compact `(float delta, company-index byte)`
  payload shape, resolves the matching live-session company entry through `0x0046f8f0`, submits
  selector `0x6b` through `0x00469d30`, and then immediately re-enters `0x0046f870` for the local
  apply. The neighboring name-match lane is now explicit too:
  selector-`0x61` body `0x00472700` scans `0x0062be10` for a company-name match against the caller
  string at `[payload+0x08]` and then either submits selector `0x62` with the original payload or
  falls back to the paired error-style `0x21` branch. The next registered band around selectors
  `0x1c..0x5d` is tighter now too. Selector-adjacent helpers `0x00470ed0` and `0x00470fa0`
  are the paired global preset passes beneath that strip: both walk the guarded named-profile
  table `0x006ceb9c`, add opposite signed integer presets into qword field `[profile+0x154]`
  through `0x00476050`, then walk `0x0062be10` and write opposite preset
  scalars into metric id `0x0d` through `0x0042a040`. Above them, selectors `0x1d`, `0x1f`,
  `0x21`, `0x23`, `0x25`, `0x27`, `0x29`, `0x2b`, `0x2d`, `0x2f`, `0x31`, `0x33`, `0x35`,
  `0x37`, and `0x39` are now explicit token-staging forwarders into selectors `0x1e`, `0x20`,
  `0x22`, `0x24`, `0x26`, `0x28`, `0x2a`, `0x2c`, `0x2e`, `0x30`, `0x32`, `0x34`, `0x36`,
  `0x38`, and `0x3a`. The next live-train strip is also grounded: selectors `0x3b`, `0x3d`,
  `0x3f`, `0x41`, and `0x43` resolve live train ids from `0x006cfcbc`, stage the current token,
  and republish into selectors `0x3c`, `0x3e`, `0x40`, `0x42`, and `0x44`; selectors `0x3c`,
  `0x3e`, and `0x40` then dispatch directly into `0x004abd70`, `0x004b2f00`, and `0x004b3000`,
  while selector `0x42` is the heavier train-adjunct branch through `0x004b2b70`,
  `0x004b3160`, `0x004b2c10`, `0x004a9460`, and `0x004ab980`. The prompt or bitmap cluster is
  tighter too: selector `0x48` consumes one 12-byte record, either marks the current-session bit
  directly or opens localized prompt `0x0b81` through `0x00469a50` and callback `0x004719c0`,
  and then republishes selector `0x49`; selector `0x49` turns that 12-byte result into one keyed
  bitset object and republishes selector `0x47`; selector `0x47` consumes the resulting ten-slot
  masks and drops straight into `0x004eb230` plus
  `shell_resolve_merger_vote_and_commit_outcome` `0x004ebd10`. The same pattern repeats one
  size smaller for selectors `0x4c`, `0x4d`, and `0x4b`: selector `0x4c` consumes one 10-byte
  record, either marks the current-session bit directly or opens localized prompt `0x0b82`
  through `0x00469a50` and callback `0x00471d50`, selector `0x4d` folds that 10-byte result into
  the keyed bitset object, and selector `0x4b` turns the resulting masks into one ten-dword cache
  setter at `0x0050c4e0` rooted at `0x006d1a08` plus the paired outcome resolver
  `0x0050c940`. The direct setter strip after that is explicit too: selector `0x4f` republishes
  selector `0x6f` when the live session object exists and dataset
  gate `0x006cd91c` is clear, selector `0x50` copies `[dataset+0x9058]` into `[dataset+0x9054]`,
  selector `0x51` derives one small session-status code and either republishes selector `0x52` or
  shell control `0x109`, selectors `0x55`, `0x56`, and `0x57` directly store dataset field
  `0x9860`, a `0x006ceb9c` inline name, and guard field `[entry+0x1e1]`, selector `0x58` flushes
  the deferred 16-slot named-profile clear queue `[dataset+0x9864..+0x9873]`, selector `0x59`
  derives one roster or capacity status and republishes selector `0x5a`, selector `0x5b` is
  another token-staging forwarder into selector `0x5c`, selector `0x5c` gates a
  `0x00493960` dispatch plus optional local `0x0046f870` apply, and selector `0x5d` validates
  one payload string before republishing selector `0x5e`. The next registered band around selectors
  `0x5e..0x7d` is tighter too. Selector `0x5e` updates the named-profile side table
  `0x006ceb9c`, mirrors the same string into the resolved live session object, and when the
  session-side guard is active hashes that string back into `[session+0x48]` and dataset field
  `[0x006cd8d8+0x8f48]`; selector `0x5f` then stages the current year-derived token and republishes
  into selector `0x60`, whose body writes one guarded byte field into the same `0x006ceb9c` entry
  family. The `0x62..0x64` strip forms the same kind of pair over `0x0062be10`: selector `0x62`
  copies one fixed `0x32`-byte band into the matched company entry, selector `0x63` rejects
  duplicate field-`0x37` values before forwarding, and selector `0x64` applies that same dword
  field directly into the matched entry or one live fallback owner. The receive-side correction is
  explicit now too: selector `0x6b` is the tiny local metric-apply wrapper
  `0x00472db0 -> 0x0046f870`, selector `0x6c` is the separate train-record wrapper
  `0x00472dc0 -> 0x0046d780`, selector `0x6d` formats localized status `0x0f4e` into the grounded
  world outcome-text buffer `[world+0x4b47]`, and selector `0x6e` walks the current keyed bucket
  under `[session+0x2580]` and marks the first matching companion record by payload hash. The
  later wrappers are cleaner too: selectors `0x71`, `0x73`, `0x75`, `0x77`, `0x79`, `0x7b`, and
  `0x7d` are all token-staging forwarders into selectors `0x72`, `0x74`, `0x76`, `0x78`, `0x7a`,
  `0x7c`, and `0x7e`. Beneath them, selector `0x72` is the heavier counted live-world apply path
  over `0x0062b2fc`, `0x0062b26c`, and `0x0062bae0`; selector `0x74` dispatches a resolved
  company-entry id into `0x0062b26c` under the small latch `0x006ce9a8`; selectors `0x76`,
  `0x7a`, and `0x7c` resolve one company-style entry and then tail into narrower local handlers;
  and selector `0x78` is the broader projection-or-notify body over `0x0044b160`, `0x00538e00`,
  and the local-session refresh strip. The next adjacent owner `0x0046e5c0` is broader but still
  belongs to the same structural neighborhood: in mode `1` it serializes a dual-collection metric
  blob from `0x0062be10` and `0x006ceb9c`, writing the two row counts into local header bytes and
  then packing one `0x24`-stride band plus one `0x2c`-stride band behind a `0x10`-byte header; the
  opposite branch starts validating and applying those packed metrics back into live entries. So
  that first named block is no longer just a string-name registry; it already includes a real typed
  static-record family beneath the preview dataset, and it now sits directly beside one broader
  fixed-record callback-successor strip. Right after the selector-`0x71` batch publisher, the local
  `0x005ce418` fixed-record family becomes explicit: `0x00473ce0` constructs one `0x187`-byte
  record from two copied strings, shell-profile bytes `[0x006cec78+0x0d/+0x0f/+0x11]`, owner field
  `[this+0x04]`, and monotonic sequence dword `[this+0x14]` seeded from `0x006cea48`;
  `0x00473dc0`, `0x00473e70`, `0x00473ee0`, and `0x00473f30` are the max-sequence, min-sequence,
  previous-sequence, and next-sequence queries over the same live collection; `0x00473e20` is the
  boolean scan for any inactive record with a nonzero owner dword; and `0x00473f80` is the real
  allocator or constructor owner, trimming the collection down to `0x19` entries, allocating one
  live record through `0x00518900`, and then dispatching the heavier constructor. So the callback
  registry now leads directly into a concrete preview-side fixed-record collection, not into
  another anonymous transport helper band. The broader snapshot/apply owner still sits over the
  same multiplayer collection state. In parallel,
  `multiplayer_register_session_event_callbacks` allocates and registers the separate session-event
  transport object at `0x006cd970`. The shell-side bridge into that deeper transport cadence is now
  tighter: `multiplayer_window_service_loop` and neighboring reset or initializer branches call
  `multiplayer_flush_session_event_transport`, which forces one status flush and then drops into
  `multiplayer_transport_flush_and_maybe_shutdown`. That wrapper in turn runs
  `multiplayer_transport_service_frame`, the recurring pump that services one worker step through
  `multiplayer_transport_service_worker_once`, sweeps the transport-owned callback tables and field
  caches through `multiplayer_transport_service_route_callback_tables`, services both the auxiliary
  status route and the current live route through
  `multiplayer_transport_service_status_and_live_routes`, and then descends one layer farther into
  the shared GameSpy route helper `multiplayer_gamespy_route_service_frame` at `0x58d040`. The
  transport also owns a separate selector-view sidecar beneath that route cadence.
  The reset and teardown side of that same outer transport is tighter now too. The bounded local
  callback-table attach validator `0x58d7e0` first clears selector registrations through
  `multiplayer_transport_reset_selector_tables`, then ensures the keyed selector-view store, and
  only then rebuilds the surrounding selector-view runtime through the auxiliary sidecar ensure
  owner `0x593fe0` before returning success. That sidecar seam is now explicit too:
  `0x593db0` hashes the ordered status-string pair `(entry, entry+0x40)` modulo the caller
  divisor, `0x593e40` compares that same ordered pair for keyed equality, `0x593ef0` is a real
  no-op release callback, and `0x593fb0` is the worker callback that resolves one selector-view
  entry through `0x594b40` and commits probe success through `0x593f00`. One layer lower,
  `0x58d810` is the common
  runtime-reset strip that clears selector slots, releases the
  keyed selector-view store, clears the auxiliary selector-view sidecar rooted at `[transport+0xac8]`,
  and forwards into the remaining route-mode-sensitive selector cleanup. That lower strip is no
  longer opaque either: `0x5955a0` is the bulk three-slot selector reset plus shared probe-marker
  clear, `0x594080` is the auxiliary selector-view sidecar release when the keyed store is unbound,
  and `0x595820` is the forced route-mode-`0` cleanup that preserves selector slot `2` ownership
  across the reset. The next owner above that strip is now explicit too: `0x58de50` either latches
  deferred reset at `[transport+0x1edc]`
  while outstanding work remains or, once the transport is quiescent, clears `[transport+0xab0]`,
  releases the live worker/runtime band through `0x58d860`, and immediately pumps one more service
  step through `0x58d8d0(-1)`. The final destroy tail `0x58d8a0` then tears down queued work,
  active opcode records, the Winsock guard, and the remaining owned runtime strings before freeing
  the transport body. The constructor-side and shutdown-side owners are explicit now too.
  `0x58dc50` enters the Winsock `1.1` guard, allocates and zeroes the full `0x1ee4`-byte transport
  body, seeds local IPv4 `[transport+0x58]`, constructs the transient work-record collection,
  copies one caller-supplied `0x70`-byte callback-vector/state seed block into
  `[transport+0x178c..+0x17f8]`, then constructs the active opcode-record collection at
  `[transport+0x17fc]` through `0x592750` and the shared plus slot-local selector callback-name stores at `[transport+0x18a8]`,
  `[transport+0x1890..+0x1898]`, `[transport+0x189c..+0x18a4]`, and `[transport+0x18ac..+0x18b4]`
  through `0x5966f0` before the object is considered live. The later callback-slot wrappers rooted
  at `[transport+0x178c]`, `[transport+0x17c0]`, `[transport+0x17c4]`, and the sibling callback
  contexts near `[transport+0x17f8]` now make that copied band read as the constructor-side
  callback vector and companion state, not as a generic label blob. The paired runtime release strip
  `0x58d860` tears the worker down, clears the configured transport latches, releases the transient
  work-record side, reruns the selector/callback reset block, and clears `[transport+0x180c]`,
  byte `[transport+0x1810]`, and deferred-reset latch `[transport+0x1edc]`. Above that, `0x58de90`
  is the actual shutdown owner: it preserves the leading callback-vector dword at
  `[transport+0x178c]` across `0x58de50`, disconnects the live route state, and then either marks
  deferred-close flag `[transport+0x1ee0]` while work remains or falls straight into final destroy
  owner `0x58d8a0`, which also releases the selector callback-name store family through `0x5967f0`.
  The adjacent route-mode text side is tighter too. `0x58db70` is the small selector-text helper
  that formats one caller mode string through the shared stack builder and sends it through
  selector slot `3` or `4`, while the broader owner `0x58dfb0` sits above it and derives the live
  route-mode status from transport latches, refreshes the mode-string band
  `[transport+0xad0/+0xadc]`, stores companion state at `[transport+0xb34/+0xb40/+0xb44/+0xb54]`,
  and then either submits the richer selector-text route request through `0x593c40` or falls back
  to the probe/enqueue path `0x592a70`. That same owner also participates in the current
  callback-table attach validation through `0x58d7e0`, with disconnect fallback `0x58d830`, and
  reuses the same immediate-drain context-id wait loop as `0x58df20`.
  The selector-status side underneath those owners is tighter now too. `0x5951f0` is not just a
  generic transport pump: it builds up to three transient selector-mode strings from selector
  presence lanes `[transport+0x384..+0x398]` and status latches `[transport+0xb40/+0xb44/+0xb54]`
  plus `[transport+0x180c]`, appending the letters `s`, `r`, `h`, `g`, and `a` into three local
  string bands and then hashing those bands through `0x594c40`. It only emits the matching
  `SETCHANKEY`/`SETCKEY` lines through `0x58ece0` when the hashed mode state changed versus cached
  masks `[transport+0x99c/+0x9a0/+0x9a4]`. The adjacent cleanup sibling `0x5965d0` is concrete
  too: it optionally releases the status route through `0x597350`, clears the `h/g/r` latch band
  `[transport+0xb40/+0xb44/+0xb54]`, and then reruns `0x5951f0` so the emitted selector-mode text
  stays consistent with the cleared route state.
  The adjacent selector and callback-table owners are tighter now too. `0x58e100` is the fixed
  selector-`2` status publisher: it only runs when transport latches `[+0x60]`, `[+0x48]`,
  `[+0x398]`, and `[+0xb40]` are all live, falls back to `0x005c87a8` when the caller token is
  null, formats one line from the caller token plus `[transport+0x282]` and the current route IPv4
  at `[transport+0x54]`, sends that line through selector `2`, sets `[transport+0xb44] = 1`, and
  then either nudges route-mode helper `0x595650(5)` or falls into the auxiliary `0x597350 /
  0x597370` branch. The adjacent dispatcher `0x596fd0` is now explicit too: it only exposes its
  built-in status-field strip when `[transport+0x398]` is live and the `[transport+0xb44]` or
  `[transport+0xb38]` gate allows it, then appends internal text `[transport+0x79c]`, decimal
  state from `[transport+0xac0]`, `[transport+0xb48]`, and `[transport+0xb3c]`, one static
  fallback token, or the boolean form of `[transport+0xb4c]`; outside those built-in ids it
  dispatches into the local status-route callback-vector lanes or falls back to the owner callback
  at `[transport+0x17dc]` with context `[transport+0x17f8]`. One level earlier, `0x58dce0` is now the setup-side sibling:
  it copies the local name into `[transport+0x60]`, seeds the two status-text bands at
  `[transport+0xad0/+0xadc]`, preserves those descriptor triplets only when selector-view result
  slot `[transport+0xab0]` is already live, copies the route-label buffers at
  `[transport+0xb58/+0xb78]`, clears route-label state bytes `[transport+0xb77/+0xb97]`, stores
  callback-table metadata at `[transport+0xb98/+0xb9c]`, rebuilds the route callback-table family
  through `0x596090`, and on success refreshes the current status text at `[transport+0xaf4]`
  before rerunning `0x5965d0(1)`. The same local pass also makes the negative boundary tighter:
  setup still touches the surrounding callback-table and replay-band fields without ever seeding a
  nonzero value into `[transport+0x1778]`, so the local static seam is closed here: no ordinary
  constructor, reset, service, or callback-table owner in `RT3.exe` currently writes that sidecar,
  and the latest full-binary disassembly scan still finds only the `0x595bc0` read while the
  neighboring lifecycle fields `[transport+0x177c/+0x1780/+0x1784/+0x178c/+0x17f8]` do show normal
  constructor/reset/use sites. The producer therefore still looks upstream of this local cluster.
  Beside it, `0x58e200` is the broader callback-table attach or refresh owner:
  it seeds one immediate-drain context id, conditionally copies the local name into `[transport+0x04]`,
  clears `[transport]`, `[transport+0x48]`, and `[transport+0x1edc]`, stores follow-on callback
  fields `[+0x4c/+0x5c]`, sets `[transport+0x44] = 1`, attaches the descriptor block through
  `0x593650`, whose worker-side callback pair is now explicit too: `0x593610` republishes the
  staged work-record triplet through opcode-`5` binding enqueue helper `0x592c40`, while
  `0x593630` stores the incoming route scalar at `[transport+0x54]` and then forwards the caller
  text/buffer plus `[transport+0x5c]` into `0x597780`, the fixed-template encoded route-scalar
  formatter beneath that attach path. On attach failure the outer owner falls through `0x58d860`,
  dispatches the resolved binding through `0x592a40`, and optionally reuses the same
  immediate-drain wait loop as the neighboring transport submit owners.
  The direct selector-text seam under those owners is explicit now too. `0x58e630` is just the
  current-local-name helper: it returns `[transport+0x36c]` while the worker root is live and
  otherwise falls back to `0x005c87a8`. Above that, `0x58e7e0` is the real direct selector-text
  variant publisher under `0x58d9e0`: it formats one line through `[transport+0x1c]` as
  `PRIVMSG %s :%s`, action-prefixed `PRIVMSG`, `NOTICE %s :%s`, `UTM %s :%s`, or `ATM %s :%s`
  depending on caller mode `0..4`, then probes the matching registered-name entry through
  `0x59d7d0` and emits opcode `4` through `0x59b790` when that entry exists. The plain sibling
  branch is explicit now too: `0x58ea60` formats the same five selector-text variants through
  `[transport+0x1c]` but stops after appending the text line, without probing `0x59d7d0` or
  emitting opcode `4`. The registered-name fastpath side is tighter at the same time:
  `0x58eb10` is just the null-worker guard above
  `multiplayer_transport_find_registered_name_entry_and_optionally_return_bucket` `0x59df60`,
  which walks the worker-owned registered-name store at `[worker+0x548]` and can return both the
  matched entry and its owning bucket pointer. One level earlier, `0x58e510` is the broader
  fastpath owner under `0x593d60`: when the caller text is null, empty, too long, or
  casefold-equal to current local name `[transport+0x36c]`, it takes the immediate callback-style
  opcode-`0x1b` path through `0x598060 -> 0x59b790`; otherwise it formats one local-name command
  through `[transport+0x1c]` using format `0x005e1c64`, packages that request through `0x598280`,
  and on either branch reuses the same `0x58e3f0 / Sleep(10) / 0x58e370` immediate-drain loop when
  requested.
  The route-request side beneath those owners is explicit too. `0x58e720` is the common submit root
  under `0x593bb0` and `0x593c40`: it formats one local route line through `[transport+0x1c]`,
  packages the caller route payload and callback triplet into a type-`1` transient request through
  `0x5981b0`, refreshes the registered-name side through `0x59d5b0`, and when requested loops
  through `0x58e3f0`, `Sleep(10)`, and `0x58e370` until the request completes. That registered-name
  refresh path is tighter too: `0x59d5b0` builds one zeroed `0x1e0`-byte stub from the caller
  string and appends it into the flat registered-name vector `[transport+0x54c]` through the
  shared `generic_vector_push_back` helper `0x59e4d0`, while the smaller sibling `0x58e7a0` sits
  beside it as the selector-slot text and registered-name removal path. The selector-text submit
  owner itself is explicit now too: `0x593c40` is not just a generic “route request” wrapper. It
  rejects null, empty, or `>= 0x101`-byte text, falls back to fixed sample `0x005c87a8` when the
  caller sample pointer is null, allocates a type-`2` transient work record through `0x5934e0`,
  stores the selector id in work field `+0x1c`, refreshes selector-side naming through
  `0x59fc80/0x595140`, and only then hands the request into `0x58e720` with callback `0x593bb0`.
  under `0x5954b0` and formats one selector-slot line before removing the corresponding
  registered-name entry through `0x59d760`. The selector callback-name side under the same reset
  tail is explicit now too: `0x596900` first walks the shared selector callback-name store at
  `[transport+0x18a8]` through the hashed-table reverse walk `0x58fa40` and callback `0x596840`,
  pruning names that no longer correspond to any live selector-view entry or any of the three
  slot-specific callback stores rooted at `[transport+0x1890/+0x1894/+0x1898]`. It then services
  the slot-local callback collections at `[transport+0x18ac/+0x18b0/+0x18b4]`, clearing inactive
  slots through the hashed-table clear helper `0x58fac0` and otherwise using `0x58fa40` plus
  callback `0x5968b0` to prune any shared names whose current selector-view entry no longer owns
  the current slot.
  The drain side itself is tighter too. `0x58e3f0` no longer just “notifies a small observer
  table”: its local child `0x58e310` walks the global `(command-name, callback)` table at
  `0x00629d58/0x00629d5c`, compares the decoded command token at `[line+0x14]` through the shared
  casefolded compare `0x5a57cf`, and on a match invokes the paired callback with the current
  decoded-line band in `EDX` and the transport pointer in `ECX`.
  `multiplayer_transport_ensure_selector_view_store` allocates the keyed selector-view store at
  `[transport+0xab4]`, `multiplayer_transport_find_selector_view_entry_by_name` resolves entries
  from that store, `multiplayer_transport_upsert_selector_name_entry` marks per-slot activity and
  flags inside each entry, and `multiplayer_transport_mark_selector_slot_views_dirty` plus
  `multiplayer_transport_reset_selector_view_entry_runtime_state` manage the dirty or refresh fields
  at `+0xa0`, `+0xa4`, and `+0xa8`. That selector-view maintenance path is now split more cleanly
  too. The recurring owner is `multiplayer_transport_service_selector_view_refresh_cycle`, which
  first runs the fast deferred-probe lane:
  `multiplayer_transport_collect_refreshable_selector_view_entries` walks the store through
  `multiplayer_transport_filter_insert_refreshable_selector_view_entry`, which now shows that
  `[entry+0x64]` is not a generic flag bucket but the third selector-slot flag word, parallel to
  `[entry+0x5c]` and `[entry+0x60]`. In that collector, the `g` and `a` mode-letter bits produced by
  `multiplayer_transport_parse_selector_mode_letters` become mask `0x0c` in the slot-local flag
  words, and any third-slot entry carrying those bits at `[entry+0x64]` is excluded from the
  refreshable set. Eligible entries then pass slot-aware retry timing on `[entry+0x68]`,
  `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the service loop schedules refresh
  probes through `multiplayer_transport_schedule_selector_view_entry_refresh_probe`. That fast lane
  is narrower now too: the entry-side match key `[entry+0x50]` is no longer just an opaque request
  field. The profile-key callback lanes feed
  `multiplayer_transport_parse_selector_view_probe_marker`, which decodes one local `X%sX|%d` marker
  into a probe request id plus displayed version/build integer, and
  `multiplayer_transport_arm_selector_view_probe_tracking` stores those into `[entry+0x50]` and
  `[entry+0x54]` before arming the live probe gate at `[entry+0x58]`. The current-selector callback
  root at `0x59f8b0` is now bounded as well: it resolves and upserts the active selector name,
  optionally reuses a cached `username` marker to arm probe tracking immediately, then submits the
  same profile-key bundle with selector context and forwards that selector through callback slot
  `17`, with the status-route side able to force route-mode transitions `2 -> 3 -> 4` afterward. One
  layer lower, `multiplayer_transport_handle_profile_key_query_result` at `0x596970` now bounds the
  per-key result path itself. It treats `username` as the probe-marker field, `b_flags` as the
  selector mode-letter field, and `(END)` as a real sentinel that publishes a zeroed slot-`22`
  payload instead of a marker pair. The same helper also hashes the selector-name, key-name, and
  resolved value text back into the caller table, so the profile-key bundle now looks like a real
  bounded handoff rather than an anonymous callback cloud. The owner above it is tighter too:
  `0x596da0` is now the real per-slot bundle submitter, not just a vague wrapper. For one active
  selector slot it first collects the slot-local key list from `[transport+0x1890+slot*4]` and
  issues the synchronous `GETKEY` query through `0x58ec50`, using either the caller override or
  the slot name at `[transport+0x80+slot*0x101]`. When no override is supplied it then collects a
  second list from `[transport+0x189c+slot*4]`, conditionally adds built-in `username` and
  `b_flags`, and sends the larger channel-key pair list through `0x58ef20` with callback
  `0x596ce0`. That second-stage callback is now explicit too: the default-slot branch resolves the
  returned selector name back into one slot and then walks one selector-name pair array through
  `0x596b90` using the shared fallback text at `0x00629d54`, while the selector-name-override
  branch uses the explicit override name and walks one parallel pair array through the same lower
  helper with publication enabled. The thin wrappers above the owner are now grounded accordingly:
  `0x596fa0` forwards one selector-name override, while `0x596fc0` forces the slot's fixed name.
  The adjacent rename helper `0x596c10` now also makes the selector callback-name
  maintenance side explicit: after a selector rename it walks the shared and slot-local callback
  stores and rewrites any callback-name entry whose primary text still matches the old selector
  name. One layer above the per-key helper, `0x596b10` now reads as the shared built-in key sweep:
  it tries the same result helper `0x596970` across the shared store `[transport+0x18a8]` and the
  three slot-local callback-name stores, stopping on the first success and then publishing callback
  slot `27` through `0x5931b0`. The deferred callback shim
  `multiplayer_transport_dispatch_selector_view_refresh_probe_result` then walks the keyed store
  through `multiplayer_transport_finish_selector_view_refresh_probe_if_matching`, which only
  completes entries whose pending latch `[entry+0x74]` is still armed and whose parsed marker
  request id `[entry+0x50]` matches the finished request. A failed result `-1` clears the pending
  latch and increments the consecutive-failure counter at `[entry+0x7c]`. A nonfailure result clears
  the pending latch, increments the success generation at `[entry+0x78]` and total-success count
  `[entry+0x98]`, clears `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, appends the
  returned sample into the short rolling history at `[entry+0x84..]`, grows the bounded sample-count
  `[entry+0x94]` up to four, computes the current average into `[entry+0x80]`, and then publishes
  that averaged `ms` sample through `multiplayer_transport_enqueue_callback_slot24_record`. So the
  publication boundary is explicit and the request-id ownership is explicit: `[entry+0x80]` now
  reads as the averaged millisecond probe sample and `[entry+0x54]` as the displayed version/build
  companion integer. The adjacent route-callback side is tighter too, but it is now kept separate:
  the staged route-callback path at `0x5958e0` and the later compatibility gate at
  `multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple` `0x595d00` operate
  on a compact GameSpy-style server or route descriptor family with a primary endpoint tuple at
  `[descriptor+0x00]/[+0x04]`, an optional secondary endpoint tuple at `[descriptor+0x08]/[+0x0c]`,
  string-key lookups such as `hostname` and `gamever`, and numeric-key lookups such as
  `numplayers`, `numservers`, `numwaiting`, and `gsi_am_rating`. The route-binding side uses that
  descriptor family's primary dword and host-order port plus the optional secondary tuple against
  route-binding offsets `+0x54/+0x58` and route word `+0x30`. The capacity-side gate above it is
  tighter now too: `0x595d60` first tries that tuple match against the current bound route at
  `[transport+0x1ecc]`, and on success immediately falls into
  `multiplayer_transport_invoke_bound_route_callback_if_present` `0x592710`, which simply calls the
  bound route's optional callback slot `[binding+0x14]` with companion argument `[binding+0x18]`.
  When the tuple does not match, the same gate instead compares descriptor fields `maxplayers` and
  `numplayers`; only a descriptor with spare capacity reaches that same callback handoff. The owner
  directly above that gate is explicit now too: `0x595dc0` first rejects when staged-route busy
  latch `[transport+0x1e8c]` or selector-slot object `[transport+0x38c]` is live, then reuses the
  same tuple-or-capacity result from `0x595d60`; only a positive result lets it refresh selector
  state through `0x5973b0`, reset selector slot `2` through `0x5954b0`, stage the descriptor
  through `0x5958e0`, and finally drop route mode back to `0` through `0x595650` when that staging
  path fails. That makes the seam read as one bounded ladder instead of three isolated helpers:
  descriptor tuple match or spare-capacity gate, optional bound-route callback handoff, then the
  busy-latch-screened route-transition owner above it. Current evidence now also closes the clone
  side of that staged path: `0x596270` copies the first nine
  dwords of the source staged callback payload, clears the intrusive next-link, and then replays
  the source keyed-property list through shim `0x596260`, which simply reinserts each owned
  `(key,value)` pair into the clone's property store through `0x58d0f0`, before the clone is
  stored at `[transport+0xb50]` for later callback publication. Current
  evidence still does not prove
  that descriptor tuple is the same field family as the selector-view marker companion integer at
  `[entry+0x54]`. The higher compact decode owners are tighter now too: `0x5907d0` is the
  route-callback receive owner for one fresh compact payload, with a concrete return split of `0`
  on malformed or undersized payloads, `-1` on the special global descriptor, and the consumed byte
  count on successful decode through `0x58ff60`; `0x590d00` is the keyed upsert-by-primary-endpoint
  lane that reuses an existing descriptor when possible, allocates only on miss, decodes in mode
  `0`, and then publishes owner callback mode `1` before returning `0/4/5` for success, decode
  failure, or special-global rejection. The route-callback-table runtime above that decode side is tighter now too:
  `multiplayer_transport_route_callback_table_construct` `0x5905e0` seeds one transport-owned
  table block, `multiplayer_transport_route_callback_table_release_decoded_schema_dictionary`
  `0x5906f0` tears down the decoded schema dictionary rooted at `[this+0x08]`,
  `multiplayer_route_callback_runtime_acquire_shared_string_copy` `0x590540` and
  `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0` now bound the shared
  string pool used by that decoded schema, and the higher bring-up owner `0x596090` now clearly
  splits between `[transport+0xba4]` with owner callback `0x595a40`, the local field-cache family
  `[transport+0x1724]` seeded through `0x5a08f0/0x595b60` with fixed stem `0x00629d50`, and
  `[transport+0x1164]` with owner callback `0x595bc0`. The same constructor also builds the
  `gsi_am_rating` primary-endpoint table `[transport+0x18bc]` from local transport name
  `[transport+0x60]` plus suffix `0x005dccfc` under callback `0x595e10`, and seeds the queued
  descriptor family `[transport+0x1e7c]` through `0x5a08f0/0x595f70` with fixed stem
  `0x00629d54`, while
  `multiplayer_transport_route_callback_table_service_receive_decode_state_machine` `0x5908c0`
  is the current live receive/decode state machine serviced by `0x591290` in table states `2/3`.
  The callback-owner mode split above that runtime is now explicit too: append-notify `0x590370`
  publishes mode `0`, compact upsert `0x590d00` publishes mode `1`, remove-notify `0x590430`
  publishes mode `2`, and the live receive/decode path `0x5908c0` publishes modes `6`, `5`, and
  `3`.
  The route-handle lifecycle above that decode path is tighter now too: `0x590740` cleanly resets
  one table's live route plus decode-side runtime without destroying the outer object; `0x5907a0`
  is the broader destroy path that also releases the active descriptor collection; `0x590ed0`
  now reads as the real open-and-request owner rather than a generic connect wrapper: it bounds
  both caller route-name strings to `0x100` bytes, stores the caller route-mode or flag dword into
  `[this+0x5b4]`, seeds one staged request with fixed selector bytes `2/1/3`, appends
  `[this+0x4a8]`, the route-label buffers `[this+0x0c]` and `[this+0x2c]`, the local label band
  `[this+0x6c]`, the caller route strings, the converted host-order route scalar, and two optional
  flag-driven branches, then sends that request through the live route handle at `[this+0x4a0]`
  before seeding state `3` and the staged receive buffer; `0x5911e0` is the state-`2/3`
  live-socket service wrapper, and it is tighter now than a generic feed loop: once one full frame
  is buffered it switches on subtype byte `[frame+0x02]`, using subtype `1` for
  `0x590c00` schema-dictionary rebuild, subtype `2` for `0x590d00` compact-descriptor upsert,
  subtype `3` for raw payload forward through `0x5b3216`, and subtype `4` for `0x590cd0`
  descriptor removal by primary endpoint before compacting the tail back to the front of the
  receive buffer; `0x5912c0` is the
  one-shot send-with-reopen-retry helper; and `0x590ea0` is the shared disconnect publication and
  reset tail. The recurring service helper `0x591290` is tighter too: it now first clears the
  staged intrusive descriptor list through `0x590490` before entering the state-driven seed-or-
  receive branch. The upstream owners are tighter too: `0x5962e0` is now the field-subscription
  route-table opener above `[transport+0xba4]`: it clears prior field-subscription runtime,
  releases any live route on that table, builds the route label from either the optional suffix
  path or the default stem block, seeds the field-cache family `[transport+0x1724]` with fixed key
  ids `1` and `0x0b`, appends per-field selector names from `0x00629958`, and then opens the live
  route in mode `4` through `0x590ed0`. Success seeds cached progress percentage
  `[transport+0x1774] = 1` and immediately enqueues one mode-`3` field snapshot through `0x592b50`;
  failure falls back through the same clear path. `0x596530` is the `gsi_am_rating` reopen
  path above `[transport+0x18bc]`, and that owner is tighter now too: when precondition
  `[transport+0xba0]` is clear it does not even attempt the reopen and instead stamps
  `[transport+0x1ed4] = 1`; otherwise it resets the am-rating route family, clears the callback
  table rooted at `[transport+0x18bc]`, tries `0x590ed0(mode 4)` from stored route label
  `[transport+0x1ed0]`, and only on success sets `[transport+0x1ec4] = 1` while clearing
  `[transport+0x1ed4]`. On that latter
  branch, `0x590dc0` is now bounded as the
  state-`0` raw-endpoint seed pass over the live route handle, repeatedly pulling endpoint tuples
  through `0x58bc7e` record type `0x1f3` before stamping descriptor flag byte `0x15` with `0x11`.
  That makes the remaining source-flag meaning narrower too: current evidence now supports reading
  byte-`0x15` bit `0x1` as a primary-endpoint-seed or endpoint-only marker. In the `gsi_am_rating`
  dispatcher, clear-bit descriptors can take the richer direct transition lane, while set-bit
  descriptors are staged through the queued enrichment path and still suppress that direct
  transition even after the ready bit arrives. The later modes in `0x595e10` are tighter now too:
  mode `3` forces route mode `2` only when the primary-endpoint table is empty, mode `4` stamps
  `[transport+0x1ed4] = 1` and then picks route mode `1` or `3` based on whether deferred
  descriptor pointer `[transport+0x1ed8]` is null, and mode `5` mirrors staged companion dword
  `[transport+0x490]` into both `[transport+0x54]` and `[transport+0x1724+0x24]`.
  The adjacent capacity-descriptor side is tighter too: `0x595bc0` is now clearly the owner
  callback for the capacity-descriptor route callback table rooted at `[transport+0x1164]`, not a
  direct transport method on `ecx = transport`. The route-callback-table constructor `0x5905e0`
  installs it with owner cookie `transport`, and the live route machinery later invokes it from
  append-notify `0x590370` and decode-service `0x5908c0/0x5911e0` with `ecx = table object`, the
  route descriptor or special decode frame on the stack, and the transport cookie on the stack.
  Inside that callback it still always reads `[transport+0x1778]` first. Modes `3/5` consume that
  sidecar immediately, while live mode `0` first resolves primary IPv4 plus `hostname`,
  `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` through `0x58d1f0`, `0x58d170`, and
  `0x58d6d0`, and only then forwards those live payload lanes together with the same sidecar
  triplet `[+0x0c/+0x10/+0x18]` into opcode-`2` builder `0x592ae0`. So mode `0` is not a
  sidecar-free fallback; it still requires the borrowed sidecar before it can publish the
  populated descriptor block. The replay-linked modes `3/5` instead enqueue an all-zero
  descriptor payload while preserving only that same borrowed callback-wrapper triplet and then
  unlinking the cached record through `0x5933a0`; and its callback modes `1/2/6` are now explicit
  no-op fallthroughs. That sidecar at `[transport+0x1778]` is tighter now too: current evidence says it behaves as one cached pointer
  into the transient work-record family at `[transport+0x1780]`, because every meaningful branch
  in `0x595bc0` reads the same `+0x0c/+0x10/+0x18` metadata triplet and replay modes later consume
  the pointer through `0x5933a0`. The negative result is stronger too: local text-side xrefs still
  show no direct store to `[transport+0x1778]`, and a wider local sweep also failed to show any
  obvious `lea`-based replay-band writer. The transient-request lifecycle tightens that further:
  `0x593330/0x593370/0x593380/0x5934e0/0x5933a0` now fully bound `[transport+0x1780]`, `0x1784`,
  and `0x1788` without ever touching `[transport+0x1778]`, and the neighboring active-opcode reset
  helper `0x5929a0` is likewise scoped only to `[transport+0x17fc]`. A broader constructor and
  teardown pass tightened that further too: `0x596090`, `0x5961b0`, and `0x5962e0` all touch the
  neighboring replay-band fields without ever seeding `[transport+0x1778]`. A full-binary
  literal-offset sweep tightens it further still: the only direct `0x1778` hit in `RT3.exe` is
  the read in `0x595bc0`. One nearby ambiguity is now closed too: the
  mode-`5` mirror path in `0x595a40` and `0x595e10` does not target `[transport+0x1778]`; it
  writes `[transport+0x54]` and mirrors the same staged route companion dword only into queue-side
  slot `[transport+0x1724+0x24]` through `0x005a0940`. So the sidecar writer remains upstream of this
  leaf publisher. Mode `0` is now also tied more cleanly to the generic descriptor append-notify lane
  at `0x590370`, while mode `2` stays outside this helper as the separate
  remove-notify-and-stage path at `0x590430`. The opcode-`2` payload boundary is tighter too:
  `0x592ae0` now grounds that payload
  as a seven-dword block with an owned string slot at `+0x08`, so live mode supplies a populated
  payload while modes `3` and `5` deliberately enqueue an all-zero payload and reuse only
  the wrapper-side sidecar metadata. Those two modes are tighter now too: they are the live
  receive-state owner callbacks emitted by `0x5911e0 -> 0x5908c0`, not loose generic replay
  guesses. So those paths are better read as delayed metadata replays over one cached work record,
  not over a separate anonymous cache blob. The neighboring
  capacity-owner split is tighter now too: `0x595bc0` only stages descriptor records for modes
  `0`, `3`, and `5`; the upstream route-callback-table owner still delivers modes `1`, `2`, and
  `6`, but those are explicit no-ops in this capacity leaf. So the owner wiring itself is no
  longer the open edge; only the upstream sidecar producer remains unresolved. The neighboring
  work queue is tighter too: `0x593330/0x593370/0x593380` now bind `[transport+0x1780]` as the
  construct/clear/destroy owner family and explicitly treat `[transport+0x1784]` and
  `[transport+0x1788]` as the queued-work and completed-work counters beside that collection,
  while `0x5933a0`, `0x5934e0`, and `0x593570` ground the remove, allocate, and completion side
  over that same queue. The completion owner is tighter now too: `0x593570` clears in-flight
  latch `[transport+0x44]`, stores the final attach result in `[transport+0x48]`, stamps current
  route scalar `[transport+0x50]` from `0x58f450` on success, refreshes local name buffer
  `[transport+0x04]` from `0x58e630`, republishes the staged metadata triplet through opcode-`1`
  trigger wrapper `0x592a40`, and only then unlinks the consumed work record. When validation of a
  nominal success fails through `0x58d7e0/0x58d810`, the same owner still replays that callback
  trigger but also arms deferred reset latch `[transport+0x1edc]`. The small sibling
  `0x593400` is tighter too: it is a pure work-record uniqueness predicate over field `+0x0c`. Its caller is
  tighter now too: `0x58d720` is an immediate-drain quiescence gate over one transport context id,
  using `0x593400` for the queued work family at `[transport+0x1780]` and `0x592970` for the
  active opcode-record collection at `[transport+0x17fc]`. The strongest current read is that
  `0x5934c0` seeds that shared drain context id first, then the transport copies it into queued
  work field `+0x0c` and active opcode-record field `+0x14` before the immediate-drain roots wait
  on one shared disappearance test rather than on a vague settle loop. The currently grounded
  roots are `0x58df20`, the neighboring formatted selector-text publish path at `0x58dfb0`, and
  callback-table registration at `0x58e200`. The `0x58df20` owner is tighter now too: it seeds one
  shared context id through `0x5934c0`, gives that same id plus the caller callback wrapper to the
  fastpath `0x593d60`, and only when that fastpath declines does it fall back into `0x593170`
  using `[transport+0x04]` as the worker-side text base. Its immediate-drain tail is the same
  shared quiescence rule as the neighboring owners: pump `0x58d8d0(-1)`, then wait in `0x58d720`
  until the context id disappears from both queued work field `+0x0c` and active opcode-record
  field `+0x14`, then honor deferred-close state if `[transport+0x1ee0]` is armed and
  `[transport+0x1808]` has reached zero. The active-opcode side is tighter too: `0x5927b0`
  now bounds the per-record service-and-retire path, `0x592800` the wider context-or-idle sweep,
  `0x5929a0` the remove-by-opcode-type sweep, and `0x5929f0` the narrower opcode-`3`
  field-snapshot removal keyed by the subscribed callback-pair payload. That also corrects
  `0x595b80`, whose final cleanup is an active field-snapshot purge rather than a queued-work
  drain. The adjacent route-callback descriptor-table lifecycle is tighter too: `0x590410` now
  grounds `[table+0x5bc]` as the staged intrusive descriptor-list head, `0x590430` is the generic
  remove-notify-and-stage lane, `0x590490` releases the staged list, and `0x5904d0` releases the
  active descriptor collection before tearing that staged list down. That also makes the earlier
  `0x5962e0` “release active descriptors” step explicit. The callback-table attach side now constrains the
  same work-record metadata family a little further too: `0x593650` deliberately duplicates its
  first caller metadata dword into both fields `+0x0c` and `+0x10`, while carrying the second
  caller metadata dword in `+0x18`. The lower opcode wrappers are tighter now too: `0x592a40`
  turned out to be the explicit opcode-`1` trigger wrapper whose constructor is a no-op and whose
  active-side service is `0x5913c0`, while `0x592c40` is the real `0x08`-byte explicit opcode-`5`
  binding leaf. The earlier opcode-`4` read was just the table-indexing mistake in `0x5928a0`:
  selector `4` lands on the row at `0x5e2044`, not the row at `0x5e2034`. The producer side is tighter too:
  bound-route requests, selector-text route requests, and the type-`9` text fastpath also stage
  that same triplet through `0x5934e0`, and the fastpath shim `0x593d00` now gives the cleanest
  proof of the callback split by first copying the returned text into the transport-local name
  buffer at `[transport+0x04]`, then only re-emitting the follow-on lane when `+0x10` is nonnull,
  and finally forwarding `(+0x10, +0x18, +0x0c)` into `0x593170` as callback function, callback
  companion, and trailing drain context. So the replay-side triplet is clearly a broader
  transport callback-wrapper family, not one fixed route-only tuple. The nearby
  field-subscription side is tighter too: `0x592b50` now clearly uses `[transport+0x1774]` as a
  cached progress percentage under `[transport+0xba4]`, and `0x5962e0` seeds that percentage to
  `1` just before the first immediate mode-`3` snapshot. The nearby route-callback-table
  lifecycle is tighter now too: `0x596090` is now the real constructor-side owner for the full
  route-callback branch. It constructs `[transport+0xba4]` with callback `0x595a40`, seeds the
  companion field-cache family `[transport+0x1724]` from fixed stem `0x00629d50`, constructs
  `[transport+0x1164]` with callback `0x595bc0`, builds one fixed `0x20`-byte local route-label
  buffer from the current local transport name at `[transport+0x60]` plus format `0x005dccfc`,
  constructs `[transport+0x18bc]` with callback `0x595e10` and that stack-built label, seeds
  queued descriptor family `[transport+0x1e7c]` through `0x595f70`, clears staged payload slot
  `[transport+0xb50]`, and then sets callback-plumbing latch `[transport+0xba0] = 1`. That
  constructor now reads cleanly as pure callback-table and cache bringup: it leaves the later
  live-route entry to the dedicated open or reopen owners `0x5962e0` and `0x596530` instead of
  trying to start either live route itself. One level lower, `0x5962e0` now reads as the
  field-subscription open owner rather than a vague route
  helper: it clears the old `[transport+0xba4]` runtime, rebuilds the route label from the
  optional caller suffix plus the fixed tail word at `0x005d0b78`, materializes one callback-key
  buffer from the fixed stem `0x005e22a0..0x005e22b2`, seeds fixed field ids `1` and `0x0b`,
  appends per-field selector-name ids through `0x00629958`, opens the live route in mode `4`, and
  then seeds `[transport+0x1774] = 1` before the first immediate field snapshot. `0x596210` is the
  recurring service sweep over those same three tables plus the field-cache and queued-descriptor
  families; `0x596060` is the explicit `gsi_am_rating` runtime-and-queue reset; `0x596530` is the
  reopen-from-stored-label sibling above that same am-rating table; and `0x5965a0` is the single-shot
  status-route connect latch that sets `[transport+0xb40]` before forwarding into `0x5973d0`,
  leaving the rollback and clear path to `0x5965d0`. The matching local cleanup is tighter too: `0x595b80` is now
  explicitly the field-subscription-side live-runtime reset plus field-cache clear plus active
  opcode-`3` purge, `0x595ce0` resets only the capacity-descriptor route callback runtime at
  `[transport+0x1164]`, `0x5961b0` is the full destroy-side owner over the three tables plus both
  descriptor caches, and `0x5962c0` is the explicit staged route-callback payload clear on
  `[transport+0xb50]`. The remaining gap on the capacity side is therefore narrower: the carried
  sidecar fields themselves now read more cleanly as the cached callback-wrapper triplet reused
  elsewhere (`drain context id +0x0c`, `callback fn +0x10`, `callback companion +0x18`), and the
  negative result is stronger too: nearby replay-band fields `[transport+0x176c]`,
  `[transport+0x1770]`, `[transport+0x1774]`, `[transport+0x177c]`, `[transport+0x1780]`, and
  `[transport+0x1784]` all have direct local owners while `[transport+0x1778]` still appears only
  as the single read in `0x595bc0`; even the broader callback-owner lifecycle now skips it while
  seeding, servicing, resetting, reopening, or tearing down those neighboring tables and caches.
  The constructor now closes that local search further: `0x58dc50` bulk-zeroes the full transport
  body and still never writes a nonzero value into `[transport+0x1778]` before later explicit
  neighbor initialization. The callback-binding owner stack now tightens that boundary too:
  `0x5934e0` stages the shared work-record metadata triplet, `0x593650` binds it into the
  callback-table worker path with one fixed second worker callback and one optional first worker
  callback gated by `[transport+0x4c]`, and `0x593570` later consumes and republishes it, while
  `[transport+0x1778]` still appears only as the borrowed sidecar read in `0x595bc0`. So this
  local ownership seam is closed: within the mapped transport cluster there is no remaining
  ordinary producer to find, and the remaining source now looks like an upstream callback or worker
  handoff rather than one missing field store in the local binary. The neighboring callback-vector
  strip is explicit now too: `0x597300` is a no-op owner-callback stub, `0x597303` is the
  validated-cookie event forwarder over callback slot `[transport+0x17f0]`, and `0x597330` is the
  validated extended-payload forwarder over `[transport+0x17f4]`; both reuse the same owner
  context at `[transport+0x17f8]`. The adjacent staged-route
  capacity gate is tighter now too: `0x595d60` is not another live-route opener. It is the
  immediate bound-route fast path and capacity gate under `gsi_am_rating`. When the staged
  descriptor already matches the current live route through `0x595d00`, it returns straight
  through `0x592710`; otherwise it only reuses that same bound-route callback lane when
  `numplayers < maxplayers`. `0x595dc0` then uses that result exactly as the already-bound-or-
  capacity gate before it clears selector slot `2`, stages route-callback payload through
  `0x5958e0`, and only then re-enters route mode `0`. The live-route connect owner is narrower in
  the same way: `0x597480` mirrors success into deferred route-status flag `[transport+0x1ed8]`,
  and the later mode-`4` branch in `0x595e10` is the place that actually consumes that flag to
  choose route mode `1` versus `3`. The adjacent staged-route
  callback side is tighter too: `0x595860` is now bounded as the
  submit-result handler beneath `0x5958e0`, and the old `[transport+0xac0]` ambiguity there is now
  gone. That branch is using the already-grounded third selector-generation counter at `[0xac0]`
  together with target `[0xb48]` to decide whether staged route-callback traffic can push the
  multiplayer route-mode ladder from `2` into `3` and later `4`. The selector-view counter beneath
  that gate is tighter now too: `0x594e30` counts slot-`2` entries whose flag dword carries bit
  `0x20`, optionally filtered by the current transport name buffer. The selector-view mutation
  family under that same lane is tighter too: `0x594a30` is now the direct keyed-store remover,
  `0x594fb0` clears one selector-slot ownership pointer plus its slot-local flag dword and drops
  the whole entry when no slots remain, `0x595010` rekeys one selector-view entry under a new name
  while preserving the `0x40..` runtime band, and callback root `0x59f9c0` now reads as the
  sibling lane that clears one named selector-view slot, publishes callback slot `18`, and may
  still re-enter the route-mode setter from the same slot-`2` status and generation gates. The
  neighboring callback roots are tighter now too: `0x5950a0` clears one selector slot from every
  selector-view entry in the keyed store, `0x59fab0` is the rename or relabel sibling above
  `0x595010`, `0x59faf0` updates one selector slot's fixed sample-text buffer and refreshes the
  active selector object when present, and `0x59fb60` replaces one selector slot's name set,
  requests the default profile-key bundle for that slot, and publishes callback slot `20`. Slot
  `16` is tighter now too: current grounded caller `0x59f440` forwards the staged route-callback
  payload handle from `[transport+0xb50]` through `0x592ea0` just before route mode `5`. The
  last adjacent callback root in that block is tighter now too: `0x59fbd0` is the built-in
  per-slot profile-key query sibling. It resolves the caller selector name into one slot index,
  forwards the caller trio into `0x596b90`, and then publishes callback slot `28`; that lower
  helper indexes one slot-specific built-in string pair from `[transport+0x189c]` and
  `[transport+0x18ac]`, reuses the generic per-key handler `0x596970`, and only republishes slot
  `28` when that lower query path succeeds. The descriptor-lane installer above those callback
  roots is explicit now too: `0x59fc80` zeroes one `0x30`-byte callback table, stores the owner
  transport pointer at `[table+0x2c]`, and installs the full second selector-descriptor callback
  vector `0x59f720/0x59f850/0x59f8b0/0x59f9c0/0x59fab0/0x59faf0/0x59fc50/0x59fc20/0x59fb60/
  0x59fbd0` used by the selector-text and selector-view request owners `0x593aa0` and `0x593c40`.
  The two smaller helper slots in that same lane are now bounded as well: `0x59fc20` resolves the
  caller selector name and forwards one byte mask into
  `multiplayer_transport_set_selector_presence_mask` `0x594d00`, while `0x59fc50` resolves that
  same selector name and publishes callback slot `12` through `0x592d70`.
  The compact-header side is tighter now too: `0x58fe20` and `0x58ff20` now show that compact
  payloads always carry the primary IPv4 dword and that header bit `0x10` only gates whether the
  primary port word is inline or inherited from the owner default port. `0x58fe90` now validates
  the `0x40` inline keyed-property vector against the owner schema, and `0x58fe50` validates the
  signed-`0x80` trailing string-pair tail before decode. `0x58ff60` then grounds bit `0x02` as
  the inline secondary IPv4 dword branch, bit `0x20` as the paired secondary-port word branch with
  owner-port fallback, bit `0x08` as the compact-header auxiliary inline dword stored at
  `[descriptor+0x10]`, bit `0x40` as one inline keyed-property vector decoded through the
  property-store writers, and signed bit `0x80` as one trailing string-pair tail. The
  descriptor-state side is tighter now too: the shared queue helper at
  `0x005a09a0` stamps pending state `0x4` for the local field-cache family `[transport+0x1724]`
  and pending state `0x8` for the `gsi_am_rating` queued-descriptor family `[transport+0x1e7c]`,
  while the adjacent active-send owner `0x005a07c0` now makes the fast path explicit instead of
  looking like a missing growth helper: it stamps the descriptor into the active list, timestamps
  `[entry+0x1c]`, and immediately emits the mode-selected outbound query packet through the queue
  socket, with the secondary endpoint tuple `[entry+0x08/+0x0c]` only taking over when queue
  companion dword `[queue+0x24]` matches the primary dword and descriptor state bit `0x2` is live.
  The receive-side owner layer is tighter too: `0x005a0b40` drains queue socket `[queue+0x20]`,
  matches inbound replies against the active list's primary or secondary endpoint tuples, and then
  routes the matched entry into `0x005a0a00` for queue mode `1` or `0x005a0ad0` for the alternate
  grounded mode. The broader maintenance pass `0x005a0c80` then adds the stale-active expiry sweep
  `0x005a0c00` and the pending-to-active promotion pass `0x005a0c50`, so the ready-bit transition
  now reads as a full queue lifecycle instead of one isolated state-byte write. That makes the
  current transport-side tests cleaner:
  `0x58d1c0` is the field-cache ready gate, `0x58d1d0` is the `gsi_am_rating` queued-descriptor
  ready gate, and `0x58d230` is the remaining flag-byte split between direct primary-endpoint
  handling at `[transport+0x18bc]` and the queued path at `[transport+0x1e7c]`. That byte-`0x14`
  story is no longer queue-only either: `0x58ff60` can also OR in bit `0x1` after the inline
  keyed-property vector and bit `0x2` after the signed string-pair tail. The flag-byte split is no
  longer purely behavioral either: current evidence now says byte `[descriptor+0x15]` bit `0x1` is
  a source-side descriptor header bit, explicitly seeded during the primary-endpoint table refresh
  around `0x590dc0` and preserved by the compact descriptor decode path at `0x58ff60`, rather than
  a queue-generated runtime state. The `gsi_am_rating` dispatcher side is tighter too: that same
  bit no longer just looks like a direct-versus-queued routing split, because `0x595e10` also uses
  it to suppress the direct `0x595dc0` transition even after queued ready bit `0x2` is present.
  The descriptor body is tighter too: `[descriptor+0x20]` is now the intrusive next-link used by
  the transport-owned primary-endpoint list headed at `[table+0x5bc]`, and `[descriptor+0x1c]` is
  now the special numeric scalar behind the current `queryid`/`ping` fallback pair. That special
  numeric path now has one clearer owner too: `0x58d6a0` lazily bootstraps the shared key
  dictionary at `0x00db8b48` for the grounded strings `queryid` and `ping`, using the local
  dereferenced-string hash, compare, and release callbacks `0x58d690`, `0x58d070`, and `0x58d090`.
  The descriptor property-store seam is tighter in the same way now. The keyed store rooted at
  `[descriptor+0x18]` is allocated by `0x58d5b0` with explicit per-entry key callbacks:
  `0x58d550` releases the owned shared key/value string pair, `0x58d570` hashes the dereferenced
  key string through `0x58d510`, and `0x58d580` compares two dereferenced keys through the shared
  locale-aware casefolded compare `0x5a57cf`. The fixed-reply side above that store is no longer
  anonymous either: when queue mode-`1` reply owner `0x5a0a00` sees descriptor flag bit `0x4`
  clear, it routes the payload into `0x58d3a0`, which first consumes one backslash key/value
  prefix and then walks exactly two counted reply sections, each with its own NUL-stem dictionary;
  the later value strings are reinserted under synthetic decimal-suffixed keys built from those
  stems plus one running per-section index.
  The compact-header
  auxiliary inline dword at `[descriptor+0x10]` is tighter in a negative way too: local xref scans now
  only show it being preserved by later generic helpers like
  `generic_record_0x1c_deep_copy_with_owned_string_at_0x08` `0x591410` and the adjacent
  callback-marshaling wrappers `0x591480` and `0x591510`, not read through any dedicated semantic
  accessor yet. The mode-`5` tails in both
  callback families do not copy a descriptor-local field but instead mirror the transport-staged
  companion dword at `[this+0x490]` into `[this+0x54]` and queue-side slot `[this+0x1724+0x24]`. The
  `gsi_am_rating` maintenance lane is tighter now too: after pruning failed descriptors it sorts
  the surviving primary-endpoint table through `0x590310` in mode `1` with key `gsi_am_rating`,
  then selects the new head through `0x590480` before re-entering the route-transition path. The
  owner above that handoff is explicit now too: mode `2` in `0x595f70` requires current route mode
  `1`, no live selector object at `[transport+0x398]`, and no busy slot object at `[transport+0x38c]`;
  it refreshes every surviving endpoint entry's `gsi_am_rating`, forces route mode `2` when the
  table empties, and otherwise stages the fixed `gsi_am_rating` key for the current head entry
  before falling into `0x5958e0`; only a submit failure drops that branch back to route mode `0`,
  while success leaves the later `0x595860` callback to drive the `2 -> 3 -> 4` route-mode ladder. The
  same service loop also owns a slower sidecar lane keyed off `[entry+0xa4]`:
  `multiplayer_transport_select_stale_selector_view_progress_entry` walks the store through
  `multiplayer_transport_pick_stale_selector_view_progress_entry`, picks one stale entry whose
  progress latch `[entry+0x9c]` is clear and whose last progress tick `[entry+0x70]` is old enough,
  and then hands it to `multiplayer_transport_stage_selector_view_progress_snapshot`. That helper
  now looks more bounded too: it rebuilds the core `X%sX` marker text from `[entry+0x50]` through
  `multiplayer_transport_format_selector_view_probe_marker_core`, formats one `PNG %s %d` line
  around that marker and the entry-local averaged millisecond sample at `[entry+0x80]`, appends bounded
  selector-slot `PNG` fragments for live overlapping slots, marks progress-snapshot state in flight
  at `[entry+0x9c]`, and stamps both `[entry+0x70]` and the transport-wide throttle tick
  `[transport+0xaec]`. So the selector-view sidecar no longer looks like one undifferentiated
  refresh bucket: it has a faster deferred-probe lane plus a slower progress-snapshot lane, both
  still under the shell-owned multiplayer transport cadence. The two descriptor lanes installed by
  `multiplayer_transport_submit_selector_text_route_request` are tighter in the same family too:
  when the entry-local marker text at `[entry+0x9ac]` is empty, the request path falls back to
  `multiplayer_transport_format_selector_view_probe_marker_fallback_with_fixed_template_0x5e2350`
  `0x597710` before handing the text into `0x593c40`. The parser split is explicit now too:
  `multiplayer_transport_parse_selector_view_probe_marker` `0x5977b0` consumes the wider
  `X%sX|%d` form, while
  `multiplayer_transport_try_parse_selector_view_probe_marker_core` `0x597860` only decodes the
  wrapped request-id from the shorter sentinel form and leaves any decimal tail to the caller. The
  linked pending-template strip is tighter in the same way: after
  `multiplayer_transport_unlink_pending_template_node` removes a node from the list rooted at
  `[transport+0x550]`, it now tails into
  `multiplayer_transport_release_pending_template_node` `0x597960`, which frees the node-owned
  payload graph, both selector strings, and the node body itself.
  The two descriptor lanes installed by
  `multiplayer_transport_attach_callback_table_descriptor` are now tighter too. The first lane
  rooted at `0x59f5c0` can arm deferred-close state on the owner transport and then forward through
  callback slot `23`. The second lane is no longer just a loose selector-view bucket:
  `multiplayer_transport_callback_dispatch_selector_name_payload_lane` at `0x59f650` classifies
  selector payloads through `multiplayer_transport_is_selector_control_line`, routes `@@@NFO`
  control lines into `multiplayer_transport_sync_selector_view_nfo_r_flag`, and otherwise publishes
  either callback slot `13` or the split token-plus-tail callback slot `14` through
  `multiplayer_transport_split_selector_payload_token_and_tail`. That local `@@@NFO` helper is now
  bounded more tightly too: it only accepts lines ending in the literal `X\` tail, searches for the
  field marker `\$flags$\`, and then sets or clears bit `0x2` in the third selector-slot flag word
  at `[entry+0x64]` depending on whether that field contains the letter `r` before the next
  backslash. The sibling `multiplayer_transport_callback_dispatch_current_selector_payload_lane` at
  `0x59f720` first resolves the active selector through `0x5951a0`, then handles the
  current-selector variants of the same control vocabulary: `@@@NFO` continues into the same local
  `r`-flag sync helper, `@@@GML` plus mode-`3/4` payloads feed the shared control-token helper
  `multiplayer_transport_handle_gml_or_png_selector_control`, and the remaining non-control payloads
  publish callback slot `9`. That shared helper now narrows the `GML` and `PNG` split materially:
  when the token is `GML` and the tail is `Disconnected`, it requires the active selector-view entry
  to pass `multiplayer_transport_selector_view_entry_has_gml_disconnect_gate`, which currently means
  the entry participates in the third selector slot and has bit `0x20` set in `[entry+0x64]`, before
  it forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`. Its
  sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry
  overlaps the active selector-slot ownership, refreshes selector-view runtime state through
  `0x5948f0` and republishes callback slot `25`. Alongside those dispatchers, one grounded branch at
  `0x59f560` still updates selector-view runtime state through `0x5948f0` and forwards the same
  selector-name pair through callback slot `25`, while `0x59f850` resets selector text state through
  `0x5954b0`, forwards through callback slot `19`, and when selector `2` is active in a nonterminal
  route mode re-enters `multiplayer_transport_set_route_mode` with mode `1`. The low-level route
  helper still looks like a two-part cycle:
  `multiplayer_gamespy_route_service_retry_and_keepalive_timers` handles challenge or retry pressure
  and periodic outbound control traffic around the `master.gamespy.com`, `PING`, `natneg`,
  `localport`, `localip%d`, and `statechanged` strings, while
  `multiplayer_gamespy_route_drain_inbound_packets` drains inbound datagrams and dispatches
  semicolon lines, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The
  outbound side is tighter now too: `0x0058cd40` is the shared decimal-text appender beneath both
  the route builders and the shell-side status publishers; `0x0058c950` is the dedicated
  field-class-`8` `PING` sender that refreshes `[route+0xac]`; and `0x0058cd70` is the broader
  mode-selected control-packet owner that appends `localip%d`, `localport`, optional
  `statechanged`, the route-name text, and then either the encoded three-slice suffix through
  `0x0058c300` or a bare terminator before `sendto`. The read side is tighter too:
  `0x0058f4e0` is the zero-timeout socket-readiness probe that `multiplayer_gamespy_route_drain_inbound_packets`
  uses immediately before `recvfrom`. The
  local control-payload seam is tighter now too: the immediate three-slice emitter wrapper
  `0x0058c300` packages predecoded slices as field classes `0`, `1`, and `2`, while `0x0058c340`
  decodes one length-coded three-part payload and re-emits those slices through the shared
  packet-field builder `0x0058c0c0`; that
  builder uses `0x0058c010` for the field header, `0x0058c030` for the encoded payload append, the
  RC4-style transform `0x0058bee0`, the Base64-like text appender `0x0058be50`, and the six-bit
  alphabet mapper `0x0058be20`. The same local support strip also now includes `0x0058bcb0` for
  bounded control-id list append and `0x0058bce0` for bounded C-string append into the shared
  `0x800`-byte text builders. The backslash-query side is tighter too: `0x0058c3e0` is the shared
  callback-driven field-group emitter that maps key ids through `0x00629958`, appends the key
  stems into the same builder, and then dispatches value production through callback slots
  `[route+0x88]`, `[route+0x8c]`, and `[route+0x90]` before `0x0058c5c0` adds the final
  terminator. The transport-owned callback story is now narrower too. The shared route constructor
  `multiplayer_gamespy_route_construct_and_seed_callback_vector` seeds `[route+0x88]` through
  `[route+0x9c]` from the caller-supplied transport callback table, records the owner transport at
  `[route+0x104]`, and explicitly zeroes `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before
  any later patch-up. For the transport-owned status route,
  `multiplayer_transport_try_connect_status_route` then seeds the six-entry callback vector
  `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0`, chooses either default route id
  `0x1964` or the caller route id, copies stored route-label pointer `[transport+0x9a8]` into
  `[transport+0xb3c]`, and patches `[route+0xa0]` through
  `multiplayer_gamespy_route_set_extended_payload_callback` to point at
  `multiplayer_transport_forward_validated_extended_route_payload` `0x00597330`, which simply
  forwards the validated payload wrapper into the owner callback at `[transport+0x17f4]` with
  context `[transport+0x17f8]`; success also clears `[transport+0xb38]`. The adjacent owner strip
  is now explicit too: `0x597350` releases the auxiliary status route, `0x597370` services that
  route alone through the shared low-level tick helper, and `0x597380` is the broader recurring
  sweep that services both the status route and the current live route. The connect-side endpoint
  setup is tighter now too:
  `0x0058f540` resolves the current local hostname into one hostent, `0x0058bd50` copies up to
  five local IPv4 dwords from that hostent into the global table at `0x00db8a28`, and
  `0x0058bd90` builds one `sockaddr_in` with `AF_INET`, `htons(port)`, direct dotted-quad parse,
  and host-name fallback. In the grounded status-route path,
  `multiplayer_transport_try_connect_status_route` formats `%s.master.gamespy.com`, uses port
  `27900`, and feeds that pair through `0x0058bd90` before the route opens its UDP handle. The
  local bind side is tighter too: `0x0058cb50` opens a UDP socket, retries a `0x64`-wide local
  port range or an ephemeral bind through the same sockaddr helper, normalizes literal
  `127.0.0.1` to `INADDR_ANY` before `bind`, and returns both the live socket and chosen local
  port; `0x0058cc40` is the wrapper above it that hands that socket and port into
  `multiplayer_gamespy_route_construct_and_seed_callback_vector` and then marks `[route+0xbc] = 1`
  on the resulting object. The startup or teardown calls around that path are now explicit too:
  `0x0058f470` is the local `WSAStartup(0x0101, ...)` guard and `0x0058f490` is the matching
  `WSACleanup` wrapper. The direct Winsock thunk strip under the same family is now mostly named
  too: `0x0058bc42/48/4e/54/5a/60/6c/72/78/7e/8a` line up with `gethostbyname`, `gethostname`,
  `closesocket`, `sendto`, `htons`, `htonl`, `socket`, `WSACleanup`, `WSAStartup`, `recvfrom`,
  and `bind`, while `0x0058bc3c` is the dotted-quad conversion thunk used under the `localip%d`
  builder path. The local-address selection side is narrower too: `0x0058d750` resolves the same
  hostent list and picks the first private or loopback IPv4 through `0x0058f580` before the
  transport-side bring-up path consumes it. The grounded live-route connect path at
  `multiplayer_gamespy_udp_global_callback_worker_bootstrap` now sits beside that route layer as a
  separate helper family rather than more route-object state. `0x0059fe30` resolves an optional
  host and port into a stack `sockaddr_in`, and `0x0059fe8e` then opens the global UDP socket
  `0x00629f28`, applies `SO_REUSEADDR`, and binds that prepared address. `0x005a0000` seeds the
  callback-state globals `0x00db9fd8..0x00db9ffc`, allocates the timeout-registration vector
  `0x00db9ff0` and queued-callback vector `0x00db9fec`, and optionally opens the socket
  immediately; `0x005a0120` is the matching shutdown path. The control-packet codec under that
  worker is explicit too: `0x0059fd00` accepts only fixed `0x91/0x01` packets with kind `1..3`
  and an optional trailing `0x18`-byte payload, while `0x0059fdc0` emits that same `0x20`-byte
  packet shape back through `sendto`. The kind handlers above it are now bounded as well:
  `0x005a0200` handles kind `1` by issuing the kind-`2` reply and optionally staging one
  timeout-registration record, `0x005a02f0` handles kind `2` by resolving that staged
  registration, optionally emitting kind `3`, and queuing the completed callback, and `0x005a03d0`
  is the shorter kind-`3` completion path. `0x005a0440` is the dispatch switch over those three
  packet kinds. The receive and timeout side now reads coherently too: `0x005a0490` waits on the
  global socket, drains one datagram through `recvfrom`, timestamps it, decodes it, and dispatches
  it; `0x005a0550` then sweeps expired timeout-registration records from `0x00db9ff0`, optionally
  queuing timeout callbacks through `0x0059fef0`; and `0x0059ff70` drains and frees the queued
  callback vector `0x00db9fec`. So `0x005a05d0` now reads cleanly as the one-shot service tick for
  the whole global UDP callback worker rather than another anonymous transport loop. One layer
  higher, `0x005a0600` is the synchronous send-side owner over that same worker: it emits the fixed
  kind-`1` query packet, stages one timeout-registration record, and can then pump
  `0x005a05d0` plus `Sleep(1)` until the registration clears before draining the queued callbacks.
  The immediate queue-side support strip is explicit now too: `0x005a0700`, `0x005a0720`,
  `0x005a0740`, `0x005a0760`, and `0x005a07b0` are the append, prepend, pop, remove, and clear
  helpers for the intrusive list family that links nodes through offset `+0x20`, and
  `0x005a08f0` is the constructor-side queue bootstrap that opens the queue-owned UDP socket and
  clears the active and pending list roots. The grounded
  live-route connect path at
  `multiplayer_transport_try_connect_live_route` now matches the status-route side on the main
  callback seam: after a successful connect it also patches `[route+0xa0]` through
  `0x58bc90 -> 0x597330`. The remaining negative boundary is narrower now: current local evidence
  still does not show matching post-construction writes to `[route+0xa4]` or `[route+0xd4]`, and
  the higher route-mode state machine now looks consistent with that. `multiplayer_transport_set_route_mode` first applies one pre-dispatch gate:
  when a bound route still exists at `[this+0x1ec8]`, requested mode `2`, and selector slot `2`
  is not active, it submits one bound-route status request through `0x5959e0`. That request itself
  is now narrower too: it derives one request token from the current binding through `0x5934c0`,
  then forwards binding dword `[route+0x2c]`, binding word `[route+0x30]`, local counter
  `[this+0xb48]`, and default sample text `0x005c87a8` into `0x593980` using completion callback
  `0x595980`, and a submit failure immediately sets `[this+0x1ed8]` so the route-mode owner can
  fall back without waiting for the callback. That callback is tighter now too: nonzero results
  force mode `2` when `[this+0xac0] <= 1` and otherwise promote through mode `3` or `4` according
  to `[this+0xb48]`, while zero results set `[this+0x1ed8] = 1` and then fall back through route
  mode `0` or `1` according to deferred am-rating latch `[this+0x1ed4]`. On success the route-mode setter stores the current
  mode at `[this+0x18b8]`, mirrors mode changes into the bound-route callback lane through
  `multiplayer_transport_enqueue_bound_route_mode_snapshot_opcode4_if_live` `0x5932a0`, and then
  runs one of the concrete branches: mode `0` releases the current
  live route, resets selector slot `2`, and only when the am-rating route is not already live at
  `[this+0x1ec4]` tries to reopen the `gsi_am_rating` callback-table family through `0x596530`;
  a failed reopen then falls back according to deferred route-status flag `[this+0x1ed8]`. Mode
  `1` conditionally reopens that am-rating family only when both `[this+0x1ec4]` and
  `[this+0x1ed4]` are clear and then, when no live route is present, tries to connect the live
  route through `multiplayer_transport_try_connect_live_route` `0x597480`; once that family is already populated, the later callback-owner at
  `0x595f70` takes over by pruning stale entries, refreshing `gsi_am_rating`, selecting the
  current head endpoint, and staging the route-callback payload through `0x5958e0`. Mode `2`
  first releases any stale live route through `multiplayer_transport_release_live_route`
  `0x5973b0` when status latch `[this+0xb40]` is clear, then resets the am-rating family and
  promotes a successful live-route connect into mode `1`. Mode `3` resets the am-rating family,
  releases the live route through `0x5973b0`, resets selector slot `2`, and then tears down the
  current bound-route payload through
  `multiplayer_transport_release_current_route_binding_detach_descriptor_callback_and_clear_slot`
  `0x595620`; mode `4` is the narrow status-route recovery retry; and mode `5` resets the
  am-rating family, releases the live route through `0x5973b0`, and runs that same
  `0x595620` teardown path without the selector-slot reset. That helper is narrower than the older
  generic wording implied: it detaches the current binding from route-label object `[this+0x1ed0]`
  through `0x58f3c0`, releases the staged bound-route callback payload at `[this+0x1ec8]` through
  `0x5933a0`, and only then clears `[this+0x1ec8]`. The status-route connect path is tighter now too:
  `0x5973d0` seeds `[this+0xaf4]`, uses the same six callback lanes, mirrors stored route label
  `[this+0x9a8]` into `[this+0xb3c]`, patches the created route's extended-payload callback slot,
  and clears `[this+0xb38]` on success; when the caller route id is not `-1` it also zero-extends
  the supplied route word before forwarding it into `0x58c9b0`. The local status-route helper
  strip is explicit too: `0x597350` releases `[this+0xaf0]` through `0x58cfd0`, `0x597370`
  services only that route through `0x58cf90`, and `0x597380` is the broader two-route sweep that
  services `[this+0xaf0]` and `[this+0x1ecc]` through the common route-object service helper
  `0x58d040`. The live-route connect path is tighter in the same way:
  `0x597480` builds one `0x20`-byte local identifier from `[this+0x60]` plus suffix template
  `0x005dccfc`, seeds the callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0`,
  and chooses either the default route id `0x1964` through `0x58cc40` or the binding-specific id
  in `[binding+0x30]` through `0x58c9b0`; on the binding-specific path it also clears pending
  rebuild cookie `[binding+0x34]` and marks the constructed route live via `[route+0xbc] = 1`,
  while the success tail mirrors stored route label `[this+0x9a8]` into `[this+0xb3c]`, patches
  `[route+0xa0]` through `0x58bc90 -> 0x597330`, and clears live-route mode mask `[this+0xb38]`.
  The callback boundary is closed more tightly now too: current local evidence still does not show
  companion writes to `[route+0xa4]` or `[route+0xd4]` in either grounded transport-owned connect
  path, so the stable transitions still switch by releasing route objects or route bindings and
  rebuilding route state, not by mutating those optional callback slots in place. The parser behavior is now tighter as well: semicolon lines only dispatch when
  `[route+0xd4]` is non-null, and the subtype-`6` raw fallback only dispatches when `[route+0xa4]`
  is non-null. For the currently grounded transport-owned status and live routes, those two branches
  therefore stay intentionally inactive and can cleanly no-op instead of implying a hidden mandatory
  transport callback path. Inside the packet parser, subtype `4` is no longer an unknown callback hop: after cookie
  validation it dispatches through `[route+0x9c]`, which the transport-owned status and live routes
  seed to `multiplayer_transport_handle_validated_route_cookie_event` `0x005972c0`. That helper
  either marks route progress and re-enters `multiplayer_transport_set_route_mode`, or forwards the
  event id plus payload into the owner callback at `[transport+0x17f0]` with context
  `[transport+0x17f8]`. The surrounding status-route callback vector is tighter now too:
  `0x005970e0` publishes either the active selector text or the averaged probe sample at
  `[entry+0x80]` and otherwise falls back to owner callback `[transport+0x17e0]`;
  `0x00597180` is a straight owner-forwarding lane through `[transport+0x17e4]`;
  `0x005971b0` seeds the local status-control id list and can then notify owner callback
  `[transport+0x17e8]`; and `0x00597270` returns the third selector-slot generation counter
  `[transport+0xac0]` on its bounded local branch before falling back to owner callback
  `[transport+0x17ec]`. Subtype `6` still validates the same cookie, dedupes one 32-bit cookie or
  packet id, and then dispatches the trailing payload through the natneg-or-raw callback layer
  rooted at `[route+0xa0]` and `[route+0xa4]`; for the grounded transport-owned status and live
  routes that currently means validated NATNEG-style payloads forward through `0x00597330` on
  `[route+0xa0]`, while the raw fallback stays disabled because `[route+0xa4]` remains null. This
  separates the shell-frame preview refresh at
  `0x006cd8d8` from the actual transport cadence at `0x006cd970`, and also separates that transport
  cadence from the lower GameSpy route-service and packet-parser layer beneath it.
- Evidence: `function-map.csv`, `pending-template-store-management.md`,
  `pending-template-store-functions.csv`, plus objdump caller traces showing
  `multiplayer_window_service_loop` reaching `multiplayer_flush_session_event_transport` and the
  transport pump chain `multiplayer_flush_session_event_transport ->
  multiplayer_transport_flush_and_maybe_shutdown -> multiplayer_transport_service_frame ->
  multiplayer_transport_service_worker_once -> multiplayer_transport_drain_request_text_queue`.
- Closure note: the older broad request-id question is now replaced by the grounded lane split
  already exposed above. `multiplayer_dispatch_requested_action` bounds the outer
  `Multiplayer.win` action family, while the concrete transport submit owners are the bound-route
  status lane `0x5959e0 -> 0x593980`, the selector-text route-request lane `0x593c40`, and the
  second selector-descriptor callback lane rooted at `0x59fc80`. The preview-dataset reuse
  boundary is also closed at the current evidence level: beyond `Multiplayer.win`, the same owner
  family is reused by the `.gmt` save-mode hook in `0x00445de0`, `BuildingDetail.win` auxiliary
  sync, `Start New Company...` side-owner submission, `CompanyDetail.win` async multiplayer
  actions, and dataset-side selector or update branches, but not by a broader ordinary
  world-service path.