| 1 | address | size | name | subsystem | calling_convention | prototype_status | source_tool | confidence | notes | verified_against |
|---|
| 2 | 0x004010f0 | 521 | city_compute_connection_bonus_candidate_weight | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Computes one city-side weight for the connection-bonus news and placement lanes. The helper rejects early when the city subtype field `[this+0x23e]` is nonzero, then builds a base float from the city-side scalar fields `[this+0x306]`, `[this+0x30a]`, and `[this+0x30e]`. When the optional stack company id is nonzero it also resolves the city's derived coordinates through `0x00455800` and `0x00455810`, probes the live world root at `0x0062c120` through `0x0044e270`, and rejects the city unless the selected company passes the follow-on world-side ownership or access check through `0x00424010`. The helper then scans the live placed-structure collection at `0x006cec20`, filters peers through `0x0041f6e0` plus the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, counts qualifying linked sites in the city, and detects whether one rival company already has an eligible linked site there. The final weight is scaled down by the inverse of `(qualifying_site_count + 1)` and then further damped when rival ownership is present, so the current grounded meaning is a city connection-bonus opportunity weight rather than a simple population or size score. Current grounded callers are the company-side news sweep at `0x00406050` and one neighboring setup-side branch at `0x00404d90`. | objdump + caller xrefs + callsite inspection + city-bonus correlation |
| 3 | 0x004014b0 | 1194 | company_try_buy_unowned_industry_near_city_and_publish_news | simulation | thiscall | inferred | objdump + callsite inspection + RT3.lng strings | 2 | Company-side acquisition and headline helper beneath the broader periodic company service pass at `0x004019e0`. The function requires at least two linked transit sites through `company_count_linked_transit_sites` `0x00426590`, rejects when scenario finance toggle `[0x006cec78+0x4abf]` is set, and then scans the live building or structure collection at `0x0062b26c` for the best current acquisition target. Current grounded candidate filters are: the record must not already have an owner in `[site+0x276]`, its linked candidate subtype gate through `0x0040d360` must identify subtype `4`, the company-specific price or affordability metric from `0x0040d540` must stay below the current company metric window, and the record must be at least three years old from `[site+0x3d5]`. Surviving candidates are scored through local profitability or demand helpers around `0x0040cac0`, `0x0042c820`, `0x00455f60`, and the current company support scalar, and the best surviving site id is then committed through `0x004269b0`. On success the helper localizes the acquired structure type through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`, resolves the nearby city or region entry through `0x004220b0`, and emits RT3.lng `2880` `%1 has bought a %2 near %3` through the shell news helper at `0x004554e0`. This is now the strongest current match for the acquisition-side sibling beneath the broader company periodic pass, though some lower structure-side helper semantics remain open. | objdump + callsite inspection + RT3.lng strings + acquisition-news correlation + structure-scan correlation |
| 4 | 0x00401860 | 221 | company_query_cached_linked_transit_route_anchor_entry_id | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Returns one cached route-entry anchor id used by the linked-transit company cache family. The helper first validates the cached id at `[this+0x0d35]` against the live route-entry collection `0x006cfca8`, requiring the resolved record to carry this company id in word `[entry+0x22e]` and byte value `2` in `[entry+0x216]`; otherwise it clears the cache to `-1`. When the cache is empty but the three company-side count lanes `[this+0x7664]`, `[this+0x7668]`, and `[this+0x766c]` still sum positive, it scans the route-entry collection for the first record that satisfies those same owner and class predicates and then caches the record's linked anchor id from `[entry+0x202]`. Current grounded caller is `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`, where the returned route-entry id is used as the company-side anchor for the narrower linked-transit reachability gate. | objdump + caller xrefs + callsite inspection + route-entry-anchor correlation |
| 5 | 0x00401940 | 152 | company_reset_linked_transit_caches_and_reseed_empty_train_routes | simulation | thiscall | inferred | objdump + callsite inspection + linked-transit correlation | 2 | Small linked-transit reset helper beneath the broader company service family. The function clears the two company-side linked-transit cache timestamps at `[this+0x0d3e]` and `[this+0x0d3a]`, immediately re-enters `company_service_linked_transit_site_caches` `0x00409720`, and then walks the live train collection `0x006cfcbc` for company-owned trains. For owned trains in operating modes `0x0a` or `0x13` it removes every existing route-list entry through `train_route_list_remove_entry_and_compact` `0x004b3000`; when the route list is empty it then re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770`. Current grounded meaning is a local linked-transit cache reset plus empty-route reseed pass rather than a broader train-service sweep. | objdump + callsite inspection + linked-transit correlation + train-route-reset correlation |
| 6 | 0x004019e0 | 611 | company_service_periodic_city_connection_finance_and_linked_transit_lanes | simulation | thiscall | inferred | objdump + callsite inspection + caller correlation + RT3.lng strings | 2 | Broader periodic company-side service pass above the currently grounded city-connection, finance, and linked-transit lanes. The helper first rejects inactive or special-case companies through `[this+0x3f]` and `0x00425b90`, clears the transient company-side latches at `[this+0x0d17]`, `[this+0x0d18]`, and `[this+0x0d56]`, and temporarily mirrors one locomotive-derived byte from `[this+0x0d17]` into scenario field `[0x006cec78+0x4c74]` while the earlier route-building side of the body runs, restoring the original scenario value on exit. Current evidence now bounds those byte latches more narrowly: `[this+0x0d17]` is this transient route-search preference override, currently seeded only when `company_select_preferred_available_locomotive_id` `0x004078a0` resolves one locomotive whose engine-type dword `[record+0x10]` equals `2`; wider engine-type evidence now makes that best-read as the electric lane, since the linked approval helper around `0x0041d550` dispatches the same `0/1/2` field across three scenario opinion slots while the local language family `706..709` and help text `3848` bound the player-facing triplet as `Steam`, `Diesel`, and `Electric`. The route-search side is tighter now too: this mirrored byte is not just reusing a display preference slot abstractly, it feeds the same initial path-sweep branch in `route_entry_collection_run_initial_candidate_path_sweep` `0x0049bd40` that explicit route-policy byte `4` uses, selecting the larger `1.8` quality multiplier instead of `1.4` before the later acceptance checks. `[this+0x0d18]` is the city-connection announcement-side latch reused by `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; and `[this+0x0d56]` is the linked-transit train-service latch later set by the train-add, train-upgrade, and route-builder-side cache-refresh family around `0x00409830`, `0x00409300`, and `0x0040457e -> 0x004093d0`. The ordering matters too: this owner clears those latches up front, runs the city-connection and linked-transit branches first, and only later enters `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, so the finance helper is reading same-cycle side-channel state rather than stale long-lived flags. It then gates and schedules several narrower service families: the city-connection announcement side through `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` and `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; the acquisition-side sibling through `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`; the linked-transit train side through `company_balance_linked_transit_train_roster` `0x00409950`; the broader annual finance and governance helper through `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`; and the linked-transit cache refresh tail through either `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` or `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` depending on current scenario mode byte `[0x006cec78+0x0f]`. This name stays intentionally conservative: it is the broader periodic owner above those lanes, not a fully split policy map yet. | objdump + callsite inspection + caller correlation + RT3.lng strings + linked-transit correlation + city-connection correlation + acquisition correlation + latch correlation + sequencing correlation + temporary-route-preference correlation + locomotive-choice correlation + engine-type correlation + route-search-threshold correlation |
| 7 | 0x004078a0 | 815 | company_select_preferred_available_locomotive_id | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Selects one preferred locomotive id for the current company from the live locomotive collection at `0x006ada84`. The helper iterates the live locomotive records, applies company-and-chairman availability gating through the linked approval family around `0x0041d550`, accumulates one weighted preference score from locomotive fields `[record+0x20]`, `[+0x28]`, `[+0x18]`, `[+0x1c]`, `[+0x0c]`, and the linked class or era record at `[record+0x72]`, and keeps the strongest surviving locomotive id, falling back to `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0` when no scored candidate survives. Current grounded callers are the periodic company service pass `0x004019e0`, the temporary route-side mode chooser around `0x00402d5f`, the linked-transit train-upgrade news helper `0x00409300`, and the linked-transit train-add helper `0x00409830`. Current evidence now also bounds one route-policy side effect above it: `0x004019e0` only arms its temporary `[company+0x0d17] -> [0x006cec78+0x4c74]` override when the chosen locomotive record carries engine-type value `2` in `[record+0x10]`, which now best aligns with the electric lane rather than an unnamed class slot. | objdump + caller xrefs + callsite inspection + locomotive-collection correlation + preferred-choice correlation + engine-type correlation |
| 8 | 0x00401c50 | 3016 | company_evaluate_annual_finance_policy_and_publish_news | simulation | thiscall | inferred | objdump + callsite inspection + RT3.lng strings | 2 | Large annual company finance-policy helper beneath the broader periodic service pass at `0x004019e0`. The earliest creditor-pressure or bankruptcy lane is now bounded more tightly: it requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since the last bankruptcy stamp at `[this+0x163]`, and at least `4` years since founding year `[this+0x157]`. It then scans the last three years of derived finance lanes through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, accumulating the net-profits lane `0x2b`, counting one three-year failure condition from the revenue aggregate `0x2c`, selecting one negative cash-and-debt stress ladder `-600000 / -1100000 / -1600000 / -2000000` from the current slot-`0x2c` band split at roughly `120000 / 230000 / 340000`, requiring the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` to be at least `15` or `20` depending on whether all three years failed, checking the current fuel-cost lane in slot `0x09` against `0.08` times that ladder, and requiring both `edi >= 2` plus the three-year slot-`0x2b` accumulator to clear one final `-60000` threshold before it commits bankruptcy through `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90` and formats RT3.lng `2881` `%1 has declared bankruptcy!`. The helper also has one later deep-distress fallback bankruptcy lane on the no-action fallthrough before the build-`1.03+` stock-issue branch: with the same bankruptcy toggle clear, current cash below `-300000`, at least `3` years since founding, no recent automatic finance action already chosen, the first three recent net-profits lanes each at or below `-20000`, and at least `5` years since the last bankruptcy stamp, it commits the same bankruptcy path and news family again. The later debt-capital restructuring family mutates the live company through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, `company_issue_bond_and_record_terms` `0x004275c0`, `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and `company_issue_public_shares_and_raise_capital` `0x00427450`, then formats the RT3.lng `2882..2886` headlines `%1 has refinanced %2 of debt.`, `%1 has refinanced %2 of debt and borrowed %3 on top of that.`, `%1 has refinanced %2 and paid off a further %3 of debt.`, `%1 has paid off %2 of its debt.`, and `%1 has borrowed %2 in debt.` The message-side tail is tighter now too: it accumulates total retired principal in one counter and total newly issued principal in another, then chooses the debt headline family by comparing those two totals directly: equal -> `2882` refinance only, issued greater -> `2883` refinance plus extra borrowing, retired greater -> `2884` refinance plus additional payoff, issued zero -> `2885` debt payoff only, and retired zero with issued positive -> `2886` straight new borrowing. The middle annual bond lane is tighter now too: when the bond toggle `[+0x4a8b]` is clear, it first simulates full bond repayment through repeated `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, then uses the resulting cash-side window with the fixed `-250000` and `-30000` thresholds plus the broader linked-transit train-service latch `[this+0x0d56]` to decide whether to stage one or more `500000` principal, `30`-year bond issues through `company_issue_bond_and_record_terms` `0x004275c0`. The repurchase lane is distinct from the later share-issue path: when the city-connection announcement-side latch `[this+0x0d18]` is set, editor growth setting `2` does not suppress it, and the stock toggle `[+0x4a87]` is clear, it starts from one `1000`-share batch and one default factor `1.0`, can replace that with a linked-chairman personality scalar `([table byte * 39] + 300) / 400`, scales that factor by `1.6` when growth setting `[0x006cec78+0x4c7c] == 1`, uses the resulting factor in one `800000` stock-value gate and one support-adjusted share-price scalar times factor times `1000` times `1.2` affordability gate, requires enough unassigned shares through `company_count_unassigned_shares_after_active_chairman_holdings` `0x004261b0`, and then commits repeated `1000`-share repurchases through `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`; this is the current strongest threshold owner behind RT3.lng `2887`. The repurchase tail also now reads cleanly: it accumulates the total repurchased public-share count in a dedicated counter and publishes `2887` from that total after the debt headline branch. The sequencing above this helper now bounds those two latch reads more clearly: `0x004019e0` clears them first, then the city-connection and linked-transit branches may set them earlier in the same periodic pass, so the bond and repurchase lanes are currently best read as same-cycle reaction policy rather than long-term company-state policy. The later stock-issue lane is now tighter in exact order, not just broad shape: it only opens on build `1.03+`, only after the earlier bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since founding. It derives one prospective equity tranche from roughly one-tenth of the current outstanding-share count, rounded down to `1000`-share lots with floor `2000`, trims that tranche downward until the pressured support-adjusted share-price scalar times tranche no longer exceeds the `55000` proceeds cap, recomputes the same share-price scalar under the negative tranche pressure term, clamps `Book Value Per Share` from stat-family `0x2329/0x1d` to a minimum `1.0`, and forms the normalized price-to-book ratio before any approval tests. The tested gates then run in a fixed order: share-price floor `>= 22`, pressured proceeds floor `>= 55000`, current cash from `0x2329/0x0d` against the highest-coupon live bond principal plus the fixed `5000` buffer, one later issue-cooldown or last-issue timestamp gate from `[this+0x16b..]`, and only then the piecewise coupon-versus-price-to-book ladder `0.07/1.3`, `0.08/1.2`, `0.09/1.1`, `0.10/0.95`, `0.11/0.8`, `0.12/0.62`, `0.13/0.5`, and `0.14/0.35`. On success it issues two same-sized public-share tranches through repeated `company_issue_public_shares_and_raise_capital` `0x00427450` calls and formats a separate equity-offering news family rooted at localized id `4053`, not the earlier `2882..2887` debt-or-buyback headlines. The dividend-side branch is now bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be clear, scenario mode `0x0c`, at least `1` year since `[this+0x0d2d]`, and at least `2` years since founding; it then converts a weighted `3/2/1` blend of the last three net-profits lanes `0x2b` into one tentative dividend-per-share target, supplements that target with current cash only on the tiny-unassigned-share branch below `1000`, and still folds in the map-editor building-density growth setting `[0x006cec78+0x4c7c]`. Current grounded postblend behavior is: growth setting `1` scales the existing dividend by `0.66`, growth setting `2` zeros it, computed deltas at or below `0.1` collapse to zero, larger deltas are quantized in tenths, and the final value is clamped against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. The tail also refreshes `CompanyDetail.win` when the selected company matches `[0x006cfe4c]`. This now grounds the main finance verbs and first-layer threshold ordering under the annual policy pass, though some lower helper semantics still remain open. | objdump + callsite inspection + RT3.lng strings + finance-policy correlation + bankruptcy/debt-news correlation + repurchase-news correlation + equity-offering-news correlation + finance-mutator correlation + threshold correlation + latch correlation + sequencing correlation + stock-data-label correlation + highest-coupon-bond correlation + income-statement-row correlation + derived-report-metric correlation + valuation-vs-borrowing correlation + weighted-dividend-target correlation + deep-distress-bankruptcy correlation + debt-headline-tail correlation + repurchase-headline-tail correlation + stock-issue-ordering correlation |
| 9 | 0x00402c90 | 19 | placed_structure_resolve_linked_candidate_record | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Tiny placed-structure-to-candidate resolver over the global candidate collection at `0x0062b268`. The helper reads one candidate id from `[this+0x173]`, re-enters the shared indexed-collection record resolver at `0x00518140`, and returns the resulting candidate record pointer. Current grounded caller is the BuildingDetail-side branch at `0x00506441`, where it is used immediately after resolving one placed-structure record from `0x0062b2fc`. This now looks like the direct placed-structure linked-candidate accessor rather than another anonymous local helper. | objdump + caller xrefs + callsite inspection + collection-resolver correlation |
| 10 | 0x00402cb0 | 3457 | city_connection_try_build_route_with_optional_direct_site_placement | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Shared heavy route-builder and optional direct-placement helper beneath the city-connection route and news family. The function starts at a clean prologue at `0x00402cb0`, seeds one builder-state latch band at `[this+0xf5]`, `[this+0xf6]`, `[this+0xf8]`, `[this+0xfa]`, `[this+0xfc]`, and `[this+0x10a]`, and then splits into three grounded internal lanes. The first is an early route-entry search or synthesis lane through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` over the global route-entry store `0x006cfca8`, which can seed the builder-state block and succeed without placing a new site. The second is a single-endpoint direct-placement lane around `0x00403d92..0x00403ef3`: it scans the live placed-structure collection `0x0062b2fc` for `Maintenance` and `ServiceTower` stems, projects one candidate placement through `0x00417840`, validates it through `0x004197e0`, and then commits through the first direct placement branch `0x00403ed5 -> placed_structure_collection_allocate_and_construct_entry` `0x004134d0` -> `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`. The third is a later paired-endpoint fallback lane around `0x00403f41..0x00404489`: it seeds two endpoint candidates from the same `Maintenance` and `ServiceTower` stem scan, builds one temporary route-entry candidate list, iterates that list against span and year-scaled step terms, projects trial placements through `0x00417840`, and on success commits through the second direct placement branch `0x0040446b -> 0x004134d0 -> 0x0040ef10` before clearing a small exclusion window in the temporary list. Outside those lanes it also re-enters geometry, region, and route-store helpers around `0x004423a0`, `0x00482e00`, `0x004931e0`, `0x00494310`, and the global route-entry stores `0x006cfcb4` / `0x006cfca8`, and it can still unwind through route-state cleanup without committing new placed structures. Current grounded external callers are still entirely in the city-connection family: the compact region-entry wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` `0x00404640`, the peer-route candidate builder `city_connection_bonus_build_peer_route_candidate` `0x004046a0`, the direct region-entry pair wrapper `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`. This now bounds the old unresolved `0x00403xxx..0x00404631` placement chooser as one shared city-connection route or placement helper with a cleaner internal policy split, even though some lower helper semantics remain open. | objdump + caller xrefs + callsite inspection + placement-correlation + route-builder correlation + Maintenance/ServiceTower scan correlation + route-entry search correlation |
| 11 | 0x004046a0 | 1388 | city_connection_bonus_build_peer_route_candidate | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Reusable candidate builder beneath the city-connection bonus news and status family. The helper starts from one region or city entry in the collection at `0x0062bae0`, samples that entry's two derived coordinate terms through `0x00455800` and `0x00455810`, then re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` with both selector flags forced on so it can recover one representative connected peer site. When a peer is found it samples the peer's derived coordinates through `0x0047df30` and `0x0047df50`; when an explicit caller-owned route anchor is present it first tries the heavier route builder at `0x00402cb0`, otherwise it falls back to the smaller helper at `0x00404640`. If neither early path succeeds the function collects one local candidate band from the two global route-entry stores at `0x006cfcb4` and `0x006cfca8`, filters those entries against the current city id and several route-state predicates, computes one compact bounding window around each surviving candidate, and then chooses the best remaining candidate by smallest span before retrying `0x00402cb0`. Current grounded callers are the wider company-side city-connection bonus sweep at `0x00406050` and one neighboring branch at `0x00406b73`, which together make this look like the shared peer-route candidate builder above the city bonus peer-selector family rather than a direct UI formatter. | objdump + caller xrefs + callsite inspection + peer-selector correlation + route-builder correlation |
| 12 | 0x00404640 | 82 | city_connection_bonus_try_compact_route_builder_from_region_entry | map | thiscall | inferred | objdump + caller inspection + route-builder correlation | 3 | Small route-builder helper beneath `city_connection_bonus_build_peer_route_candidate` `0x004046a0`. The helper resolves one caller-supplied region or city entry id through collection `0x0062bae0`, derives that entry's compact coordinate pair through `0x00401000`, reads one explicit route-anchor or peer-site id from `[this+0x00]`, and then re-enters the heavier route builder at `0x00402cb0` with that resolved coordinate pair plus default wildcard arguments `-1/0/-1` in the remaining route slots. Current grounded caller is the city-connection bonus candidate builder at `0x004047bf`, where this helper is used as the smaller fallback path when the earlier explicit-anchor route attempt does not apply. This now looks like the compact region-entry wrapper around the shared route builder rather than a generic coordinate helper. | objdump + caller inspection + route-builder correlation + city-bonus fallback correlation |
| 13 | 0x00404c60 | 124 | city_connection_try_build_route_between_region_entry_pair | map | fastcall | inferred | objdump + caller inspection + route-builder correlation | 3 | Compact fastcall route-builder above the shared route store at `0x006cfca8`. The helper resolves the two caller-supplied region or city entry ids through collection `0x0062bae0`, derives both endpoint coordinate pairs through `0x00401000`, and then re-enters the heavier route builder at `0x00402cb0` with those two endpoints plus the caller's remaining stack-side policy tuple. Current grounded callers are the pair-selection sweeps inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`, where it is used both for the early dense score matrix and the later selected-pair retry. This now looks like the direct region-entry pair wrapper around the shared route builder rather than another anonymous internal callsite. | objdump + caller inspection + route-builder correlation + pair-selection correlation |
| 14 | 0x00404ce0 | 3124 | simulation_try_select_and_publish_company_start_or_city_connection_news | simulation | fastcall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Broad fastcall city-pair chooser and news publisher above `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`. When the stack company-id argument is zero the helper sweeps up to `0xa0` region-or-city entries from `0x0062bae0`; when it is nonzero it first validates that company through collection `0x0062be10`, stat family `0x2329` mode `0x0d` via `0x0042a5d0`, and the territory-access gate `0x00424010`. Eligible city entries are filtered through `city_connection_bonus_exists_matching_peer_site` `0x00420030`, weighted through `city_compute_connection_bonus_candidate_weight` `0x004010f0`, damped by map-size terms, territory access, and current region flags, and stored into temporary score bands. The helper then builds one dense pair matrix, repeatedly re-enters `0x00404c60` to validate candidate city pairs, can update one company-side selected endpoint pair through `0x00426f20`, and finally publishes shell news through `0x004554e0`. Current grounded publication ids are `2889` `%1 has started a new company - the %2` and `2890` `%1 has connected %2 to %3.`. Current grounded callers are `0x00401455`, which temporarily clears region-state dwords `[0x006cfc9c+0x2d]` before a global pass, and `0x00401b36`, which re-enters the same chooser with the active company and linked chairman after the smaller company-side city-connection bonus lane falls through. This now looks like the broader company-start-or-city-connection headline chooser above the smaller city-connection bonus sweep at `0x00406050` rather than another anonymous route-builder. | objdump + caller inspection + RT3.lng strings + route-builder correlation + pair-selection correlation + publication-path correlation |
| 15 | 0x00405920 | 189 | company_query_min_linked_site_distance_to_xy | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Queries the minimum distance from one company to an input X or Y point pair. The helper walks the live placed-structure collection at `0x006cec20`, keeps only sites whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, samples each surviving site's derived coordinates through `0x0047ded0` and `0x0047df00`, and then computes one scalar distance against the caller-supplied coordinate pair through `0x0051dbe0`. It returns the minimum observed distance across all linked sites, clamped to a floor of `1.0` when a closer or degenerate result would go lower. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where this helper provides the distance term later blended into each city candidate score. | objdump + caller xrefs + callsite inspection + distance-term correlation |
| 16 | 0x00406050 | 2966 | company_evaluate_and_publish_city_connection_bonus_news | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Broader company-side city-connection bonus sweep above `city_connection_bonus_build_peer_route_candidate` at `0x004046a0`. The function starts by building one announcement-value floor from several company-side support or governance helpers: the generic metric readers at `0x0042a5d0` and `0x00426ef0`, the linked transit-site counter `company_count_linked_transit_sites` at `0x00426590`, the small bonus-lane gate at `0x00427590`, and the longer company value ladder at `0x00425320`. Once that floor is high enough it walks the region-or-city collection at `0x0062bae0` and computes one per-city opportunity score from three terms: the city-side opportunity weight from `city_compute_connection_bonus_candidate_weight` at `0x004010f0`, the minimum linked-site distance from `company_query_min_linked_site_distance_to_xy` at `0x00405920`, and one city-side coordinate or spacing term around `0x00455800` and `0x00455810`. Those city scores are then adjusted by rival-company presence, chairman-profile scaling, the map-editor building-density setting at `0x006cec78+0x4c78`, and a linked-transit-site-count cap before the function keeps up to ten city ids in the persistent band at `[this+0x0d42]`. It repeatedly re-enters `city_connection_bonus_build_peer_route_candidate` to validate the best remaining entry, and when one validated winner survives it formats company and city names into the localized news strings `2888` `%1 has connected to %2.`, `2890` `%1 has connected %2 to %3.`, or `2921` `%1 has put a station in %2, but to win the %3 connection bonus, this station must be connected to ANOTHER city.` before publishing the result through the shell news helper at `0x004554e0`. When no winner survives it sets the byte latch at `[this+0x0d18]` instead. This is now the first grounded announcement owner above the city-connection bonus status formatter and peer-selector pair rather than just an anonymous caller around `0x004064c0`. | objdump + caller inspection + RT3.lng strings + peer-route candidate correlation + publication-path correlation + score-component correlation |
| 17 | 0x00407bd0 | 1697 | company_rebuild_linked_transit_autoroute_site_score_cache | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Slower per-company follow-on above the fast linked-transit peer cache. The helper stamps the current scenario tick into `[this+0x0d3a]`, then walks the live placed-structure collection and keeps only sites whose company-side cache cell at `[site+0x5bd][company_id]` is present and eligible. For each such site it refreshes the cache-cell tick at `+0x0a`, zeroes the three accumulated float lanes at `+0x0e`, `+0x12`, and `+0x16`, and then rebuilds those lanes from two phases. First it uses `placed_structure_count_candidates_with_local_service_metrics` `0x0047e330`, `0x0047e620`, and the issue-opinion helper `0x00437d20` to populate bounded candidate-local amount bands at stack `0x1a0..` and normalized scaling bands at `0x350..`. Then it re-enters the per-site peer buffer at cache `+0x06`, resolves each peer site's live service words through `0x0047de20`, and only keeps candidate lanes whose local amount still exceeds the peer baseline. The surviving excess amount accumulates raw into cache float `+0x12`, while the continuity share at peer float `+0x09` and route-step count at peer dword `+0x05` feed a second step-biased weighted accumulator in cache float `+0x0e` through the local `+0x28` denominator bias. A later grouped promotion pass chooses the strongest adjacent candidate bands and folds their weighted contribution into cache float `+0x16`, which is the final site-ranking lane consumed by the downstream site selector. That split now matters for the tracker compatibility question too: the pre-`1.03` versus `1.03+` pair-metric dispatcher at `0x004a65b0` can perturb peer step counts and continuity share, but on current evidence that only flows into the weighted `+0x0e` and promoted `+0x16` lanes, not the raw `+0x12` amount total. Current grounded callers are the company-side mode gate at `0x00401c2a`, the timed wrapper at `0x00409766`, and the fast-cache tail path at `0x004093cd`. This now reads as the slower autoroute-site score rebuild over the linked-transit peer cache family rather than an unnamed tail call. | objdump + caller xrefs + callsite inspection + linked-transit score-cache correlation + linked-transit consumer correlation + version-compatibility impact correlation |
| 18 | 0x00408280 | 255 | company_select_best_owned_linked_transit_site_by_autoroute_score | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Selects one owned linked transit site from the company-side autoroute cache family. The helper walks the live placed-structure collection, keeps only sites whose company cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the station-or-transit gate `0x0047fd50`. It then ranks the surviving sites by cache float `[cell+0x16]`, applying a small bonus when the placed-structure-side lanes `[site+0x5c1]` and `[site+0x5c5]` are both clear, and returns the winning site id or `-1` when no candidate survives. Current grounded caller is `company_build_linked_transit_autoroute_entry` `0x00408380`, where this helper provides the fallback start site when the caller does not already supply one. | objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation |
| 19 | 0x00408380 | 3215 | company_build_linked_transit_autoroute_entry | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. The downstream effect boundary is tighter now too: because this builder ranks peer-site candidates from the weighted peer-derived bands rather than the raw site totals, the pre-`1.03` versus `1.03+` tracker metric split is now best read as perturbing autoroute peer choice and seeded route-entry selection here, not the later company-wide train-pressure target at `0x00408f70`. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query. | objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation + version-compatibility impact correlation |
| 20 | 0x00408f70 | 864 | company_compute_owned_linked_transit_site_score_total | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Aggregates one company-side linked-transit train-pressure target from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the raw site score float at cache offset `+0x12` across the surviving sites while also retaining the first two representative site pointers and the eligible-site count. It then converts that raw total into the returned roster target through a year-dependent divisor ladder, later year-side multipliers, and site-count bands. On build `1.03+`, when exactly two eligible sites survive, it also measures the inter-site distance between those retained sites and applies an extra distance-side scaling branch before the final train-balance comparison. The compatibility boundary is now tighter too: because this helper sums cache `+0x12` rather than the weighted `+0x0e` or promoted `+0x16` lanes, current evidence says the pre-`1.03` versus `1.03+` tracker metric split does not directly change this company-wide roster target except through any earlier coarse candidate-survival effects, not through the step-count or continuity-weighting lanes themselves. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run. | objdump + caller xrefs + callsite inspection + linked-transit score-total correlation + linked-transit consumer correlation + version-compatibility impact correlation |
| 21 | 0x00409300 | 200 | company_publish_train_upgrade_news | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 3 | Formats and publishes the linked-transit train-upgrade news item. After one scenario gate through `[0x006cec78+0x4a97]`, the helper chooses one preferred locomotive id through `0x004078a0`, resolves the caller-supplied train id through the live train collection `0x006cfcbc`, formats the old and new locomotive names through the locomotive collection `0x006ada84` and the name helper at `0x00461ca0`, and then emits RT3.lng id `2897` `%1 has just upgraded a %2 to a %3.` through the shell news helper at `0x004554e0`. It finally sets the byte latch at `[company+0x0d56]`. Current grounded callers are the train-roster balancer at `0x00409950` and one neighboring branch at `0x00409b52`, so this now reads as the shared company-side train-upgrade headline helper rather than an anonymous news formatter. | objdump + caller xrefs + callsite inspection + RT3.lng strings + train-upgrade news correlation |
| 22 | 0x004093d0 | 837 | company_rebuild_linked_transit_site_peer_cache | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step count from `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` `0x004a6630`, and float `+0x09` stores the normalized continuity share computed from that step count and the companion mismatch-count output of the same helper. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`. | objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation + route-step-count correlation + continuity-ratio correlation |
| 23 | 0x00409720 | 80 | company_service_linked_transit_site_caches | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Timed service wrapper above the two company-side linked-transit cache lanes. The helper refreshes the fast peer cache through `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` when `[this+0x0d3e]` is zero or older than `0x7ff80` ticks, and otherwise refreshes the slower follow-on lane at `0x00407bd0` when `[this+0x0d3a]` is zero or older than `0x31380` ticks. Current grounded direct callers are `0x004097b8`, which re-enters it after one larger local mode change, and several neighboring company-side service paths. This now looks like the bounded timed owner for the company-side linked-transit cache family rather than another anonymous small wrapper. | objdump + caller xrefs + callsite inspection + timed-service correlation |
| 24 | 0x00409770 | 88 | train_try_append_linked_transit_autoroute_entry | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Attempts to append one linked-transit autoroute entry onto a live train route list. After validating the train-side state and one current route-kind gate through `0x004a8840`, the helper clears one local staging byte, re-enters `company_service_linked_transit_site_caches` `0x00409720` on the owning company, and then asks `company_build_linked_transit_autoroute_entry` `0x00408380` for a single staged `0x33`-byte route-list record using the current anchor site id at `[this+0x0a0]`. On success it either appends that record through `train_route_list_insert_staged_entry_at_index` `0x004b3160` and refreshes the new trailing selection through `train_route_list_select_entry_and_refresh_linked_site_state` `0x004b2f00`, or when the list is already at the local two-entry cap it rotates the target slot via `[this+0x08] mod [this+0x04]` and overwrites that `0x33`-byte entry in place. The weighted linked-transit cache lanes stay indirect here too: this helper inherits ranked site and peer choice only through `0x00408380`, not by reading cache `+0x0e/+0x16` itself. Current grounded caller is the company-side service sweep at `0x004019cc`, so this now reads as the single-entry train-side autoroute append helper rather than a two-entry seeding pass. | objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation + train-route-list correlation + weighted-consumer-boundary correlation |
| 25 | 0x00409830 | 274 | company_try_add_linked_transit_train_and_publish_news | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 3 | Local add-train branch beneath the linked-transit company train-roster balancer. The helper first respects scenario gate `[0x006cec78+0x4aa3]`, clears and seeds one staged route-entry buffer through `0x004b2ba0`, services the owning company's linked-transit caches, asks `company_build_linked_transit_autoroute_entry` `0x00408380` for two route-list entries, inserts those entries through `train_route_list_insert_staged_entry_at_index` `0x004b3160`, chooses one preferred locomotive id through `0x004078a0`, and then hands the staged route plus locomotive choice into the train-construction helper at `0x004b2140`. On success it emits RT3.lng id `2896` `%1 has added a new train (%2) at %3` through `0x004554e0` and sets the byte latch at `[company+0x0d56]`. The weighted linked-transit cache lanes stay indirect here too: this add-train path inherits ranked site and peer choice only through the two `0x00408380` builder calls, while the separate roster-pressure decision above it still comes from raw cache `+0x12` through `0x00408f70`. Current grounded callers are the local add branches inside `company_balance_linked_transit_train_roster` `0x00409950`, while multiplayer callers package opcode `0x75` instead. | objdump + caller xrefs + callsite inspection + RT3.lng strings + linked-transit train-add correlation + weighted-consumer-boundary correlation |
| 26 | 0x00409950 | 923 | company_balance_linked_transit_train_roster | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Balances one company's linked-transit train roster against the linked-site cache family. The helper first requires at least one linked transit site through `company_count_linked_transit_sites` `0x00426590`, then computes one aggregate train-pressure target through `company_compute_owned_linked_transit_site_score_total` `0x00408f70` and counts currently owned trains through `company_count_owned_trains` `0x004264c0`. It walks the live train collection `0x006cfcbc`, keeps only trains owned by the current company, derives one year-dependent age scalar from current scenario year `[0x006cec78+0x0d]`, and applies that scaled age against two thresholds. Very old trains above the upper band are either removed outright through the train collection vtable when the roster already exceeds target, or upgraded in place through `company_publish_train_upgrade_news` `0x00409300` when the target still needs capacity. Mid-age trains above the lower band can trigger one narrower upgrade branch when the roster is still below target. After pruning, it computes the remaining deficit between the aggregate target and the owned-train count, then repeatedly either packages multiplayer opcode `0x75` through `0x00469d30` or locally re-enters `company_try_add_linked_transit_train_and_publish_news` `0x00409830` until that deficit collapses, with one later add-train retry branch when the residual target is still high enough. Current grounded callers are the company-side service sweep at `0x00401b9d` and a neighboring company wrapper at `0x004097b8`, so this now looks like the live train-balance owner above the linked-transit autoroute and news helpers rather than an unnamed local maintenance pass. | objdump + caller xrefs + callsite inspection + linked-transit train-balance correlation + linked-transit consumer correlation |
| 27 | 0x004264c0 | 96 | company_count_owned_trains | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Counts the live trains owned by the current company. The helper walks the train collection at `0x006cfcbc`, compares each record's owning company byte at `[train+0x51]` against `[this+0x00]`, and returns the number of matches. Current grounded callers are the linked-transit train-roster balancer at `0x00409950` and the `LoadScreen.win` company train-list page at `0x004e7670`, where the count gates the no-trains fallback before the detailed roster rows are built. | objdump + caller xrefs + callsite inspection + company-owned train count correlation |
| 28 | 0x00426590 | 135 | company_count_linked_transit_sites | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Counts the live linked placed structures for this company that also pass the station-or-transit gate. The helper walks the placed-structure collection at `0x006cec20`, keeps only peers whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, requires the linked-instance class byte through `0x0047de00 -> 0x0040c990 == 1`, and optionally enforces the narrower station-or-transit predicate through `0x0047fd50` when the caller passes a nonzero stack flag. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where the helper contributes the current linked transit-site count used in the bonus-value ladder and later building-density caps. | objdump + caller xrefs + callsite inspection + connection-bonus count correlation |
| 29 | 0x00427590 | 47 | company_credit_rating_score_meets_threshold_5 | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Small boolean gate over the bounded company credit-rating score at `0x00425320`. The helper rejects immediately when scenario-state flag `0x006cec78+0x4a8b` is set or when the company-side count or age-like field `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument credit-rating score and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the neighboring branch around `0x004064a9`, so this is currently safest as a small reusable threshold gate over the same debt-market or company-strength score rather than a dedicated shell-only bond predicate. | objdump + caller xrefs + callsite inspection + credit-rating correlation + threshold-gate correlation |
| 30 | 0x00409e80 | 192 | world_set_selected_year_and_refresh_calendar_presentation_state | simulation | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small world-side year setter beneath the periodic step family and the later world-entry staged-profile rehydrate band. The helper stores the caller-supplied selected absolute calendar counter at `[this+0x15]`, resolves the paired mixed-radix calendar-point tuple through `0x0051d460` into `[this+0x0d/+0x11]`, recomputes several derived year-fraction or presentation scalars rooted at `[this+0x0bfa]`, refreshes the live shell controller at `0x006d4024` through `0x0051f070`, `0x00527c70`, and `0x00527c20`, and updates the controller's cached doubled-year field at `[controller+0x2c]`. When the unpacked year field at `[this+0x0d]` actually changes it also re-enters `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`. Current grounded callers are the smaller periodic-step wrapper at `0x0040a150`, the larger simulation-advance family through `0x0040a590/0x0040ab50`, and the late staged-profile rehydrate lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared selected-year/calendar refresh helper rather than a one-off world-entry setter. | objdump + caller inspection + local disassembly + periodic-step correlation + world-entry rehydrate correlation + year-bucket-companion correlation + calendar-counter model correlation |
| 31 | 0x0040a590 | 892 | simulation_service_periodic_boundary_work | simulation | cdecl | inferred | objdump + analysis-context | 3 | Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. Its scenario-runtime handoff is now explicit too: the grounded calls at `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3` re-enter `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kinds `1`, `0`, `3`, and `2` respectively. The route-style lane is tighter here now too: the neighboring recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, then later drives the same runtime-effect collection loop with trigger kinds `5` and `4` at `0x0040a930` and `0x0040a9ac`. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence. | objdump + analysis-context + caller xrefs + runtime-effect trigger-kind correlation |
| 32 | 0x0040ab50 | 339 | simulation_advance_to_target_calendar_point | simulation | cdecl | inferred | objdump + analysis-context | 3 | Advances the active world state toward one caller-selected mixed-radix calendar target while guarded by the recursion counter at `0x0062b240`. The helper compares the current local calendar-point tuple fields `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and `[this+0x14]` against a target resolved through `0x0051d550` and `0x0051d5f0`, then either recurses in larger `0x168`-sized chunks or advances through the smaller periodic step family rooted at `0x00409e80` and `0x0040a9c0`. Current tuple evidence now bounds this as the same mixed-radix counter family used by `0x0051d3c0/0x0051d460`: a packed year-plus-subfield calendar point rather than a plain year or month-only target. Each successful step notifies the live world root at `0x0062c120` through `0x00450030`. Grounded callers include the frame-time accumulator at `0x00439140`, the larger fast-forward helper at `0x00437b20`, and one shell UI command path. | objdump + analysis-context + caller xrefs + calendar-counter model correlation |
| 33 | 0x0040e360 | 235 | placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Subtype-specific local-runtime follow-on beneath `0x0040eba0` and `0x0040ee10`. The helper resolves the current placed structure's candidate from `[this+0x3cc]` through `0x0062b2fc` and `0x0062b268`, requires subtype byte `[candidate+0x32] == 1` plus candidate class byte `[candidate+0x8c] == 3`, then requires a linked site id at `[this+0x2a8]`. When the linked peer exists and its route-entry anchor at `[peer+0x08]` is live in collection `0x006cfca8`, the helper samples one anchor-side float through `0x0048aab0`, subtracts the fixed offset at `0x005c8738`, combines that result with the current placed structure's coordinate pair through `0x00455810` and `0x00455800`, and publishes the resulting triplet through the shared position setter `0x00530720`. Current grounded caller is the broader local side helper `0x0040ee10`, plus the heavier subtype-driven refresh path at `0x0040eba0`, so this is now the safest current read for the linked-site anchor position-triplet refresh beneath the placed-structure local-runtime family rather than a generic route query. | objdump + caller inspection + local disassembly + linked-site-anchor correlation + local-runtime correlation |
| 34 | 0x0040e450 | 131 | placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small wrapper that rebuilds one placed structure's cloned local-runtime record from its current candidate stem and cached profile slot. The helper copies the current stem string from the candidate referenced by `[this+0x3cc]`, resolves the matching live candidate id through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, seeds the projected-rectangle profile-slot cache from `[this+0x252]` through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470`, and then re-enters `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` `0x00418a60` with the current placed-structure pointer. It stores the returned cloned record into `[this+0x24e]`, refreshes the local cached profile slot from `[record+0x732]` into `[this+0x252]`, and ties the clone back to the owning placed structure through `[record+0x73a] = this`. Current grounded caller is the collection-wide wrapper `0x004133b0`, so this now reads as the cloned local-runtime rebuild helper for one live placed structure rather than an unowned stem lookup. | objdump + caller inspection + local disassembly + local-runtime-clone correlation + projected-rect-profile correlation |
| 35 | 0x0040eba0 | 620 | placed_structure_set_world_coords_and_refresh_local_runtime_side_state | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavier placed-structure world-coordinate mutation helper above the local-runtime side refresh family. The function updates the current record's world position through `0x00455860`, recomputes cached grid coordinates `[this+0x388]` and `[this+0x38c]`, and rewrites the world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`. On the candidate subtype-`4` branch it also removes and then re-appends the current site to the nearby-transit proximity bucket family through `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0` and `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480`. After that it rebuilds the same local position or scalar triplet family later serviced by `0x0040ee10`, caches the accepted scalar pair in `[this+0x392]` and `[this+0x396]`, publishes the chosen triplet through the shared setter `0x00530720`, optionally refreshes the linked peer route-entry anchor through `0x00480710`, and finally tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers include the broader rebuild paths `0x0040ef10` and `0x0040f6d0`, later site-mutation branches `0x00419110`, `0x0046ef40`, `0x004707da`, and `0x00473bf0`, plus shell-side subject updates around `0x00507cf0` and `0x00508bb0`, so this is now the safest current owner for world-coordinate updates plus local-runtime side-state refresh rather than a generic movement helper. | objdump + caller inspection + local disassembly + world-coordinate mutation correlation + local-runtime correlation + proximity-bucket correlation |
| 36 | 0x0040ee10 | 248 | placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small placed-structure local-runtime side refresh over one live record. The helper samples the current structure coordinate pair through `0x00455800` and `0x00455810`, converts that pair through the basis at `0x006d4024`, `0x0051f090`, and `0x00534490` into one base scalar, and then conditionally adjusts that scalar when the linked candidate-side structure record keeps nonzero byte `[candidate+0xba]` via the rounded world-grid sampler `0x0044ae40` and the fixed subtractive offset at `0x005c8840`. When the auxiliary preview owner gate `shell_has_auxiliary_preview_owner` `0x00434050` is active, it rounds that scalar to an integer float. It then publishes the resulting position triplet through the shared setter `0x00530720` and tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers are the collection-wide local-runtime refresh wrapper `0x004133b0` and the connected-component recursion tail `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`, so this is now the strongest current owner for the per-site local-runtime position-triplet refresh rather than a generic coordinate helper. | objdump + caller inspection + local disassembly + local-runtime correlation + connected-component correlation |
| 37 | 0x0040ef10 | 1984 | placed_structure_finalize_creation_or_rebuild_local_runtime_state | map | thiscall | inferred | objdump + caller inspection + placement and mutation correlation | 3 | Broad placed-structure post-create or post-edit rebuild above the narrower route-style lane. The helper validates several linked-site and world-state preconditions before keeping the current site live, increments the global live-site count at `0x0062be40`, seeds runtime mode and year fields at `[this+0x390]`, `[this+0x3d4]`, and `[this+0x3d5]`, refreshes the adjacent site-status or overlay family through `0x0040d2d0`, and rebuilds one larger local owner or service bundle through `0x00418be0`, `0x0040eba0`, and the scalar-staging family `0x00475ed0` / `0x00474fe0` / `0x00475010` / `0x00475030` into fields such as `[this+0x24e]`, `[this+0x252]`, `[this+0x25a]`, and `[this+0x25e]`. Later in the same body it re-enters `0x0040db30`, and when the local latch at `[this+0x29e]` is still zero it also re-enters `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `1`. The tail is tighter now too: when creation-mode byte `[this+0x3d4]` equals `1`, the branch at `0x0040f692` triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6` just before the local live-site follow-on at `0x433b80`. Current grounded callers include the placement-side builders at `0x00403ef3` and `0x00404489`, later site-mutation paths at `0x0046f073` and `0x004707ff`, and one train-side site operation at `0x005098eb`, so this now looks like the broad post-create or post-edit runtime rebuild above route-style scoring and peer-link emission rather than a route-style-only helper. | objdump + caller inspection + placement and mutation correlation + route-style rebuild correlation + runtime-effect trigger-kind correlation |
| 38 | 0x0040f6d0 | 891 | placed_structure_construct_entry_from_candidate_and_world_args | map | thiscall | inferred | objdump + constructor inspection + caller correlation | 3 | Lower constructor beneath the shared placed-structure allocator at `0x004134d0`. The helper writes the new placed-structure id into `[this+0x2a4]`, clears a large band of local runtime fields, copies the candidate stem or label payload from the caller-supplied construction scratch record, initializes local world geometry through `0x0040cd70`, `0x0045b9b0`, `0x00455750`, and `0x00455720`, quantizes the input coordinates into the cached grid terms at `[this+0x388]` and `[this+0x38c]`, seeds the current scenario year into `[this+0x3d5]`, and initializes the class-weight lanes near `[this+0x28a]` from the linked candidate vtable owner. It then zeroes the local route-style and service-score bands, conditionally builds the first local owner or service record through `0x00418be0` and `0x0040eba0`, resolves the initial linked site id at `[this+0x2a8]` through `0x00481390` when the backing candidate subtype byte `[candidate+0x32]` is `1`, seeds region linkage through `0x0044a800` and `0x0041f7e0`, optionally re-enters `0x0040db30` for subtype `4`, and finally seeds the trailing random-like dwords at `[this+0x3d9]` and `[this+0x3dd]` from `0x518d70`. Current grounded caller is `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, so this is now the concrete placed-structure constructor rather than an anonymous lower helper beneath the placement-side builders. | objdump + constructor inspection + caller correlation + placed-structure runtime-state correlation |
| 39 | 0x0040fbe0 | 224 | placed_structure_endpoint_pair_has_shared_route_entry_key | map | thiscall | inferred | objdump + caller inspection + world-grid chain comparison | 3 | Boolean peer-test between one placed structure and one caller-supplied peer site id. The helper converts the current site and the peer site into their derived world-grid owner records through `0x00455800`, `0x00455810`, the world-grid tables rooted at `[0x0062c120+0x2129]`, and the placed-structure resolver `0x0040fa50`. It then compares the two route-entry chains rooted at `[cell+0x0ef]`, using the chain lengths at `[cell+0x0eb]`, and returns `1` on the first shared leading `u16` route-entry key; otherwise it returns `0`. Current grounded callers are the route-link emitter at `0x0040fef0`, where it blocks duplicate endpoint pairing before `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50`, and the neighboring cleanup sweep at `0x0040d2aa`, where it decides whether an existing site-owned route-link should be erased. This now looks like the shared duplicate-or-overlap test for the route-link family rather than a generic proximity check. | objdump + caller inspection + world-grid chain comparison + route-link duplicate-check correlation |
| 40 | 0x0040fef0 | 752 | placed_structure_try_emit_best_route_style_peer_link_for_candidate_class | map | thiscall | inferred | objdump + caller inspection + placed-structure sweep inspection | 3 | Scans the live placed-structure collection for one best peer site and emits a missing route-link for one caller-selected candidate class when a qualifying endpoint pair survives. The helper first derives one distance cap from the current placed-structure population size at `0x0062b26c`, scales that cap by the caller-supplied float, and then walks the live placed-structure ids in a wrapped pseudo-random order. Candidate peers must have a positive class-specific weight in the placed-structure lane `[peer+class*4+0x27e]`, differ from the source site, pass the linked-instance class gate `0x0040c990 == 1`, and lie inside the chosen distance window after the coordinate and span checks built from `0x00455800`, `0x00455810`, `0x00455f60`, and nearby math helpers. The strongest surviving peer is kept through a weighted comparison, and if one remains the helper re-enters `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0`; only when that duplicate check fails does it call `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` with the source site id from `[this+0x2a4]`, the chosen peer id, and the same candidate-class argument. Current grounded callers are the larger per-site world pass around `0x00410665` and the route-style grid contribution branch at `0x0042cafe`, so this now looks like the current peer-selection emitter for site-owned route-style links rather than a low-level allocator wrapper. | objdump + caller inspection + placed-structure sweep inspection + route-link emission correlation |
| 41 | 0x004101e0 | 6843 | placed_structure_rebuild_route_style_candidate_scores_and_peer_links | map | thiscall | inferred | objdump + caller inspection + route-style emission correlation | 3 | Large per-site rebuild pass above the route-style link emitter. The helper first requires the current placed structure to pass the linked-instance class gate `0x0040c990 == 1` and several scenario-state gates rooted at `0x006cec78` and `0x006cec7c`, then derives one set of per-class route-style score scalars from the current site's local state, scenario opinion multipliers through `0x00436590`, year-dependent dampers, and the placed-structure class-weight lanes near `[this+0x28a]`. The early compatibility side is tighter now too: it probes the current placed-structure stem against `Nuclear Power Plant`, `Electric Plant`, and `Recycling Plant`, stages three local boolean latches from those matches, and then clears the `Recycling Plant` latch again when the shared build-version query `0x00482e00` reports below `0x68` (`1.04`), so that stem-specific branch is now bounded as a post-`1.04` compatibility lane rather than one timeless route-style rule. For the first three route-style classes it conditionally re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the caller-supplied mode flag and one computed float score. The function then continues into a larger descriptor-driven scoring phase over the current candidate's runtime descriptor array at `[candidate+0x37]`, building temporary score bands and normalizing them against the same local totals before later write-back. That later phase has another bounded version gate: on one descriptor-accumulation subbranch the helper consults `0x00482e00` again at `0x41109f`, and build `1.05+` (`>= 0x69`) skips one older fallback attenuation path that earlier builds still apply through the local multiplier tables. Current grounded callers are the local per-site branch at `0x0040f640`, which reaches it with stack flag `1`, and the broader placed-structure sweep at `0x004135e3`, which reaches it with stack flag `0`; this is therefore the strongest current owner for route-style candidate scoring and peer-link emission on one live placed structure rather than a narrow one-off helper. | objdump + caller inspection + route-style emission correlation + descriptor-loop inspection + version-gate correlation + stem-probe correlation |
| 42 | 0x004134d0 | 112 | placed_structure_collection_allocate_and_construct_entry | map | thiscall | inferred | objdump + caller xrefs + constructor inspection | 3 | Shared direct placement helper above the broader placed-structure runtime rebuild. The helper first obtains one temporary `0x3e1`-sized construction scratch object through `0x53b070` and `0x0040c950`, then allocates one live placed-structure entry from the current collection through `0x518900`, resolves the new record through `0x518140`, and finally re-enters the lower constructor at `0x0040f6d0` with the new entry id plus the caller-supplied coordinate and candidate payload tuple. Current grounded callers include the candidate-placement branches at `0x00403ed5`, `0x0040446b`, and `world_region_try_place_candidate_structure` `0x00422ee0`, plus later mutation or editor-side branches at `0x0046efbf`, `0x0047074b`, `0x00472bef`, `0x00472d03`, and `0x00508fd1`. This now looks like the shared placed-structure allocator and constructor entrypoint beneath the placement-side builders rather than a route-style-specific helper. | objdump + caller xrefs + constructor inspection + placement correlation |
| 43 | 0x0041d550 | 574 | locomotive_era_and_engine_type_pass_company_policy_gate | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + engine-type correlation | 2 | Policy gate beneath the preferred-locomotive chooser and its non-electric fallback. The helper operates on one locomotive-era or availability record whose linked locomotive id sits at `[this+0x126]`. On the fuller policy path, reached when record field `[this+0x41]` is `2` or `3`, it first respects several scenario-state locks rooted at `[0x006cec74+0x180]`, `[0x006cec78+0x4c8c]`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x247]`, then resolves the linked locomotive record from `0x006ada84` and dispatches its engine-type dword `[locomotive+0x10]` across three scenario opinion slots through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`: `0x1c6`, `0x1c7`, and `0x1c8`, which current evidence now best aligns with the steam, diesel, and electric lanes. It also special-cases the locomotive stem at `[locomotive+0x34]` against the local string `WhaleL`; current data-file correlation now ties that stem to the `Orca NX462` locomotive family and its `WhaleL_NE` asset set, and when that compare hits the helper explicitly zeros the accumulated issue-opinion result before the later availability checks, so that family loses the positive-opinion shortcut rather than taking a bonus branch. It then consults one neighboring locomotive-derived issue or policy id through `0x00442a85`, and applies a late scenario availability triplet from `[0x006cec78+0x4c97..0x4c99]` against three per-record bytes `[this+0x30..0x32]` plus record field `[this+0x7b]`. That triplet now has a stronger player-facing read: the same three scenario bytes are the live editor-policy fields owned by `map_editor_locomotive_availability_panel_construct` `0x004cd680` and `map_editor_locomotive_availability_panel_handle_message` `0x004cf0d0`, and their localized labels `2863..2865` are `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All Electric Locos Avail.`. The current gate is narrower than a plain override: when the issue-opinion result stays positive and none of those three editor bytes are enabled, that positive result alone seeds the local availability flag; but once any of the editor family bytes is nonzero, the helper instead requires one matching intersection between the per-record family bytes `[this+0x30..0x32]` and the corresponding scenario bytes `0x4c97..0x4c99`. Independent of that family check, record field `[this+0x7b]` can still carry the path into the later year-window gate. On the simpler path it falls straight to an era-window gate using the current scenario year with floor `0x726` against `[this+0x105]` and `[this+0x109]`, plus one current-month-like check from `[0x006cec78+0x0f]`. The helper returns `1` when the era and engine family pass those combined scenario, opinion, availability, and year gates; otherwise `0`. Current grounded callers are `company_select_preferred_available_locomotive_id` `0x004078a0` and `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0`. | objdump + caller xrefs + callsite inspection + engine-type correlation + year-window correlation + scenario-gate correlation + editor-locomotive-availability correlation + WhaleL carveout correlation + engine-data correlation |
| 44 | 0x00417790 | 160 | map_angle_rotate_grid_offset_pair_into_world_offset_pair | map | cdecl | inferred | objdump + callsite inspection + math-table correlation | 2 | Small angle-table rotation helper beneath the placement projection family. The helper normalizes the caller-supplied heading float into the engine's cyclic angle domain, indexes one sine or cosine-like basis table under `0x006d4024`, and then applies that basis pair to the caller-supplied X or Y grid offsets before writing the rotated world-space offset pair through the two out-pointers. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, so this now looks like the low-level offset-rotation helper rather than a generic trig wrapper. | objdump + callsite inspection + math-table correlation |
| 45 | 0x00417840 | 205 | placed_structure_project_candidate_grid_extent_offset_by_rotation | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Projects one candidate-sized local grid extent into rotated world-space X or Y offsets for placement and mutation previews. The helper resolves the caller-supplied placed-structure id through the current collection, pulls one local grid basis pair through `0x00413d80`, reads the linked candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, converts those grid extents into local offset terms, and then re-enters `map_angle_rotate_grid_offset_pair_into_world_offset_pair` `0x00417790` with the caller-supplied heading float to produce the rotated output pair. Current grounded callers include the city-connection placement chooser `0x00402cb0`, the placed-structure local rebuild lane at `0x0040de78`, subtype-`1` placement validation inside `0x004197e0`, and later world-side update branches at `0x00417b6f`, `0x00417e27`, `0x0041a250`, `0x0041a615`, `0x004802c6`, `0x00480875`, and `0x00480d50`. This now looks like the shared projected-footprint offset helper beneath placement validation rather than an unnamed geometry routine. | objdump + caller xrefs + callsite inspection + placement-correlation |
| 46 | 0x004185a0 | 100 | world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Small world-grid mask helper beneath the neighboring projected-rectangle raster family. The helper walks one caller-supplied rectangle from the four dwords rooted at stack arg `+0x04`, reads the aligned float sample band from the caller buffer at stack arg `+0x08`, skips cells whose sample is still the sentinel `0x497423f0`, and otherwise toggles bit `0x01` in the grid-byte mask rooted at `[0x0062c120+0x2135]` by XORing it with the low bit of the caller-supplied byte flag at stack arg `+0x0c`. Current grounded callers are the higher projected-rectangle workers at `0x00418610`, `0x00418a60`, and `0x00418d40`, so this is now bounded as a non-sentinel mask-toggle helper rather than another generic grid writer. | objdump + caller inspection + local disassembly + grid-mask correlation |
| 47 | 0x00418610 | 584 | world_grid_refresh_projected_rect_sample_band_and_flag_mask | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan. | objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation |
| 48 | 0x00418a60 | 372 | placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan. | objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation |
| 49 | 0x00418be0 | 346 | placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper. | objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation |
| 50 | 0x004197e0 | 5232 | placed_structure_validate_projected_candidate_placement | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`. | objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation |
| 51 | 0x00480210 | 448 | placed_structure_construct_linked_site_record_from_anchor_and_coords | map | thiscall | inferred | objdump + caller inspection + constructor inspection | 3 | Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`. | objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation |
| 52 | 0x00413580 | 160 | placed_structure_collection_refresh_quarter_subset_route_style_state | map | thiscall | inferred | objdump + caller inspection + collection-iteration inspection | 3 | Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper computes a start index from the scenario time byte at `0x006cec78+0x11` modulo `4`, then walks every fourth live placed-structure record in the collection, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass. | objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation |
| 53 | 0x00414fa0 | 118 | world_grid_count_flagged_cells_and_collect_float_samples | map | cdecl | inferred | objdump + callsite inspection | 3 | Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues. | objdump + callsite inspection + world-grid scan correlation |
| 54 | 0x00415020 | 1968 | world_grid_refresh_flagged_region_float_extrema_and_mean | map | cdecl | inferred | objdump + caller inspection | 3 | Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper. | objdump + caller inspection + version-gate correlation + world-grid scan correlation |
| 55 | 0x00415f20 | 403 | placed_structure_recursive_collect_connected_component_tile_bounds | map | thiscall | inferred | objdump + caller inspection | 3 | Recursive connected-component bounds collector over linked placed-structure records. Starting from one placed-structure node, the helper expands four caller-owned tile-bound out slots from the record-local rectangle fields `[record+0x4a0..0x4ac]`, tags the record with the current component pass id at `[record+0x73e]`, then walks the component membership map rooted at `0x0062ba7c` to find adjacent records whose packed tile key falls inside the current rectangle and whose prior pass id differs. Matching adjacent records recurse through the same helper until the reachable component rectangle is exhausted. On return the helper also seeds one default local rectangle owner through `0x004159e0` when `[record+0x732] == -1`, then refreshes the neighboring runtime side through `0x0040ee10`. Current grounded callers are the wrapper at `0x004160c0` and internal recursive self-calls. | objdump + caller inspection + recursive-component correlation + placed-structure-bound correlation |
| 56 | 0x004160c0 | 168 | placed_structure_collect_connected_component_tile_bounds_with_version_gate | map | cdecl | inferred | objdump + caller inspection | 3 | Wrapper above `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`. The helper initializes four tile-bound accumulators to sentinel values, increments one world-grid reentry depth counter at `0x0062c120+0x2205`, and then chooses between two paths. On builds `1.03` and earlier, or when scenario field `[0x006cec78+0x46c38]` is still clear, it re-enters the recursive component walk through `0x00415f20`; otherwise it skips that older walk entirely. In both cases it decrements the reentry counter and then expands the surviving rectangle by `2` tiles on each side before publishing it through `0x0044d410`. Current grounded caller is the route-entry-backed component wrapper at `0x004161a0`, so this now looks like the version-gated connected-component bounds collector rather than another generic tracker helper. | objdump + caller inspection + version-gate correlation + connected-component correlation |
| 57 | 0x00416170 | 345 | placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tile-range wrapper above `placed_structure_collect_connected_component_tile_bounds_with_version_gate` `0x004160c0`. The helper seeds the current connected-component pass keys at `0x0062ba7c` and `0x0062ba80`, iterates the caller-supplied tile rectangle, allocates or reuses one small per-tile record from the caller-owned queue, and looks up the packed `(row << 16) | col` key through the component map rooted at `0x0062ba7c` via `0x0053dae0`. When one mapped component record exists and the current placed-structure owner at stack arg `+0x0c` still has `[site+0x732] == -1`, the world-side latch at `[0x0062b2fc+0x9c]` is clear, scenario field `[0x006cec74+0x4fd]` is clear, and the caller-supplied suppress-refresh flag at stack arg `+0x10` is zero, it follows the mapped component chain and re-enters `0x004160c0` for each linked record; otherwise it clears one world-grid byte through `0x00448a70`. The resolved or refreshed record is then stored back through `0x0053d9e0` and `0x0053d960`. Current grounded callers are the neighboring local-runtime passes at `0x00418a60` and `0x00418be0`, so this is now the strongest current owner for mapping one tile rectangle into connected-component records with optional bounds refresh rather than another bare recursive walk. | objdump + caller inspection + local disassembly + connected-component-map correlation |
| 58 | 0x00416e20 | 156 | indexed_collection_resolve_live_entry_id_by_stem_string | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small live-entry resolver over an indexed collection. The helper walks the live slot count through `indexed_collection_slot_count` `0x00517cf0`, fetches each live id through `indexed_collection_get_nth_live_entry_id` `0x00518380`, resolves the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and compares the caller-supplied string against the record stem at `[record+0x04]` through `0x005a57cf`. On success it returns the matching live id. On failure it emits localized id `189` through the shell string helpers and returns `-1`. Current grounded callers are the neighboring placed-structure local-runtime builders at `0x00418be0` and `0x0040e450`, plus one shell-side branch at `0x00507e80`, so this is now the strongest current match for a stem-to-live-id resolver rather than an unowned search loop. | objdump + caller inspection + local disassembly + stem-compare correlation |
| 59 | 0x00416ec0 | 1867 | placed_structure_build_projected_runtime_scratch_from_candidate_and_coords | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavy projected-runtime scratch builder beneath the neighboring local placed-structure runtime family. The helper resolves one candidate record from the caller-supplied id, derives rotated footprint extents and centered world-space bounds from the caller-supplied coordinate and heading inputs, allocates and clears several temporary per-footprint mask bands on the stack, then walks up to four candidate-side shape or access sublanes rooted at `[candidate+0xcf]`, `[candidate+0xd3]`, `[candidate+0xd7]`, and `[candidate+0xdb]`. Within that deeper loop it projects rotated footprint cells through the basis pair at `0x006d4024`, rejects out-of-bounds or duplicate cells, checks multiple world-grid acceptance gates through `0x00448af0`, `0x00534e10`, `0x004499c0`, and `0x00413df0`, and marks the surviving cells into both temporary stack masks and the live world-grid byte lane at `[0x0062c120+0x2131]`. The tail publishes the finished scratch payload through `0x00416620`. Current grounded caller is `0x00418be0`, which then copies that scratch block into one queued local runtime record, so this is now the safest current name for the projected-runtime scratch builder rather than a generic placement validator. | objdump + caller inspection + local disassembly + projected-footprint correlation |
| 60 | 0x00418040 | 1168 | placed_structure_render_local_runtime_overlay_payload_from_projected_bounds | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavy local-runtime overlay-payload builder beneath the broader local-runtime record family. The helper derives one projected bounds rectangle through `0x004142e0` and `0x00417f20`, rejects very small payloads, allocates one temporary dword buffer, folds that buffer through `0x00415370`, and then walks the projected rectangle producing one packed dword payload per cell. Current bounded gates include a duplicate-entry or occupancy fast path keyed by `[var_10h]`, world-grid rejection through `0x004499c0`, and several distance- and ratio-shaped thresholds built from the projected rectangle geometry. On accepted cells it writes one four-byte packed value into the caller output stream. Current grounded caller is `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` `0x00418be0`, where the result is stored into `[0x0062b7c8]`, so this is now the safest current read for the local-runtime overlay payload renderer rather than a generic geometric sweep. | objdump + caller inspection + local disassembly + overlay-payload correlation |
| 61 | 0x00414470 | 10 | placed_structure_cache_projected_rect_profile_slot_id | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tiny setter for the projected-rectangle profile-slot cache at `0x005ee030`. The helper just stores the caller-supplied dword into that global cache. Current grounded caller is `0x0040e450`, where the cached value is set immediately before the current-subject local-runtime clone path at `0x00418a60`. | objdump + caller inspection + local disassembly + global-cache correlation |
| 62 | 0x00416620 | 521 | placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Publishes one projected-runtime rectangle and its companion globals beneath the local-runtime scratch builder. The helper copies the current scratch owner id from `0x0062b304` into `0x0062b308`, stores the caller-supplied pair into `0x0062b30c/0x0062b310`, grows the active rectangle bounds at `0x0062b7ac` and `0x0062b7b4` when needed, clears one current index slot in `0x0062b318`, and then validates the rectangle against the route-entry store `0x006cfca8` through `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`. On failure it raises localized id `185`; on one special-candidate branch keyed by `[record+0x123]` it re-enters `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, either expands the rectangle by three cells on each side and refreshes the per-cell side tables through `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` or fails with localized id `186`; and on the ordinary branch it can scan the temporary cell-value bank at `0x0062b300` across the rectangle and fail with localized id `187` before again tailing into `0x00414e10`. Current grounded callers are `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0` and the placement validator `0x004197e0`, so this now looks like the projected-runtime rectangle publisher plus side-window validator rather than an anonymous scratch tail. | objdump + caller inspection + local disassembly + projected-rectangle-global correlation |
| 63 | 0x00415570 | 317 | placed_structure_try_select_projected_rect_profile_slot | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Small projected-rectangle profile selector beneath `0x00416620`. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, resets the shared slot id at `0x0062ba3a`, derives one companion value through `0x00413eb0` into `0x0062ba3e`, and then probes the current rectangle at `0x0062b7a8..0x0062b7b4` through repeated `0x004153f0` checks. One fast path reuses the cached selector at `0x005ee030`; another starts from localized id `11` through `0x00518be0`; and both update `0x0062ba3a` on success. Current grounded caller is the special-candidate branch inside `0x00416620`, where the returned success decides whether the rectangle can be expanded and the companion byte tables refreshed. This is therefore best-read as a projected-rectangle profile-slot selector rather than a broad route or placement policy helper. | objdump + caller inspection + local disassembly + rectangle-probe correlation |
| 64 | 0x00414e10 | 200 | world_grid_refresh_projected_rect_surface_and_region_byte_tables | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan. | objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation |
| 65 | 0x00494240 | 195 | route_entry_collection_query_rect_window_passes_entry_type_gate | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan. | objdump + caller inspection + local disassembly + route-entry-window correlation |
| 66 | 0x00411ee0 | 451 | structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables | map | thiscall | inferred | objdump + callsite inspection | 3 | Rebuilds the per-candidate cargo summary tables after one runtime descriptor array has been materialized. The helper clears the two cargo-id pointer tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and one float-like per-cargo accumulator band rooted at `[this+0x0a1]`, then walks every live `0xbc` descriptor in `[this+0x37]` against the current scenario year at `[0x006cec78+0x0d]`. For each active subordinate cargo row in the descriptor-owned `0x1c`-byte entry band it resolves one cargo id through the global cargo collection at `0x0062ba8c`, updates the per-cargo accumulator, and tracks one or two levels of cargo membership before compacting those marks into the two emitted cargo-id tables. The stronger production-mode result is now bounded here rather than only in the editor importer: when the descriptor-side mode flag at `[desc+0x00]` is zero the subordinate row amount is multiplied by the shared recipe-book production cap at `[this+0x2a]` and divided by the descriptor amount at `[desc+0x04]`; when that mode flag is nonzero the helper bypasses that scaling path. That matches the editor-side split where production mode keeps the entered annual amount on the supply half while the demand half is normalized to `1.0`, so the demand-side production branch now looks like a normalized input selector or gate while the supply side is the branch that receives cap-scaled runtime rates. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`. | objdump + callsite inspection + scenario-state correlation + cargo-collection correlation |
| 67 | 0x00412560 | 144 | structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When the runtime cargo-economy latch at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`. | objdump + caller xrefs + callsite inspection + cargo-collection correlation |
| 68 | 0x004125f0 | 87 | structure_candidate_count_active_scaled_supply_descriptors | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Counts active runtime descriptors that participate in the scaled supply-side production lane for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, selects only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active scaled-supply descriptors. | objdump + caller xrefs + callsite inspection |
| 69 | 0x00412650 | 543 | structure_candidate_query_cargo_runtime_summary_channels | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, then walks every live `0xbc` descriptor across two mode banks through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. Demand-side descriptors with nonzero mode dword accumulate subordinate-row weights into the bank rooted at `[this+0x10e]`; direct supply descriptors with no subordinate rows accumulate annual amounts into `[this+0x03a]`; and scaled supply descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, then publish the per-descriptor share into `[this+0x0a4]` and the subrow-scaled outputs into `[this+0x178]`. The helper finally returns one caller-selected cargo entry from all four banks through out-pointers, so current grounded meaning is one direct-supply channel, one cap-normalized supply channel, one demand or input channel, and one scaled production-output subrow channel rather than a single aggregate total. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`. | objdump + caller xrefs + callsite inspection + scenario-state correlation |
| 70 | 0x004129d0 | 179 | structure_candidate_supports_or_references_cargo_id | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. Current grounded caller is the placed-structure sweep around `0x00452e60`, where the result gates per-instance activation against one requested cargo id. | objdump + caller xrefs + callsite inspection + cargo-summary correlation |
| 71 | 0x00412d70 | 563 | structure_candidate_collection_rebuild_runtime_records_from_scenario_state | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062ba8c`. The helper iterates the collection twice against the paired availability bytes at `[candidate+0xba]` and `[candidate+0xbb]`, chooses one existing record to clone when the scenario-side owner id at `[candidate+0x794]` matches, otherwise clears the target record, and then repopulates the candidate runtime fields from the active scenario state rooted at `0x006cec78`. For each rebuilt candidate it copies the recipe-line count from `[state+0x1024]`, the shared production-cap float from `[state+0x13d4]`, and the packed `0xbc` descriptor array from `[state+0x1028]`, then refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` at `0x00411ee0` and the neighboring mode-flag pass at `0x00411ce0`. One bounded text side branch also republishes the candidate label from the scenario-side recipe-book name around `[state+0x0fe8]` when that string ends in `:`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` at `0x00435630` and the larger collection load path at `0x00412fb0`, so this now looks like the candidate-side bridge that projects editor recipe-book state into live runtime records rather than another generic collection copy loop. | objdump + caller xrefs + callsite inspection + scenario-state correlation |
| 72 | 0x00412ca0 | 192 | world_region_pick_commercial_profile_label_by_region_rank | map | thiscall | inferred | objdump + strings + callsite inspection | 4 | Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`. | objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings |
| 73 | 0x004133b0 | 132 | placed_structure_collection_refresh_local_runtime_records_and_position_scalars | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b26c` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller is no longer just an anonymous raw callsite: it sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep. | objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation |
| 74 | 0x00413f50 | 47 | placed_structure_local_runtime_site_id_queue_pop_next | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt. | objdump + caller inspection + local disassembly + local-runtime-queue correlation |
| 75 | 0x00414480 | 6 | placed_structure_local_runtime_site_id_queue_count | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tiny count getter over the temporary placed-structure id queue used by the local-runtime refresh family. The helper simply returns the current queue count at `0x0062ba64`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the returned count bounds the queue-drain loop before the later all-sites side refresh. | objdump + caller inspection + local disassembly + local-runtime-queue correlation |
| 76 | 0x0041e8e0 | 63 | structure_candidate_collection_write_filter_and_year_visible_summary_blocks | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small packed-state write wrapper over the live structure-candidate collection at `0x0062ba8c`. The helper opens two tagged packed blocks through `0x00531360` with ids `0x6979` and `0x697a`, forwards the caller's packed-state sink plus side flag into `0x00518680`, and returns the combined emitted size. Current grounded caller is the later world-entry or restore-side branch at `0x00444375`, immediately after the candidate-count refresh family has run, so this is the safest current read for the candidate-summary packed-state write sibling rather than a direct count recompute helper. | objdump + local disassembly + caller correlation + packed-state correlation |
| 77 | 0x0041e930 | 48 | structure_candidate_collection_read_filter_and_year_visible_summary_blocks | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small packed-state read wrapper over the same structure-candidate summary family at `0x0062ba8c`. The helper opens the tagged blocks `0x6979` and `0x697a` through `0x00531340`, forwards the caller's packed-state source plus side flag into `0x00517d90`, and returns after both reads complete. Current grounded caller is the neighboring world-entry-side branch at `0x00445226`, which uses this read-side companion after shell service and before later post-load status updates, so this is the safest current read for the candidate-summary packed-state import sibling rather than a direct filter refresh helper. | objdump + local disassembly + caller correlation + packed-state correlation |
| 78 | 0x0041e970 | 121 | structure_candidate_collection_refresh_filter_and_year_visible_counts | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide counter refresh over the live structure-candidate pool at `0x0062ba8c`. The helper clears aggregate counts `[this+0x242]` and `[this+0x31a]`, then walks all `0x35` candidate slots through the collection accessors. For each live slot it stores the cargo-economy or editor-filter flag `[entry+0x56]` into one per-slot band rooted at `[this+0x246]`, increments `[this+0x31a]` when that flag is nonzero, re-enters `structure_candidate_is_enabled_for_current_year` `0x0041e220`, stores that result into the paired per-slot band rooted at `[this+0x16e]`, and increments `[this+0x242]` when the year-visible gate succeeds. Current grounded callers include the periodic boundary-service path at `0x0040a56a`, the post-fast-forward setup tail at `0x00437192`, the cargo-economy filter refresh family at `0x0041eac0/0x0041f584`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring locomotive-side bridge at `0x00464aa8`, so this is the safest current read for the shared candidate-collection filter and year-visible count rebuild rather than a one-off world-entry helper. | objdump + local disassembly + caller correlation + candidate-count correlation + year-visible correlation |
| 79 | 0x0041ea50 | 179 | world_setup_building_collection_phase | map | cdecl | inferred | objdump + strings + callsite inspection | 3 | Post-load world-generation subphase inside world_run_post_load_generation_pipeline. The helper iterates the building-related collection at `0x0062ba8c`, chooses either the full pass or one modulo-selected bucket from the current world byte at `[0x006cec78+0x0f]`, resolves each entry through `0x00518380` and `0x00518140`, and then dispatches the selected record into the lower setup worker at `0x0041e2b0`. Current grounded callsite is the early collection sweep inside world_run_post_load_generation_pipeline immediately before the localized progress update `Setting up Players and Companies...`, so this looks like the collection-owned building-setup staging phase rather than one of the later player-speed or shell-frame loops. | objdump + caller context + RT3.lng strings |
| 80 | 0x0041e220 | 52 | structure_candidate_is_enabled_for_current_year | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper. | objdump + caller xrefs + callsite inspection + cargo-economy filter correlation |
| 81 | 0x0041e650 | 142 | structure_candidate_query_route_style_or_local_availability_metric | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + collection-correlation | 3 | Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader. | objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation |
| 82 | 0x00467eb0 | 104 | placed_structure_route_link_attach_site_owner | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Attaches one `0x006ada90` route-link record onto the owner chain of one placed structure. The helper first detaches the current record through `0x00467df0`, stages the caller-supplied placed-structure id into route-link field `+0x0a`, links the record into the placed-structure-owned chain at `[site+0x272]` through route-link field `+0x04`, and then re-enters `0x00467c30` to recompute the route-link flag byte at `+0x12` against neighboring site pairs. When that flag byte keeps bit `0x2` set, the helper also projects one class-indexed signed contribution through `0x0040fa50` and accumulates it into the placed structure through `0x0042b310`. Current grounded caller is the route-link allocator path at `0x00468067`, which makes this the clearest current owner bridge from one freshly allocated `0x006ada90` record into the site-linked chain later scanned by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` and `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650`. | objdump + caller xrefs + chain-layout inspection + route-link-correlation |
| 83 | 0x00467df0 | 183 | placed_structure_route_link_detach_current_owner_chain | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Detaches one `0x006ada90` route-link record from whichever owner chain currently anchors it. The helper first checks route-link field `+0x08`; when nonzero it treats that field as one route-node-like owner id in collection `0x006cfcbc` and unlinks the record through owner field `+0x04` plus route-node link slot `+0x29`. Otherwise it falls back to the placed-structure owner path, using route-link field `+0x0a` as one site id in collection `0x0062b26c`, optionally applying the same class-indexed signed contribution rollback through `0x0040fa50` and `0x0042b310` when flag byte `+0x12` keeps bit `0x2` set, and then unlinking through `[site+0x272]`. Current grounded callers are the site-owner attach path at `0x00467eb0`, the route-node attach path at `0x00467f20`, and the route-link destructor path at `0x004680b0`, so this now looks like the shared detach helper beneath all owner-chain rewrites for the route-link family. | objdump + caller xrefs + chain-layout inspection + owner-slot correlation |
| 84 | 0x00467c30 | 443 | placed_structure_route_link_recompute_endpoint_pair_state | map | thiscall | inferred | objdump + caller xrefs + endpoint-pair inspection | 3 | Recomputes the route-link state byte at `+0x12` from the active site-endpoint pair and updates the linked site contribution when that state flips. The helper only runs on the site-owned branch where route-link field `+0x08` is zero; it resolves the two endpoint site ids from fields `+0x0a` and `+0x0e` through collection `0x0062b26c`, clears the prior bit-`0x2` state, then compares the two endpoint-side route-entry chains through `0x00455f60`, `0x0047de00`, `0x0040c990`, and `0x0047f2d0` until it finds a compatible shared peer. On the first match it restores bit `0x2` in the state byte. If the boolean substate derived from bit `0x1` changes across the recomputation, the helper applies one signed class-indexed contribution through candidate class byte `+0x10`, the class-weight table at `0x0062ba8c+0x8e`, and `0x0042b310` against the first endpoint owner. Current grounded callers are the site-owner attach path `0x00467eb0`, the route-link rebuild sweep around `0x004682e6`, and the route-link allocator path at `0x0046809b`, so this now looks like the endpoint-pair state reconciler beneath the route-link family rather than a generic chain walk. | objdump + caller xrefs + endpoint-pair inspection + shared-peer correlation |
| 85 | 0x00467f20 | 45 | placed_structure_route_link_attach_route_node_owner | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Attaches one `0x006ada90` route-link record onto the owner chain of one route-node-like record in collection `0x006cfcbc`. The helper first detaches the current record through `0x00467df0`, then stages the caller-supplied route-node id into route-link field `+0x08` and links the route-link through owner field `+0x04` plus route-node link slot `+0x29`. Current grounded caller is the route-node-side rewrite path at `0x004680e0`, which keeps this as the route-node owner companion to `placed_structure_route_link_attach_site_owner` rather than another site-chain helper. | objdump + caller xrefs + chain-layout inspection + route-node-owner correlation |
| 86 | 0x00467f50 | 352 | placed_structure_route_link_allocate_site_pair_for_candidate_class | map | cdecl | inferred | objdump + caller xrefs + stack-layout inspection + class-counter correlation | 3 | Allocates and seeds one new `0x006ada90` route-link record for a caller-supplied placed-structure pair and candidate class. The helper builds one `0x19`-byte local template whose current grounded creation-side writes seed route-link fields `+0x0c` and `+0x0e` from the two input site ids, class byte `+0x10` from the supplied candidate-class argument, and one masked initial state template from the class side table at `0x005f2adc[class]`. It then allocates the live record from the route-link collection, attaches it to the first site through `placed_structure_route_link_attach_site_owner` `0x00467eb0`, increments the grouped class counters at `[class_record+0x5a]` and `[class_record+0x5e]` through the candidate-class table at `0x0062ba8c+0x8e`, and finally re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current direct creation-side caller is `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0`, while grounded internal calls land at `0x00468067` and `0x0046809b`; this is therefore the strongest current owner for creation-side site-pair seeding in the route-link family. | objdump + caller xrefs + stack-layout inspection + class-counter correlation + route-link-collection correlation |
| 87 | 0x004680b0 | 96 | placed_structure_route_link_release_and_detach | map | thiscall | inferred | objdump + caller xrefs + class-counter correlation | 3 | Releases one live `0x006ada90` route-link record's class-side counters and then detaches it from its current owner chain. The helper resolves the candidate-class record from route-link byte `+0x10` through `0x0062ba8c+0x8e`, subtracts the fixed creation-side increment from `[class_record+0x5a]`, then chooses one of the two trailing accumulator slots `[class_record+0x62]` or `[class_record+0x66]` by testing state byte `+0x12 & 0x1`. After that class-side rollback it tails into `placed_structure_route_link_detach_current_owner_chain` `0x00467df0`. Current grounded caller is the route-link collection sweep around `0x004681ae`, which keeps this as the clearest release-side companion to `placed_structure_route_link_allocate_site_pair_for_candidate_class` rather than another attach helper. | objdump + caller xrefs + class-counter correlation + detach-tail correlation |
| 88 | 0x00468110 | 39 | placed_structure_route_link_collection_construct | map | thiscall | inferred | objdump + world-bringup correlation + collection-layout inspection | 3 | Constructs the world-side route-link collection later published at `0x006ada90`. The helper seeds the collection vtable at `0x005ce130`, then initializes one indexed collection through `0x00518570` with grounded parameters `(record_size=0x19, initial_slots=0x64, growth=0x64, id_base=1)`. Current grounded caller is the world bring-up path at `0x004488a3`, where the resulting manager is stored into `0x006ada90` beside the placed-structure and candidate collections. This is the strongest current owner name for the record family later scanned by the route-style overlay and availability helpers. | objdump + world-bringup correlation + collection-layout inspection + manager-publication correlation |
| 89 | 0x00468140 | 18 | placed_structure_route_link_collection_destroy | map | thiscall | inferred | objdump + world-shutdown correlation + collection-layout inspection | 3 | Destroys the world-side route-link collection rooted at `0x006ada90`. The helper restores the same collection vtable at `0x005ce130`, releases the indexed-collection payload through `0x00518600`, and then tails into the common collection teardown at `0x00518bd0`. Current grounded callers are the global world-shutdown path at `0x0044931d` and the route-link collection sweep at `0x004681ae`, which keep this as the clear destructor companion to `placed_structure_route_link_collection_construct`. | objdump + world-shutdown correlation + collection-layout inspection + manager-publication correlation |
| 90 | 0x004681f0 | 100 | placed_structure_route_link_collection_remove_links_touching_site_id | map | thiscall | inferred | objdump + caller xrefs + field-match inspection | 3 | Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose grounded site-reference triple matches one caller-supplied placed-structure id. The helper walks the live route-link collection and deletes any record whose `u16` fields at `+0x0a`, `+0x0c`, or `+0x0e` equal the requested id, reusing the collection erase vfunc for each match. Current grounded callers include the placed-structure teardown path at `0x0040e23b`, where the supplied id comes from `[site+0x2a4]`, so this now looks like the site-side cleanup companion for the route-link family rather than a generic collection filter. | objdump + caller xrefs + field-match inspection + site-cleanup correlation |
| 91 | 0x00468260 | 84 | placed_structure_route_link_collection_remove_links_by_route_node_id | map | thiscall | inferred | objdump + caller xrefs + field-match inspection | 3 | Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose route-node owner field at `+0x08` matches one caller-supplied id. The helper walks the live route-link collection, compares each record's `u16` field `+0x08` against the requested route-node id, and erases matching records through the same collection vfunc used by the broader cleanup paths. Current grounded caller is the neighboring runtime teardown at `0x004acf03`, which keeps this as the route-node-side cleanup companion to `placed_structure_route_link_collection_remove_links_touching_site_id` rather than another site sweep. | objdump + caller xrefs + field-match inspection + route-node-cleanup correlation |
| 92 | 0x004682c0 | 58 | placed_structure_route_link_collection_recompute_all_endpoint_pair_state | map | thiscall | inferred | objdump + caller inspection + collection-iteration inspection | 3 | Collection-wide recompute sweep over the live `0x006ada90` route-link family. The helper iterates every live route-link id through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` on each resolved record. This is the clean whole-collection state refresh companion to the per-record recompute helper rather than another allocator or cleanup path. | objdump + caller inspection + collection-iteration inspection + recompute-helper correlation |
| 93 | 0x00468300 | 235 | placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state | map | thiscall | inferred | objdump + caller inspection + world-grid correlation + collection-iteration inspection | 3 | Higher-level rebuild pass above the route-link family that resets the route-style world-grid counters and then recomputes live endpoint state across `0x006ada90`. The helper first reads three candidate-class ids from the structure-candidate side table at `0x0062ba8c+0x88/+0x8a/+0x8c`, walks the active world-grid tables rooted at `[0x0062c120+0x2129]`, and clears the aligned per-cell dword lanes at offset `+0x103` for those three classes. It then iterates every live route-link record in `0x006ada90`, clears state bit `0x2` in each record's flag byte at `+0x12`, and re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current grounded callers include the recurring simulation-maintenance branch at `0x0040a575`, the world bring-up side near `0x00444b2f`, and one later world-side update path at `0x00481157`, which makes this the clearest current owner of the full-family route-style counter-and-state rebuild rather than just another collection walk. | objdump + caller inspection + world-grid correlation + collection-iteration inspection + route-style-class correlation |
| 94 | 0x0041e2b0 | 589 | structure_candidate_rebuild_local_service_metrics | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `world_setup_building_collection_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate. | objdump + caller xrefs + callsite inspection + world-grid correlation |
| 95 | 0x0042db20 | 1040 | scenario_event_refresh_runtime_record_from_packed_state | scenario | thiscall | inferred | objdump + caller inspection + local disassembly + shell-event-window correlation | 2 | Heavy per-event runtime materializer beneath the live event collection at `0x0062be18`. The helper reads one packed event definition from the caller-supplied state or stream object, conditionally clears and repopulates several fixed text bands on the destination event record at offsets such as `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, then rebuilds two event-runtime row families from caller-supplied counts and packed row payloads. Current shell-side xrefs now tighten that split. The first family allocates `0x1e`-byte rows, fills scalar and byte fields from the packed source, conditionally extends the row on later-format branches, remaps bounded id ranges through the live structure-candidate collection `0x0062ba8c`, and links the resulting rows through one standalone event-side list anchor; the adjacent helper cluster `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is only consumed by `EventConditions.win`, so this first family now reads as the runtime condition-row list. The second family repeats the same materialization pattern with `0x28`-byte rows across four grouped slots on the destination event record, applying version-gated field extension and bounded remap logic against the locomotive collection `0x006ada84`, the live structure-candidate collection `0x0062ba8c`, and the global candidate pool `0x0062b268` before linking each rebuilt row into one of four grouped list anchors; the generic deep-copy helper `0x0042e050` now clones those same grouped lists during event duplication, so this second family still reads as the grouped event-effect row side rather than another condition list. Current grounded caller is the collection-wide wrapper `0x00433130`, so this is now the safest current read for one live event's runtime-record refresh from packed scenario-state data rather than a generic collection helper. | objdump + caller inspection + local disassembly + event-record materialization correlation + candidate-and-locomotive-remap correlation + shell-event-window correlation |
| 96 | 0x0042d700 | 59 | scenario_event_query_standalone_condition_row_list_class_and_modifier_flags | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + local disassembly | 2 | Aggregates the class and modifier bits implied by one live event's standalone `0x1e`-row condition list. The helper first short-circuits to literal `0x7f` when event byte `[event+0x82b]` is set, then otherwise walks the list rooted at `[event+0x00]`, OR-ing the static row-class byte from `0x005f3e04 + id*0x81` for ordinary nonnegative row ids and using the negative-id fallback branch only to preserve special marker value `0x7f`. Current grounded callers are the condition-window summary refreshes `0x004d9970` and the broader control refresh `0x004da0f0`, so this is the safest current read for the standalone condition-list class or modifier aggregate rather than a generic linked-list scan. | objdump + EventConditions.win refresh correlation + local disassembly + condition-row-class-table correlation |
| 97 | 0x0042d740 | 87 | scenario_event_query_grouped_effect_row_list_type_flags | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + local disassembly | 2 | Aggregates one grouped effect-row type bitfield for a live event. The caller supplies the grouped list ordinal on the stack, and the helper walks the selected grouped anchor at `[event + group*4 + 0x04]`, OR-ing one descriptor byte from `0x006103fd + opcode*0x6e` across the linked `0x28`-row family. One caller-controlled boolean also enables a narrower normalization path that remaps a small special opcode subset to shared bit `0x08` before the OR step. Current grounded callers are the conditions-window refresh family `0x004d9d10` and `0x004da0f0`, plus one world-side branch at `0x00431120`, so this is the safest current read for grouped effect-row type flags rather than a standalone condition helper. | objdump + EventConditions.win refresh correlation + local disassembly + grouped-effect-descriptor correlation |
| 98 | 0x0042df30 | 63 | scenario_event_condition_row_list_has_class_bit0_or_flag7f9_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Tiny predicate over the standalone `0x1e`-row event-condition list rebuilt by `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. The helper walks the linked list rooted at the caller-supplied event record, tests each nonnegative row id against class-bit `0x01` in the static per-condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7f9]`. Current grounded callers are the `EventConditions.win` refresh path at `0x004da19a` and `0x004da23c`, so this now reads as the class-bit-0 condition-summary gate rather than a generic list scan. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 99 | 0x0042df70 | 63 | scenario_event_condition_row_list_has_class_bit1_or_flag7fa_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x02` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7fa]`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da1de`, so this now reads as the class-bit-1 condition-summary gate rather than another anonymous list helper. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 100 | 0x0042dfb0 | 62 | scenario_event_condition_row_list_has_class_bit2_or_type63_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to the event-record dword check `[event+0x7f0] == 0x63`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da2be`, so this now reads as the class-bit-2 condition-summary gate rather than another generic scan. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-type correlation |
| 101 | 0x0042dff0 | 82 | scenario_event_condition_row_list_has_any_class_bit012_or_special_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Broad predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as the smaller `0x0042df30/0x0042df70/0x0042dfb0` family, tests each nonnegative row id against any of class bits `0x01|0x02|0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to any of the three special event-record checks `[event+0x7f9]`, `[event+0x7fa]`, or `[event+0x7f0] == 0x63`. Current grounded caller is the early `EventConditions.win` refresh gate at `0x004da17d`, so this now reads as the broad condition-summary eligibility probe rather than a generic linked-list walk. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 102 | 0x0042e050 | 603 | scenario_event_clone_runtime_record_deep_copy | scenario | cdecl | inferred | objdump + caller xrefs + local disassembly + shell-event-window correlation | 2 | Deep-copy helper for one already-materialized live event runtime record. The helper copies the six fixed text bands at destination offsets `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, mirrors the compact event metadata band at `+0x7ee..+0x80e`, then deep-copies the standalone `0x1e`-row linked list and the four grouped `0x28`-row linked lists from one live event-runtime record into the caller-supplied destination record. Current grounded caller is `shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal` `0x004db8b0`, where it clones the currently selected live event into a newly created event record before selector refresh. This is therefore the safest current owner for deep-copy of an already-materialized event runtime record rather than another packed-state loader or an effects-only staging helper. | objdump + caller xrefs + local disassembly + shell-event-window correlation + deep-copy correlation |
| 103 | 0x0042c1b0 | 886 | placed_structure_redistribute_local_service_pressure_from_neighbors | map | thiscall | inferred | objdump + caller xrefs + neighborhood sweep inspection | 3 | Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop. | objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation |
| 104 | 0x0041eac0 | 794 | structure_candidate_collection_refresh_cargo_economy_filter_flags | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + rdata strings | 3 | Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and one neighboring mode gate at `[0x006cec78+0x4afb]`, and writes the resulting enabled-or-filtered state into `[entry+0x56]` before re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule into live structure-candidate filtering rather than a purely editor-side helper. | objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation |
| 105 | 0x00421b60 | 180 | world_region_collection_seed_default_regions | map | thiscall | inferred | objdump + strings + callsite inspection | 4 | Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup. | objdump + RT3.lng strings + caller xrefs + callsite inspection |
| 106 | 0x00421c20 | 187 | world_region_collection_run_building_population_pass | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup. | objdump + caller xrefs + callsite inspection |
| 107 | 0x0041f9b0 | 125 | world_region_count_structure_profiles_before_year_for_category | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Counts region-subcollection structure profiles whose backing candidate resolves through `0x00412b70`, passes the availability gate at `0x0041f998`, matches one caller-selected category byte, and has threshold year `[profile+0x26]` less than or equal to the caller-supplied year. Current grounded callers include the region stats path at `0x004cbd41`, where category `2` feeds the localized `Industry Weightings` report, and the deeper per-region worker at `0x004235c0`, where the same count bounds demand for the weighted category-2 profile family. | objdump + caller xrefs + callsite inspection + RT3.lng strings |
| 108 | 0x0041fa30 | 133 | world_region_find_named_structure_profile_weight | map | thiscall | inferred | objdump + strings + caller xrefs | 3 | Looks up one named structure profile in the current region subcollection `[region+0x37f]`. The helper linearly compares the caller-supplied text against each profile label and returns the float-like weight at `[profile+0x1e]` for the first exact match, otherwise `0.0`. The same region-subcollection string block is now partially grounded from nearby `.rdata` as labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, `Fertilizer Factory`, and `farm`. Current grounded callers sit in world-side UI or telemetry branches around `0x004cbb74`, `0x004cc054`, and `0x004ccc54`. | objdump + caller xrefs + rdata strings |
| 109 | 0x0041fac0 | 60 | world_region_read_structure_profile_label_and_weight_by_index | map | thiscall | inferred | objdump + caller xrefs + strings | 4 | Reads one 1-based structure-profile entry from the current region subcollection `[region+0x37f]`. It copies the profile label string into the caller buffer and writes the float-like weight at `[profile+0x1e]` into the caller-provided out-slot. This is the label/value helper used beneath the region structure-demand worker and the adjacent UI or telemetry callers. The grounded profile-name block around `0x005c9100` now includes labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, and `Fertilizer Factory`. | objdump + caller xrefs + rdata strings |
| 110 | 0x00422320 | 1320 | world_region_normalize_cached_structure_balance_scalars | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Collection-wide region normalization pass over the live region manager `0x0062bae0`. The helper first early-outs in sandbox/editor-side mode through `[0x006cec7c+0x82]` and the active-mode latch `[0x006cec78+0x4aef]`, then runs one per-region prepass through `0x00420d40`, and finally performs two cohort sweeps split by region live byte `[region+0x23e]`. Across those sweeps it accumulates the cached scalar bands `[region+0x2b2/+0x2b6/+0x2ba/+0x2be/+0x2c2/+0x2c6]`, derives bounded normalization ratios, and writes the resulting cached growth-balance band back to `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. The player-facing meaning is tighter now from the editor growth report at `0x004d1d60`: `[region+0x2e2]` is the cached weighted-profit-margin scalar and `[region+0x2ee]` is the cached annual-density-adjust scalar later formatted as a percent, while `[region+0x2e6]` and `[region+0x2ea]` are the intermediate normalized-delta and clamped companion slots beneath that final annual-density adjust. The helper also uses world_region_count_linked_placed_structures_by_category `0x004228b0` as the direct category-count companion during the writeback sweep, and it applies one final live-value adjustment into `[region+0x25e]` when the shell latch `[0x006cec78+0x46c38]` is clear. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a265` inside `simulation_service_periodic_boundary_work` `0x0040a590`, so this is now the safest current read for the region cached growth-balance normalization pass rather than a one-time setup helper. | objdump + local disassembly + caller inspection + recurring-maintenance correlation + editor-growth-report correlation |
| 111 | 0x004228b0 | 68 | world_region_count_linked_placed_structures_by_category | map | thiscall | inferred | objdump + local disassembly | 3 | Counts linked placed-structure records in the current region entry whose category byte matches one caller-supplied value. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and increments one simple match count without applying the heavier cap or availability filters used by `0x00422be0`. The current grounded local caller is the broader region-side worker around `0x00422320`, where this helper is used as the direct category-count companion to the later aggregate and placement passes rather than as a full demand-balancing gate. | objdump + local disassembly + local caller correlation |
| 112 | 0x00422900 | 352 | world_region_accumulate_structure_category_totals | map | thiscall | inferred | objdump + callsite inspection | 3 | Aggregates the current structure-category totals for one region entry. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and returns both counts and accumulated weight-like totals across four categories via the caller-provided out-pointers. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the outputs feed the later demand-balancing logic for the region-owned building-population pass. | objdump + callsite inspection |
| 113 | 0x00422a70 | 355 | world_region_validate_and_commit_candidate_placement | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Shared placement-validation and commit gate beneath the region candidate-placement family. The helper takes one region entry in `ECX`, one candidate or profile id on the stack, one candidate world-coordinate pair, one caller-controlled side flag, one direct-versus-staged commit flag, and one optional out-pointer for the created placed-structure id. It first clears the optional out-slot, conditionally snaps the candidate coordinate pair to integers under the preview gate `0x434050 -> 0x46d2b0`, then validates projected placement through `placed_structure_validate_projected_candidate_placement` `0x004197e0`. On the direct-commit lane it additionally resolves the candidate world cell through `0x0044a800` and requires that cell's region id to match `[region+0x23a]`. When placement is allowed and the shell-side latch `[0x006cec78+0x46c3c]` is clear, one branch emits the staged side path through `0x0046d260`; otherwise it commits directly through `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` and stores the resulting placed-structure id in the caller's out-slot. Current grounded callers are `world_region_try_place_candidate_structure` `0x00422ee0` and the world-side randomized batch helper `world_try_place_random_structure_batch_from_compact_record` `0x00430270`, so this is best read as the shared region-side candidate-placement validator and commit gate rather than as one region-worker-private helper. | objdump + local disassembly + caller correlation + placement-validator correlation |
| 114 | 0x00422be0 | 768 | world_region_count_placed_structures_for_category | map | thiscall | inferred | objdump + callsite inspection | 3 | Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen. | objdump + callsite inspection |
| 115 | 0x00422ee0 | 884 | world_region_try_place_candidate_structure | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family. | objdump + caller xrefs + callsite inspection |
| 116 | 0x004235c0 | 1887 | world_region_balance_structure_demand_and_place_candidates | map | thiscall | inferred | objdump + callsite inspection | 4 | Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, queries projected structure-count scalars through `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0`, and then computes target demand for three structure categories by comparing those projected totals against live placed counts plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop. | objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation + projected-demand correlation |
| 117 | 0x004234e0 | 211 | world_region_query_projected_structure_count_scalar_by_category | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Returns one projected structure-count scalar for the requested region and category family. On the live-region branch `[region+0x23e] != 0`, the helper indexes the category table at `0x005ee1b0` by `(live_region_class, category)`, scales it by scenario difficulty and the normalized region-density field `[region+0x25e]`, then multiplies by the cached building-count slot `[region+0x242]`. On the fallback branch it instead derives one region bucket from `[region+0x25e]`, combines the two static tables `0x005ee138` and `0x005ee1b0`, and applies the alternate scenario-difficulty scale before returning the final float. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator. | objdump + local disassembly + caller correlation + city-count-stats correlation |
| 118 | 0x00423d30 | 51 | world_region_refresh_cached_category_totals_and_weight_slots | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Refreshes one small cached region summary band rooted at `[this+0x27a]`. The helper forwards three out-pointers `+0x27a/+0x27e/+0x282` plus one return slot `+0x286` into world_region_accumulate_structure_category_totals `0x00422900`, forcing the remaining category outputs and optional aggregate pointers to zero. Current grounded caller is the post-load seeding-burst tail around `0x00437bdc`, which sweeps the live region collection `0x0062bae0` after simulation_run_chunked_fast_forward_burst `0x00437b20`. This is therefore the narrow cached-category-summary refresher beneath that region-side setup and maintenance family rather than a company debt-table helper. | objdump + local disassembly + caller inspection + post-load caller correlation |
| 119 | 0x00423d70 | 176 | company_repay_bond_slot_and_compact_debt_table | simulation | thiscall | inferred | objdump + caller inspection | 4 | Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper. | objdump + caller inspection + finance-field correlation |
| 120 | 0x00423ec0 | 33 | company_adjust_available_track_laying_capacity_with_floor_zero | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter. | objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation |
| 121 | 0x004240a0 | 28 | company_query_available_track_laying_capacity_or_unlimited | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Returns the current company's available track-laying capacity. When scenario byte `[0x006cec78+0x4aaf]` is enabled, the helper returns the live company counter at `[this+0x7680]`; otherwise it returns fixed fallback `29999`, which currently reads as an effectively-unlimited path. Current language-table correlation now ties that scenario byte to RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`, so this helper is best read as the live getter beneath that scenario rule rather than only as an internal company counter accessor. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, and `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`, where the returned value is used as the company-side track-laying-capacity gate for route synthesis and station-attachment placement. | objdump + caller xrefs + callsite inspection + track-laying-capacity correlation + RT3.lng correlation |
| 122 | 0x00424010 | 29 | company_has_territory_access_rights | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`. | objdump + caller inspection + territory-access table correlation |
| 123 | 0x00423e40 | 112 | company_compute_weighted_average_bond_interest_rate | simulation | thiscall | inferred | objdump + caller xrefs + debt-record inspection | 4 | Computes the company's current weighted average bond interest rate from the live debt table rooted at `[this+0x5f]`. The helper rejects inactive companies and companies with no live bond slots, then walks each 12-byte debt record, accumulates total principal from `[slot+0x00]`, accumulates principal-times-rate from `[slot+0x08]`, and returns the weighted quotient `sum(principal*rate) / sum(principal)`. Current grounded callers are the bond-quote wrapper at `0x00427540`, the CompanyDetail capital summary panel at `0x004c23a0`, and the city-connection bonus ladder at `0x00425320`, so this is the shared average coupon or interest-rate helper rather than a generic finance multiplier. | objdump + caller xrefs + debt-record inspection + finance-summary correlation + bond-quote correlation |
| 124 | 0x00423eb0 | 6 | company_query_cached_share_price_scalar | simulation | thiscall | inferred | objdump + caller xrefs + per-share panel correlation | 3 | Tiny cached-float accessor that returns the company field at `[this+0x0d7b]`. Current grounded shell callers are the CompanyDetail per-share panel at `0x004c2720` and later train-side consumer paths, where this cached scalar is used in the same lane as the `Share Price` readout. The write-side owner is now tighter too: `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` optionally snapshots its final float into the same field when the caller requests a cache refresh, so this remains the narrow cached share-price accessor rather than an arbitrary finance-field read. | objdump + caller xrefs + per-share panel correlation + cached-float-field correlation + stock-price-cache-write correlation |
| 125 | 0x00424030 | 22 | company_set_territory_access_rights_byte | simulation | thiscall | inferred | objdump + caller inspection | 4 | Stores one territory-access byte for the requested company and territory id. The helper writes the supplied byte value into the same per-territory access table rooted at `[this + territory*0x38d + 0x1d9f]`. Current grounded shell caller is the immediate commit path inside `shell_company_detail_buy_territory_access_rights_flow` at `0x004c5fc9`, where the purchase path writes value `1` after the access-rights dialog is accepted. | objdump + caller inspection + territory-access table correlation |
| 126 | 0x004241e0 | 23 | company_sum_control_transfer_offer_policy_fields_raw | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the raw sum of two company-side floating fields at `[this+0x124f]` and `[this+0x12a7]`. Current grounded callers are the merger-offer builder around `0x004eb5a9` and adjacent control-transfer offer-side stat readers, where the returned value is paired with surrounding formatter setup for mode `0x0b` but is not itself passed an issue argument. This now looks like a narrow raw control-transfer offer policy total rather than a generic finance calculation. | objdump + caller inspection + merger-offer dialog correlation |
| 127 | 0x00424200 | 37 | company_sum_control_transfer_offer_policy_fields_scaled_tenths | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the same `[this+0x124f] + [this+0x12a7]` company-side policy total as `company_sum_control_transfer_offer_policy_fields_raw`, but scaled by the `0.1` constant at `0x005c9b50`. Current grounded callers are the merger and chairmanship-takeover offer builders at `0x004eb588` and `0x0050c7cb`, where the scaled result is immediately paired with surrounding formatter setup for mode `0x0b`. The helper itself does not consume an issue id, so this now reads as the scaled control-transfer offer policy total rather than a broader vote-weight function. | objdump + caller inspection + takeover and merger dialog correlation |
| 128 | 0x004248d0 | 759 | company_compute_cached_recent_per_share_performance_subscore | simulation | thiscall | inferred | objdump + caller inspection | 3 | Builds one cached company-side per-share performance subscore from recent yearly stock-data history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it first walks up to five recent years above founding year `[this+0x157]`, weighting yearly `Earnings Per Share` from slot `0x1f` and yearly `Revenue Per Share` from slot `0x1e` through `0x0042a5d0`; the current partial year uses weight `(5 * [world+0x0f]) - 5`, while the prior four full years use `48`, `36`, `24`, and `12`. That yields two normalized history lanes: `EPS * 10` into the first lane and `Revenue Per Share` into the second. It then runs a second trend pass over `Dividend Per Share` slot `0x20`, rewarding adjacent year pairs where the newer dividend does not fall below the previous year's value; that pairwise ladder uses weights `9`, `8`, `7`, and `6` from newest to oldest surviving comparison. The third lane is a dividend-strength score derived from that rewarded ratio, the previous-year dividend, and the constants `0.5`, `0.6`, `30`, and `230`, then floored to `1.13 * min(max(EPS lane, 1.0), revenue lane, current Book Value Per Share slot 0x1d)`. The fourth lane is current `Book Value Per Share` from slot `0x1d`. Negative lanes are clamped to zero. Base lane weights come from `0x005ee208` as `40/10/20/30`, and for company age under five years they are ramped through the four-dword rows at `0x005ee218`: `0/0/0/100`, `25/25/35/100`, `50/50/65/100`, `75/75/85/100`, and `100/100/100/100`. The strongest lane then gets weight `*1.25` while the weakest gets `*0.8`, and the resulting weighted blend ratio is stored as bounded intermediate `[this+0x0d19]` after multiplying by `((difficulty_table[[world+0x2d]] + 1.0) / 2.0)` and flooring at `0.5`. The final cached score recomputes that same base blend, multiplies it by the raw difficulty scalar table at `0x005f33b8` (`0.8/0.9/1.0/1.1/1.2/0.9/0.95/1.0`), applies post-bankruptcy smoothing for companies within ten years of `[this+0x163]` as `score * ((0.025 * years_since_bankruptcy) + 0.5)`, floors the result at `1.0`, and finally caches the float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded caller is `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, where this helper now reads as the recent per-share performance feeder rather than a generic governance-support history walker. | objdump + caller inspection + cache-field correlation + stock-data-family correlation + per-share-panel correlation + weight-ladder correlation + dividend-trend correlation + age-ramp-table correlation + difficulty-table correlation |
| 129 | 0x00425a90 | 194 | company_declare_bankruptcy_and_halve_bond_debt | simulation | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path. | objdump + RT3.lng strings + caller inspection + finance-field correlation |
| 130 | 0x004261b0 | 74 | company_count_unassigned_shares_after_active_chairman_holdings | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the current company share pool at `[this+0x47]` minus the positive holdings found in each active chairman profile record under `0x006ceb9c`. The helper uses the company collection index from `[this+0x00]` to read per-profile holdings from `[profile + company_index*4 + 0x15d]`, sums only positive entries, and subtracts that total from the company share count. Current grounded callers are the takeover and merger vote resolvers, which stage the result into `0x006d1a04` and `0x006d1104` before the lower public-vote support formulas run. | objdump + caller inspection + takeover and merger vote correlation |
| 131 | 0x00426260 | 607 | company_compute_board_approved_dividend_rate_ceiling | simulation | thiscall | inferred | objdump + caller inspection | 4 | Computes one nonnegative per-share dividend ceiling for the selected company. The helper starts from the current support or governance lane `0x2329/0x0d`, normalizes that value by the current outstanding-share band at `[this+0x47]`, then scans a bounded recent-year window relative to the founding year `[this+0x157]` and current scenario year `[0x006cec78+0x0d]`, taking minima from the shareholder-facing slots `0x2b` and `0x2c`. In the early-company path it also folds in `[this+0x57]` and the previous-year slot `0x1c`, applies several scale constants, and clamps the result at zero before returning the final per-share ceiling. Current grounded shell caller is `shell_company_detail_handle_change_dividend_rate_dialog_message` at `0x004c5140`, where this is the direct board-approval limit behind localized id `991` when the player tries to raise the dividend too far. | objdump + caller inspection + dividend-ceiling correlation |
| 132 | 0x004273c0 | 132 | company_repurchase_public_shares_and_reduce_capital | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Repurchases one caller-supplied quantity of public shares and reduces company capital accordingly. The helper converts the share count into one cash-side total through the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` and fixed market-scale constants, posts the resulting negative amount into company stat slots `0x0c` and `0x0d` through `0x0042a080` and `0x0042a040`, and subtracts the same share count from the outstanding-share field `[this+0x47]`. Current grounded callers are the `CompanyDetail.win` stock-buyback flow at `0x004c46d0` and the annual finance-policy helper at `0x00401c50`, where it contributes the RT3.lng `2887` repurchase headline. | objdump + caller xrefs + callsite inspection + stock-buyback correlation + annual-finance correlation |
| 133 | 0x00427450 | 224 | company_issue_public_shares_and_raise_capital | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Issues one caller-supplied quantity of public shares and increases company capital. When the optional pricing flag is clear, the helper derives one implied share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, the current company credit-rating score at `0x00425320`, and fixed underwriting constants; when the flag is set it reuses the caller-supplied scalar instead. It then posts the resulting proceeds into company stat slot `0x0c`, records the issued-share quantity in stat slot `0x0d`, snapshots the prior current-issue packed calendar tuple from `[this+0x16b/+0x16f]` into `[this+0x173/+0x177]`, writes the active world tuple from `[0x006cec78+0x0d/+0x11]` back into `[this+0x16b/+0x16f]` when taking the derived-pricing lane, and increases the outstanding-share field `[this+0x47]` by the issued quantity. Current grounded callers are the `CompanyDetail.win` stock-issue flow at `0x004c3f30` and the annual finance-policy helper at `0x00401c50`, where it contributes the debt-refinance-plus-borrowing and straight new-borrow capital side. | objdump + caller xrefs + callsite inspection + stock-issue correlation + annual-finance correlation + calendar-tuple-stamp correlation |
| 134 | 0x00427540 | 76 | company_compute_bond_interest_rate_quote | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Computes one company-specific bond interest-rate quote from the requested term and current credit or rate state. When the company is active it combines the current company credit-rating score from `0x00425320`, the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, and one term-dependent adjustment from the caller-supplied year span, then returns the resulting float rate; otherwise it falls back to `1.0`. Current grounded caller is `company_issue_bond_and_record_terms` `0x004275c0`, where this helper supplies the quoted rate when the caller does not already provide one. | objdump + caller xrefs + callsite inspection + bond-rate correlation + credit-rating correlation + prime-rate correlation |
| 135 | 0x004275c0 | 255 | company_issue_bond_and_record_terms | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Issues one new bond and appends its term record to the live company debt table. The helper first rejects companies already at the `0x14` bond-slot cap, computes or accepts one quoted interest rate through `company_compute_bond_interest_rate_quote` `0x00427540`, posts the bond proceeds into company stat slot `0x0c`, posts the principal into stat slot `0x12`, posts the coupon rate into stat slot `0x0d`, and then writes one new three-dword bond record into the next 12-byte entry rooted at `[this+0x5f]`: principal, maturity year, and quoted rate. It increments the bond count at `[this+0x5b]` and returns success. Current grounded callers are the `CompanyDetail.win` bond-issue flow at `0x004c3890` and the annual finance-policy helper at `0x00401c50`, where it supplies both straight new borrowing and refinance-plus-borrow follow-ons. | objdump + caller xrefs + callsite inspection + bond-issue correlation + annual-finance correlation |
| 136 | 0x00426890 | 68 | company_find_collection_index_by_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`. | objdump + caller inspection + company collection correlation |
| 137 | 0x00426be0 | 53 | company_can_purchase_territory_access_rights | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt. | objdump + caller inspection + RT3.lng strings + territory-flag correlation |
| 138 | 0x00426d60 | 393 | company_deactivate_and_clear_chairman_share_links | simulation | thiscall | inferred | objdump + caller inspection + collection-state correlation | 4 | Runs the destructive selected-company clear path currently reached from `CompanyDetail.win`. The helper first rejects inactive companies through `[this+0x3f]`, then zeroes all active-chairman share holdings for this company across `0x006ceb9c`, clears the linked chairman backpointer `[company+0x3b]` and the profile-side owning-company field `[profile+0x1dd]`, clears the selected-company latch when the scenario currently points at this company, marks the company inactive by zeroing `[company+0x3f]`, and walks two live collections to drop or invalidate remaining references that still point back to this company. The tail then rebuilds one local name block from `[company+0x4]` and publishes the change through the scenario-state helper at `0x004360d0`. Current grounded shell caller is the `0x9493` section-0 control under `shell_company_detail_window_handle_message`, so current best meaning is a company deactivation or liquidation-style clear path rather than an ordinary governance vote helper. | objdump + caller inspection + collection-state correlation + CompanyDetail control correlation |
| 139 | 0x00426ef0 | 43 | company_get_linked_chairman_profile_record | simulation | thiscall | inferred | objdump + caller inspection | 4 | Resolves the linked chairman profile record for one company. The helper reads the linked chairman id from `[this+0x3b]`, validates it against the live profile collection at `0x006ceb9c`, and returns the resolved profile record through `0x00518140`; zero or invalid ids return null. Current grounded callers include the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the direct bridge from a selected company to the chairman profile used for ownership and governance text. | objdump + caller inspection + chairman-link correlation |
| 140 | 0x0042a0e0 | 77 | company_query_highest_coupon_bond_slot_index | simulation | thiscall | inferred | objdump + caller inspection + debt-record layout correlation | 3 | Returns the live bond-slot index with the highest coupon rate from the debt table rooted at `[this+0x5f]`. The helper walks the current bond count at `[this+0x5b]`, compares each slot's rate field at `[this+0x67 + slot*0xc]`, and returns the zero-based index of the strongest surviving slot or `-1` when no bond slots are live. Current grounded caller is the annual finance-policy helper at `0x00401c50`, where this picks the reference bond used by the build-`1.03+` stock-issue lane before it checks current cash against that slot's principal plus a small fixed buffer. | objdump + caller inspection + debt-record layout correlation + annual-finance correlation |
| 141 | 0x0042a040 | 55 | company_add_delta_into_stat_series_and_current_slot | simulation | thiscall | inferred | objdump + caller xrefs + field-write correlation | 3 | Adds one caller-supplied float delta into the company stat-family series lane selected by the requested slot id. The helper increments both the year-indexed series rooted at `[this+0x0d7f]` and the current aggregate lane rooted at `[this+0x1c47]`, but does not touch the broader cash-side shadow totals. Current grounded callers include bond repayment `0x00423d70`, bankruptcy `0x00425a90`, stock buyback `0x004273c0`, territory-access purchase `0x004c5fc9`, and several placement or world-service mutations, so this now reads as the shared company stat poster without the optional cash-side follow-on. | objdump + caller xrefs + field-write correlation + finance-mutator correlation |
| 142 | 0x0042a080 | 95 | company_add_delta_into_stat_series_current_slot_and_optional_cash_totals | simulation | thiscall | inferred | objdump + caller xrefs + field-write correlation | 3 | Adds one caller-supplied float delta into the selected company stat-family lane, exactly like `company_add_delta_into_stat_series_and_current_slot` `0x0042a040`, and optionally mirrors the same delta into the broader cash-side shadow totals when the third argument is nonzero. The shared stat writes still land in the year-indexed series rooted at `[this+0x0d7f]` and current aggregate lane `[this+0x1c47]`; the optional follow-on also increments the cash-pair totals at `[this+0x11f7]` and `[this+0x1caf]`. Current grounded callers include stock buyback `0x004273c0`, chairman-salary and dividend policy paths around `0x00427920`, linked world-service updates, and several company-side cash or capital mutators, so this is the stronger shared company stat poster when cash-side shadow totals must stay synchronized. | objdump + caller xrefs + field-write correlation + cash-pair correlation + finance-mutator correlation |
| 143 | 0x0042a2e0 | 645 | company_read_control_transfer_metric_slot | simulation | thiscall | inferred | objdump + caller inspection | 3 | Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader. | objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation |
| 144 | 0x0042a5d0 | 131 | company_read_year_or_control_transfer_metric_value | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula. | objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation |
| 145 | 0x0042c690 | 311 | placed_structure_rebuild_candidate_cargo_service_bitsets | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path. | objdump + caller xrefs + callsite inspection + cargo-summary correlation |
| 146 | 0x0042c8f0 | 112 | placed_structure_refresh_linked_candidate_flag4 | map | thiscall | inferred | objdump + caller xrefs + linked-instance inspection | 3 | Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild even though the exact player-facing meaning of `[candidate+0xba]` is still open. | objdump + caller xrefs + linked-instance inspection + candidate-flag correlation |
| 147 | 0x0042cab0 | 117 | placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link | map | thiscall | inferred | objdump + caller inspection + route-style remap inspection | 3 | Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests. | objdump + caller inspection + route-style remap inspection + peer-link emission correlation |
| 148 | 0x0042cb30 | 124 | placed_structure_clamp_candidate_service_age_table | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper. | objdump + caller xrefs + callsite inspection + route-age correlation |
| 149 | 0x0042cbb0 | 145 | placed_structure_route_supports_candidate_local_service_mode | map | thiscall | inferred | objdump + caller xrefs + route-record inspection | 3 | Boolean route-linked predicate for one candidate-local service branch. The helper walks the route or service record chain owned by the current site through `[this+0x0d4]` and collection `0x006cec20`, reads one candidate-indexed float lane at `[route+0x3e]`, and compares the route-side threshold at `[route+0x112]` against the current local word-table value for that candidate after scaling through `0x00437d20`. It returns `1` on the first matching route record and `0` otherwise. Current grounded caller is `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, where this predicate selects one of the route-backed scoring transforms. | objdump + caller xrefs + route-record inspection + candidate-table correlation |
| 150 | 0x0042cc50 | 402 | placed_structure_apply_route_linked_service_caps | map | thiscall | inferred | objdump + caller xrefs + route-record inspection | 3 | Route-linked cap pass over the aligned local service tables. The helper walks the route or service record chain rooted at `[this+0x0d4]` through `0x006cec20`, then for each live non-remapped candidate that passes `structure_candidate_is_enabled_for_current_year` it compares the route-side candidate float at `[route+0x42]` against the current site float table at `[this+0x107]` and the current primary word-table value at `[this+0x00]`. When the route-linked ratio stays inside the live clamp window it writes a lower capped value back into the primary word table. Current grounded caller is the composite local refresh `0x0042d580`, so this now looks like the first route-backed cap pass that shapes the rebuilt local service tables before the later neighborhood redistribution and recent-service clamp run. | objdump + caller xrefs + route-record inspection + local-table correlation |
| 151 | 0x0042cdf0 | 16 | placed_structure_refresh_candidate_service_state | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Tiny composite refresh for one placed-structure or site record. The helper first rebuilds the candidate cargo-service bitsets through `placed_structure_rebuild_candidate_cargo_service_bitsets` at `0x0042c690`, then tail-calls `placed_structure_refresh_linked_candidate_flag4` at `0x0042c8f0` to refresh the sibling state bit at `[this+0x0e6]`. Current grounded callers include the world-grid sweep at `0x00450003`, so this now looks like the common steady-state placed-structure service-state refresh immediately above the editor-driven cargo runtime tables. | objdump + caller xrefs + wrapper inspection |
| 152 | 0x0042ce00 | 1394 | placed_structure_rebuild_candidate_local_service_tables | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Large per-site rebuild over the live candidate collection at `0x0062ba8c`. The helper walks every candidate with live runtime state at `[collection+0x16e]` and no remap entry at `[collection+0x9a]`, decays positive floats in the aligned per-candidate table rooted at `[this+0x107]`, and commits those float updates back through `0x0041e1b0`. It then combines that float table with two aligned per-candidate word tables rooted at `[this+0x02]` and `[this+0x6c]`, the direct-supply cargo bitset at `[this+0x0df]`, the site-side latch at `[this+0x0d4]`, and the branch predicate `0x0042cbb0` to choose among several normalized scoring transforms before writing the quantized result back into the destination word table. Current grounded callers now put this directly under the local wrapper at `0x0042d580`, so this looks like the first real site-side candidate service-score rebuild above the editor-driven cargo runtime lane rather than another candidate-only helper. | objdump + caller xrefs + callsite inspection + table-layout correlation |
| 153 | 0x0042d580 | 26 | placed_structure_refresh_local_service_score_bundle | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Composite local-service refresh for one placed-structure or site record. The helper first runs `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, then immediately chains into the neighboring local post-passes at `0x0042cc50`, `0x0042c1b0`, and `0x0042cb30` before returning. Current grounded caller is the world-grid sweep at `0x00450110`, which uses this as the stronger per-site local-service refresh after the lighter cargo-service-state pass at `0x00450003`. | objdump + caller xrefs + wrapper inspection |
| 154 | 0x00428a10 | 22 | company_clear_selected_chairman_if_current_profile | simulation | thiscall | inferred | objdump + caller inspection | 4 | Clears the linked chairman for the current company when the supplied profile id matches `[this+0x3b]`. On a match the helper zeroes the incoming profile id and tail-calls `0x00427c70`; otherwise it returns without changing company state. Current grounded shell caller is `shell_company_detail_resign_chairmanship_flow`, which uses this as the commit step behind the localized resignation confirmation. | objdump + caller inspection + chairman-link correlation |
| 155 | 0x00425320 | 607 | company_compute_credit_rating_score | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 4 | Computes the bounded company credit-rating score reused by the debt-side shell and several adjacent company-policy gates. The helper returns a fixed floor when the company-active flag at `[this+0x3f]` is clear; otherwise it starts from a weighted four-year net-profits-minus-fuel ladder over slots `0x2b` and `0x09`, blends in the current debt total from stat-family `0x2329/0x12`, folds in the weighted average bond interest rate through `company_compute_weighted_average_bond_interest_rate` `0x00423e40`, conditionally adds the prime-rate baseline and raw issue-39 total through `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, then derives several debt- or liquidity-side ratios from derived stat slots `0x30` and `0x31` before applying company-age smoothing. The tail then adds the raw issue-38 total through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`, rounds the result, and uses that bounded score both for the CompanyDetail credit row and for bond-offer gating. Current grounded callers are the city-connection news owner `0x00406050`, the bond-interest quote wrapper `0x00427540`, the bond-side boolean gate `0x00427590`, the generic derived-metric reader at `0x0042a2e0` for the credit-rating-style slot, the CompanyDetail debt-credit-rate summary panel `0x004c23a0`, and the CompanyDetail bond-issue flow `0x004c3890`. The surrounding text anchors are explicit: shell localized id `952` is `Credit Rating:`, and localized id `974` says new bonds require a strong enough credit rating. This is therefore the safest current read for the debt-market or creditworthiness score, distinct from the issue-39 prime-rate lane and from the broader issue-37 equity-support lane. | objdump + caller xrefs + callsite inspection + RT3.lng strings + credit-rating correlation + bond-dialog correlation + prime-rate contrast + issue-38 correlation |
| 156 | 0x00424fd0 | 751 | company_compute_public_support_adjusted_share_price_scalar | simulation | thiscall | inferred | objdump + caller inspection | 3 | Computes one bounded investor-support and share-price scalar used by stock-capital policy, cached share-price readouts, and adjacent governance or control-transfer vote lanes. The helper starts from `company_compute_cached_recent_per_share_performance_subscore` at `0x004248d0`. If the older company-side support field `[this+0x57]` is still at least as strong as that fresh score and the company is within five years of founding year `[this+0x157]`, it interpolates the two through a capped startup-progress term derived from the current world calendar counter `[0x006cec78+0x15]`, the company stamp `[this+0x0d07]`, and the founding year, with the progress side capped at `50`; otherwise it keeps the fresh per-share score directly. The first caller argument is then normalized by current outstanding shares `[this+0x47]` and clamped into the narrow pressure band `[-0.2, 0.2]`. When the caller supplies nonzero control arguments, that pressure term can also refresh the mutable support field `[this+0x4f]` by blending the prior field with the staged delta. The later share-price body is tighter now too: it derives a share-count growth term from outstanding shares through the power helper `0x005a1b60` on `(shares / 20000)^0.33`, scales that by `1.4`, folds it back against current shares, and then runs a piecewise compression or clamp ladder over the resulting support scalar at thresholds `0.6`, `0.45`, `0.3`, `1.7`, `2.5`, `4.0`, and `6.0`. After that it multiplies by the scenario issue-opinion multiplier from `scenario_state_compute_issue_opinion_multiplier` `0x00436590` using issue id `0x37`, rounds through `0x005a10d0`, floors the rounded result at `0.0001`, and optionally snapshots it into the cached share-price field `[this+0x0d7b]` when the second control argument is nonzero. Current grounded callers include the cached share-price accessor `0x00423eb0`, the stock buyback and stock issue mutators `0x004273c0` and `0x00427450`, the bankruptcy recompute path `0x00425a90`, the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual creditor-pressure or shareholder-policy lane that surfaces localized ids `300..304`. The surrounding finance split is now tighter too: `company_compute_credit_rating_score` `0x00425320` feeds the explicit `Credit Rating` shell rows and bond-offer rejection flow, while `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds the explicit `Prime Rate` row and cash interest helpers. That leaves issue `0x37` as the broader equity-market or investor-confidence lane behind company or chairman performance. The strongest direct text anchors are still localized ids `300/301` `Shareholders revolt against poor management`, `1217` `Investors are somewhat pleased with the chairman's performance.`, and `3048/3049` `Investors are %1 your performance./the chairman's performance.`. A deeper follow-up now rules out three tempting label shortcuts: the nearby `0x460a90..0x460c53` and `0x473620..0x47366a` registration families are camera-view and related shell-command bindings, not finance issue owners; the editor-side `Stock Prices` label belongs to the separate float-tuning block `[state+0x0bde..0x0bf6]`, not the issue table behind `0x37`; and the extracted `CompanyDetail.win` shell resource from `rt3_2WIN.PK4` does not expose any separate plain-English investor or finance caption for this lane, which matches the owner-side read that section-0 is a dynamic text widget (`0x947f`) fed by `shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a fixed label row. | objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation + stock-buyback correlation + stock-issue correlation + share-price-cache correlation + per-share-performance correlation + pressure-band correlation + startup-interpolation correlation + power-helper correlation + credit-vs-prime-rate correlation + negative-label-owner correlation + shell-resource extraction negative-result |
| 157 | 0x00424580 | 82 | company_compute_prime_rate_from_issue39_scenario_baseline | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Small company-side rate helper that produces the current prime-rate-style baseline from scenario state plus issue `0x39`. It first reads one normalized scenario baseline through `0x00433740` on active scenario state `0x006cec78`, then adds the scaled raw issue-39 total from `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` using the current company id `[this+0x00]`, linked chairman id `[this+0x3b]`, and no territory argument. Current grounded callers now bound the player-facing meaning more tightly: the bond-interest quote wrapper at `0x00427540`, the negative and positive cash interest helpers at `0x00425880` and `0x004258c0`, and the CompanyDetail capital summary row labeled `954` `Prime Rate:` at `0x004c23a0`. This now reads as the shared prime-rate or market-rate helper rather than a generic company-support scalar. | objdump + caller xrefs + callsite inspection + issue-39 correlation + prime-rate correlation + bond-quote correlation |
| 158 | 0x004246b0 | 544 | company_compute_five_year_weighted_shareholder_return | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Computes the stock-data lane surfaced as `5 Year Weighted Return`. Inactive companies fall back to the fixed scalar at `0x005c8598`; otherwise the helper walks up to five recent years above founding year `[this+0x157]`, samples yearly `Share Price` from slot `0x1c`, measures year-over-year price appreciation against the prior sample, blends that with the paired historical shareholder-payout lane from slot `0x23`, and weights recent years more heavily through the same scenario-side year weighting byte at `[0x006cec78+0x0f]`. Current evidence now bounds that paired lane more tightly: slot `0x23` falls back to direct company field `[this+0x53]` on the current-company path and is only consumed here, so the strongest current read is the historical dividend-per-share or shareholder-payout component paired with yearly price appreciation. The tail normalizes the accumulated weighted return by the accumulated weights and returns one bounded annualized-style float. Current grounded caller is `company_read_control_transfer_metric_slot` at `0x0042a2e0` for slot `0x21`, which matches the stock-data label `942` `5 Year Weighted Return:` and tooltip `936`. | objdump + caller inspection + RT3.lng strings + stock-data-label correlation + weighted-return correlation + shareholder-payout-lane correlation |
| 159 | 0x00425880 | 64 | company_compute_negative_cash_balance_interest_rate | shell | thiscall | inferred | objdump + LoadScreen report correlation + localized string correlation | 4 | Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows. | objdump + LoadScreen report correlation + localized string correlation + helper call inspection + prime-rate correlation |
| 160 | 0x004258c0 | 396 | company_compute_positive_cash_balance_interest_rate | shell | thiscall | inferred | objdump + LoadScreen report correlation + localized string correlation | 4 | Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same prime-rate helper at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows. | objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation + prime-rate correlation |
| 161 | 0x00429c70 | 976 | company_read_derived_financial_report_metric_slot | simulation | thiscall | inferred | objdump + caller inspection + shell-label correlation | 3 | Reads one derived company metric from the higher report-style slot family rooted at `0x2b`. The jump-table body now has one safe finance-side core: slot `0x2c` sums raw slots `0x01..0x04` into the broader revenue aggregate, slot `0x2d` combines the neighboring expense-side derived lanes, and slot `0x2b` then combines `0x2c` and `0x2d` into the net-profits-style lane reused by shell labels `1212` `Profits`, `925` `Profits:`, and the annual finance policy. The same helper also owns several later derived ratios and aggregates, including one asset-side pair around `0x30/0x31` and the per-unit revenue lanes that divide the revenue aggregate `0x2c` by count or distance slots such as `0x24`, `0x16`, and `0x17`. Current grounded callers arrive indirectly through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, so this is the shared derived financial-report metric reader beneath CompanyDetail, LoadScreen, and annual finance rather than a shell-only formatter helper. | objdump + caller inspection + shell-label correlation + derived-metric correlation + income-statement correlation |
| 162 | 0x00429990 | 86 | company_collection_get_nth_active_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows. | objdump + caller inspection + active-company roster correlation |
| 163 | 0x004299f0 | 84 | company_collection_count_active_companies_before_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`. | objdump + caller inspection + active-company roster correlation |
| 164 | 0x00429a50 | 62 | company_collection_count_active_companies | simulation | thiscall | inferred | objdump + caller inspection | 4 | Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math. | objdump + caller inspection + active-company roster correlation |
| 165 | 0x00430270 | 225 | world_try_place_random_structure_batch_from_compact_record | map | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Shared world-side retry loop that tries to place multiple structures from one compact spawn record. The caller supplies one small record whose fields now read most safely as a structure or profile token at `+0x00`, requested placement count at `+0x11`, center coordinates at `+0x12/+0x14`, and placement radius or extent at `+0x16`. The helper translates the token through the static table at `0x0061039c` into the live structure-profile collection `0x0062b268`, increments the region-manager reentrancy counter at `[0x0062bae0+0x88]`, and then runs up to `200` randomized attempts while placements remain. Each attempt samples a candidate coordinate inside the requested radius, rejects points outside the live world bounds at `[0x0062c120+0x2155/+0x2159]`, resolves the owning region through `0x0044a800` and `0x0062bae0`, adapts the candidate through `0x00412880`, and finally re-enters `world_region_validate_and_commit_candidate_placement` `0x00422a70`. Successful placements decrement the remaining batch count and reset the local retry counter. Current grounded caller is the world-side dispatch branch at `0x00431b43`, where only compact record classes in the `0x1f7..0x265` table range enter this batch placer. This is therefore the strongest current read for the world-side randomized structure-batch placement loop rather than a region-worker-private helper. | objdump + local disassembly + caller correlation + placement-batch correlation |
| 166 | 0x00430b50 | 624 | scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Builds one runtime-effect record in the live scenario event collection from a compact source record plus the caller's currently resolved targets. The helper first allocates a new runtime-effect entry through `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`, then seeds several per-record control bytes and target selectors in the new object, including mode byte `[record+0x7ef]`, optional gating bytes `[record+0x7f4/+0x7f9/+0x7fa]`, a primary selector at `[record+0x7f0]`, and optional comparison ids at `[record+0x82c/+0x830]`. Current grounded callers are the compact runtime-effect dispatcher `0x00431b20`, where fallback branches synthesize follow-on runtime effects from one compact linked record, and the shell-side branch at `0x004d60fd`, where the same builder is reached with a caller-owned output slot. This is therefore the current safest read for the runtime-effect follow-on record builder rather than a generic collection insert wrapper. | objdump + local disassembly + caller correlation + runtime-effect-builder correlation |
| 167 | 0x00431b20 | 399 | world_apply_compact_runtime_effect_record_to_resolved_targets | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Dispatches one linked compact runtime-effect record against the caller-resolved target context. The record token at `[*record+0x00]` is translated through the static table at `0x0061039c`; when the translated class lies in the `0x1f7..0x265` range the helper immediately re-enters `world_try_place_random_structure_batch_from_compact_record` `0x00430270`. Otherwise it jumps through the local class table at `0x004320b4/0x004320fc` into a mixed effect family that now includes: shell-state modifier branches over `0x006cec78`, signed scalar adjustments on resolved company/profile/territory targets through the `0x004d6611/0x004d6617` numeric readers, territory-access writes through `company_set_territory_access_rights_byte` `0x00424030`, selected-profile updates through `0x00434890/0x004348c0`, and several collection-side erase or follow-on branches. Current grounded caller is the outer loop at `0x00432317`, which walks linked compact records via `[record+0x24]` and supplies optional resolved company, chairman-profile, and adjacent owner context before each dispatch. This is therefore the current safest read for the wider compact runtime-effect dispatcher above the separate world-side structure-batch placement branch rather than as a placement-only helper. | objdump + local disassembly + caller correlation + effect-dispatch correlation |
| 168 | 0x004323a0 | 842 | scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Per-record service pass over one live runtime-effect record in the scenario event collection. The helper first enforces several activation gates over the record's local control bytes and shell-side preview state, including one one-shot latch at `[this+0x81f]`, mode byte `[this+0x7ef]`, optional preview-policy byte `[this+0x7f4]`, and shell-side state at `0x006cec78/0x006cec74`. Once active it formats the optional status line through shell news helper `0x004554e0`, derives a target-availability bitmask through `0x0042d700`, resolves optional company/chairman/territory target pools, and then walks the linked compact effect chain rooted at `[this+0x00]`. Each linked record is dispatched through `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, while fallback branches synthesize follow-on runtime-effect records through `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50`. When any effect fires it may refresh company share-price caches through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, and records with nonzero `[this+0x7f5]` set the one-shot latch `[this+0x81f]`. Current grounded caller is the collection-wide service loop `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40`. This is therefore the current safest read for the runtime-effect record service and linked-effect dispatcher rather than a low-level target iterator. | objdump + local disassembly + caller correlation + runtime-effect-service correlation |
| 169 | 0x00433130 | 169 | scenario_event_collection_refresh_runtime_records_from_packed_state | scenario | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper stages one small packed header read from the caller-supplied state or stream object, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk. | objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation |
| 170 | 0x00432ea0 | 103 | scenario_event_collection_allocate_runtime_effect_record_from_compact_payload | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Allocates and initializes one live runtime-effect record in the scenario event collection at `0x0062be18` from a compact payload source. The helper allocates one temporary `0x88f` payload object, inserts a new collection entry through the generic collection allocator path, resolves the inserted live entry, and then initializes that entry from the caller-supplied compact payload through `0x0042d670` before freeing the temporary object. Current grounded callers are `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50` and the shell-side branch at `0x004db9f1`, where the returned live entry id is stored back into the caller object. This is therefore the current safest read for the scenario event collection's runtime-effect allocator rather than a generic collection clone helper. | objdump + local disassembly + caller correlation + runtime-effect-allocation correlation |
| 171 | 0x00432f40 | 267 | scenario_event_collection_service_runtime_effect_records_for_trigger_kind | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide service loop over the live scenario event collection at `0x0062be18` for one caller-selected trigger kind byte. The helper first rejects fast-forward and editor-map gates through `0x006cec78+0x46c38`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x68]` unless the trigger kind is `9`, then walks every live runtime-effect record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Each resolved record is serviced through `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` `0x004323a0` with the selected trigger kind and optional text sink. When any record fires, the helper refreshes every active company's cached share price through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`; when the collection dirty latch at `[this+0x88]` is raised it clears that latch and immediately reruns the whole pass with trigger kind `0x0a`. The caller split is now tighter too: recurring simulation maintenance drives kinds `1`, `0`, `3`, and `2` through `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3`, while the neighboring route-style follow-on at `0x0040a91f` drives kinds `5` and `4` through `0x0040a930` and `0x0040a9ac`; world or startup-side company creation branches at `0x00407682`, `0x0047d293`, `0x0047d42b`, and `0x0047d6de` drive kind `7`; the kind-`6` branch is now tighter too, covering the placed-structure post-create tail at `0x0040f69e`, the build-version-gated company-startup or roster-refresh tail at `0x00428406`, and the route-entry post-change sweep at `0x004a3eae`; the kind-`8` world-entry one-shot gate now sits inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where it fires after the post-load company or route setup passes and then clears shell-profile latch `[0x006cec7c+0x97]`; and the `LoadScreen.win` briefing page at `0x004e520b` drives kind `9`. This is therefore the current safest read for the scenario event collection's collection-wide runtime-effect service loop rather than a generic text-query helper. | objdump + local disassembly + caller correlation + collection-service correlation + trigger-kind callsite decode |
| 172 | 0x00433bd0 | 546 | world_refresh_selected_year_bucket_scalar_band | simulation | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads the packed world year at `[this+0x0d]`, bins it against the threshold table at `0x005f3978/0x005f3980`, derives one interpolated bucket fraction when the current year falls inside a nontrivial range, and writes the resulting float band into `[this+0x65]`, `[this+0x69]`, `[this+0x6d]`, and `[this+0x4ca2]` after one build-version-sensitive clamp through `0x00482e00`. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on. | objdump + local disassembly + caller inspection + year-bucket-table correlation + world-entry correlation |
| 173 | 0x00434050 | 11 | shell_has_auxiliary_preview_owner | shell | cdecl | inferred | objdump + caller inspection + side-owner correlation | 4 | Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live. | objdump + caller inspection + side-owner correlation + caller xrefs |
| 174 | 0x00434080 | 80 | scenario_state_query_cached_available_locomotive_rating_clamped_for_shell | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small read-side helper over cached scenario-state float `[this+0x4cbe]`. The helper returns that cached available-locomotive rating in `st(0)` when it stays under the local threshold, and otherwise falls back to one fixed shell-side float constant before returning. Current grounded caller is the shell-side formatter band around `0x004b11c5`, where this cached value is optionally rounded to an integer and then compared against display thresholds `40/50/70/85/100`. This is therefore the safest current read for the query-side companion of the later locomotive-rating refresh rather than a broader world-state getter. | objdump + caller inspection + local disassembly + shell-threshold correlation + display-bucket correlation |
| 175 | 0x00434300 | 881 | world_runtime_release_global_services | map | cdecl | inferred | objdump + analysis-context | 3 | Releases or clears a broad set of world-runtime global services owned by the current map object before a new world entry or sibling save branch continues. The helper walks the owner collection at [this+0x66b2] and then touches many global manager slots including 0x0062b244 0x0062cfcbc 0x0062be10 0x0062c120 0x0062ba8c 0x0062ba88 0x0062b2fc 0x0062b268 0x006cea4c and 0x006acd34 through repeated release-style calls and nulling writes. Current grounded callers are the heavier world-entry branch at 0x00443a50 the sibling .smp world-state branch at 0x00446d40 and shell_transition_mode at 0x00482ec0. | objdump + analysis-context + caller xrefs |
| 176 | 0x00434d40 | 100 | placed_structure_collection_seed_candidate_subtype2_runtime_latch | map | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Shared post-setup sweep over the live placed-structure collection at `0x0062b26c`. The helper walks every live placed structure through the indexed-collection accessors, resolves each linked candidate or structure descriptor through vtable slot `+0x80`, and when the resolved record's subtype byte `[candidate+0x32]` equals `2` it writes `1` to runtime dword `[candidate+0x7b0]`. Local field evidence is now tight enough to keep the name structural: the same dword is zeroed during candidate runtime materialization around `0x00412112`, read as a one-shot guard in the world-side placement branch around `0x00423c43`, and also written there after the guarded follow-on fires. Current grounded callers are the post-fast-forward setup tail at `0x00437bf9` and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared subtype-`2` candidate-runtime latch seeder rather than a one-off world-entry patch. | objdump + local disassembly + caller correlation + candidate-runtime-latch correlation |
| 177 | 0x004354a0 | 355 | world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Shared shell-facing scalar publisher beneath selected-year changes, shell-state selector updates, and the late world-entry reactivation band. The helper always resolves the current shell presentation object through controller `0x006d4024 -> [controller+0x18]` and writes one clamped `0..255` integer into `[object+0x15]` through `0x00523d60`. Its source split is now bounded enough to name conservatively: when tutorial flag `0x006d3b4c` is live it forces `0`; otherwise it first honors the temporary shell-state selector pair `[0x006cec74+0x1df/+0x1e3]`, then the persisted selector pair `[0x006cec74+0x23b/+0x23f]` when sandbox bit `[0x006cec7c+0x82]` is set, and only when no selector override is active does it derive one interpolated scalar from the current year `[this+0x15]` against the ensured threshold band `[this+0x51/+0x55/+0x59/+0x5d/+0x61]` plus the base value at `[this+0x3a]`, re-entering `scenario_state_ensure_derived_year_threshold_band` `0x00435603` before the year-band path needs it. Current grounded callers are the simulation year-advance path at `0x0040ab39`, the shell-state setter at `0x00482878`, the startup-side branch at `0x005173d3`, and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared shell-controller progress-scalar publisher rather than a world-entry-only helper. | objdump + local disassembly + caller correlation + shell-controller correlation + year-threshold-band correlation |
| 178 | 0x00434ea0 | 124 | scenario_state_query_named_candidate_availability_record_value | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Read-side lookup over the scenario-side named candidate-availability collection at `[this+0x66b2]`. The helper normalizes the first byte of the caller-supplied candidate name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x1e]`; otherwise it returns zero. The insert sibling `0x00434f20` shows the exact record shape now too: each collection entry is a zero-initialized `0x22`-byte blob with a fixed zero-terminated name slot at `[entry+0x00..+0x1d]` and one trailing availability dword at `[entry+0x1e]`. Current grounded callers are the runtime refresh pass `0x00412c10`, the editor-side detail and summary formatters at `0x004cc209`, `0x004cdfa3`, `0x004d14b8`, and `0x004d1684`, and the same startup-side candidate filter family that later writes `[candidate+0x7ac]`. This is therefore the current safest read for the candidate-side lookup sibling of the named availability helpers rather than a generic string-table query. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation |
| 179 | 0x00434f20 | 272 | scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437743` and `0x00436ad7` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation |
| 180 | 0x00435030 | 124 | scenario_state_query_named_locomotive_availability_record_value | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Read-side lookup over the scenario-side named locomotive-availability collection at `[this+0x66b6]`. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x3d]`; otherwise it returns zero. The insert sibling `0x004350b0` shows the exact record shape now too: each collection entry is a zero-initialized `0x41`-byte blob with a fixed zero-terminated locomotive-name slot at `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`. Current grounded callers are the shell-side `Locomotives` availability page constructor `map_editor_locomotive_availability_panel_construct` `0x004cd680`, the locomotive-side stats and summary branches at `0x004d0e5f` and `0x00461ed5`, and the neighboring startup or restore-side upsert family at `0x00438d6b` and `0x004478ea`. This is therefore the safest current read for the locomotive-side lookup sibling of the named availability helpers rather than a generic string-table query. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-availability correlation + record-layout correlation |
| 181 | 0x004350b0 | 249 | scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Upserts one named locomotive-availability record into the scenario-side collection at `[this+0x66b6]` and then refreshes dependent runtime locomotive usage state. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches existing names through `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the locomotive-availability dword at `[entry+0x3d]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x41`-byte record, copies the supplied zero-terminated locomotive name into `[entry+0x00..+0x3c]`, and seeds that same trailing dword. When the live locomotive pool `0x006ada84` exists it then re-enters `0x00461e00`, where the queried value is later stored into `[loco+0x7b]`. The write-side caller set is now tight enough to close the remaining semantic gap here too: the grounded startup or restore-side seeding lanes at `0x00438d6b`, `0x004478ea`, and `0x00461eab` and the shell-side `Locomotives` availability handler family at `0x004cf178`, `0x004cf1fe`, `0x004cf2f9`, and `0x004cf3fc` all supply only boolean values, so `[entry+0x3d]` now reads safely as a real locomotive-availability override bit rather than a broader policy enum. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-runtime-refresh correlation + record-layout correlation + callsite-argument correlation |
| 182 | 0x00436af0 | 384 | scenario_state_refresh_cached_available_locomotive_rating | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, filters them through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. It then normalizes and clamps that winning value into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper. | objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation |
| 183 | 0x0043cb00 | 295 | world_view_step_heading_quadrant | shell | thiscall | inferred | objdump + caller xrefs | 3 | Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag. | objdump + caller xrefs + callsite inspection |
| 184 | 0x0043cc30 | 437 | world_view_step_zoom_bucket | shell | thiscall | inferred | objdump + caller xrefs | 3 | Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4. | objdump + caller xrefs + callsite inspection |
| 185 | 0x0043d050 | 111 | world_view_set_focus_position_xyz | shell | thiscall | inferred | objdump + caller xrefs | 4 | Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d. | objdump + caller xrefs |
| 186 | 0x0043af60 | 205 | world_view_should_drive_primary_pan_channel | shell | thiscall | inferred | objdump | 3 | Returns whether the world-view owner should drive its primary pan channel on this pass. The predicate first honors the latched override at [this+0xa2] then checks several shell-view gates through 0x00543e00 0x00543e20 and 0x00543e40 on the active controller node plus one optional guard under 0x006d1a8c and the world-mode flag at [0x006cec74+0x120]. When the controller view is active it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as one enabling condition; `shell_input_apply_window_key_transition` grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36 which ties held Shift state back into the same world-view pan family. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and the smaller motion helper at 0x0043e610. | objdump + callsite inspection |
| 187 | 0x0043b030 | 173 | world_view_should_drive_secondary_pan_channel | shell | thiscall | inferred | objdump | 3 | Returns whether the world-view owner should drive its secondary pan channel on this pass. Like the neighboring primary predicate it combines shell controller view gates through 0x00543e00 0x00543e20 and 0x00543e40 optional suppression under 0x006d1a8c and one world-mode check at [0x006cec74+0x120]; when the active controller view is present it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as an enabling condition. Those bits are now grounded as the left and right Shift modifiers from scan codes 0x2a and 0x36 rather than an opaque gameplay-only flag source. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and in the smaller motion helpers at 0x0043e610 and 0x0043f4f0. | objdump + callsite inspection |
| 188 | 0x0043d0c0 | 111 | world_view_apply_screen_delta_to_focus_position | shell | thiscall | inferred | objdump + caller xrefs | 4 | Converts one screen-relative drag delta into a new world-view focus position and forwards it through world_view_set_focus_position_xyz. When the auxiliary object at [this+0x6e] is live it samples a derived center or height term through 0x00534490 and scales both incoming deltas by the world-view projection constant at 0x005c8700 before calling the lower focus-position setter. The current grounded caller is the cursor-drag helper at 0x00478d31 inside the larger input loop at 0x00478cb0. | objdump + caller xrefs |
| 189 | 0x0043d130 | 292 | world_view_pan_relative_offset_in_camera_plane | shell | thiscall | inferred | objdump + caller xrefs | 4 | Applies one local X/Z pan offset to the world-view owner at 0x0062be68 in the current camera plane and forwards the result through world_view_set_focus_position_xyz. The helper derives a scale from the active view-height field [this+0x18] rotates the incoming offset by the current heading-like field [this+0x10] through sine and cosine calls at 0x005a13e4 and 0x005a1494 adds the rotated result onto the current world focus position in [this+0x04] and [this+0x0c] preserves the current Y term in [this+0x08] and then calls the lower focus-position setter. Current grounded callers are the GameUppermost hotspot path at 0x004e094b and the keyboard-owned service branch inside world_view_service_keyboard_turn_and_pan_bindings at 0x0043dae4 which together indicate a shared world-view pan action rather than a separate gameplay command dispatcher. | objdump + caller xrefs |
| 190 | 0x0043d740 | 937 | world_view_service_keyboard_turn_pan_and_zoom_bindings | shell | thiscall | inferred | objdump + callsite inspection | 4 | Keyboard-driven world-view interaction helper beneath world_view_service_shell_input_pan_and_hover. It samples elapsed wall-clock time through 0x0051d890 against the previous timestamp at 0x0062be74 clamps the per-pass delta into the 0x08 through 0xc8 range and polls four configurable binding-pair families through the shell input table at 0x006d4018 via 0x0054e7d0. The first two pair families at [this+0x0a6] through [this+0x0b2] and [this+0x0b6] through [this+0x0c2] now ground as the default `Camera Forward` or `Camera Backward` pair and `Camera Left` or `Camera Right` pair. The third family at [this+0x0c6] through [this+0x0d2] produces a signed zoom-step or view-height delta that is returned through the caller-owned out-parameter for later smoothing and grounds as the default `Camera Zoom In` or `Camera Zoom Out` pair, while the fourth family at [this+0x0d6] through [this+0x0e2] applies continuous heading turns through 0x0043c810 and grounds as the default `Camera Rotate Left` or `Camera Rotate Right` pair. When the pan families are active the helper reaches world_view_pan_relative_offset_in_camera_plane at 0x0043d130 after checking the active world-view state. Current grounded caller is world_view_service_shell_input_pan_and_hover at 0x0043db00. | objdump + callsite inspection + caller xrefs + registration xrefs + RT3.lng |
| 191 | 0x00439e40 | 557 | world_view_seed_keyboard_binding_slot_pairs | shell | thiscall | inferred | objdump + callsite inspection | 4 | Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store. | objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng |
| 192 | 0x0043db00 | 1968 | world_view_service_shell_input_pan_and_hover | shell | thiscall | inferred | objdump + callsite inspection | 4 | Recurring world-view service that fuses shell input state into the live world-view owner at 0x0062be68. It begins by delegating keyboard-bound turn pan and zoom work to world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 then samples controller and view state through 0x00543c50 and 0x00543ba0 caches successive shell input coordinates from 0x006d4018 offsets 0xa94 and 0xa98 derives smoothed cursor or hover deltas against [this+0x2f6] [this+0x2fa] and [this+0x2fe] updates one world-under-cursor cache through 0x00448ac0 and 0x00448bd0 and refreshes the GameUppermost overlay through 0x004e0730 when the pan state changes. The helper repeatedly consults world_view_should_drive_primary_pan_channel at 0x0043af60 and world_view_should_drive_secondary_pan_channel at 0x0043b030 drives one of the lower motion branches at 0x0043e610 0x0043f4f0 or 0x0043e2c0 and smooths the keyboard zoom-step channel through the shared accumulator at 0x0062be78 before issuing discrete view-height bucket steps through world_view_step_zoom_bucket at 0x0043cc30. Current grounded callers include the recurring world-frame path at 0x00439730 and two setup or transition loops at 0x00516859 and 0x00516921. This now looks like the shared shell-input coordinator above keyboard turn pan zoom cursor drag and hotspot world-view motion rather than a mouse-only helper. | objdump + callsite inspection + caller xrefs |
| 193 | 0x00420030 | 578 | city_connection_bonus_exists_matching_peer_site | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan. | objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding |
| 194 | 0x00420280 | 204 | city_connection_bonus_select_first_matching_peer_site | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan. | objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation |
| 195 | 0x004207d0 | 1053 | city_site_format_connection_bonus_status_label | map | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. When the preview-global `0x0062be84` is armed or the city-side subtype field `[this+0x23e]` is nonzero the function falls back into the neighboring virtual-style formatter at `0x00455860`; otherwise it builds one visible text block from the base city label at `[this+0x356]`, optionally appends the numeric value in `[this+0x276]`, and can append localized id `207` `(Connected)` when the active linked world object and city class checks succeed. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` at `0x00420030` with three meaningful filter combinations: a deeper peer-reachability pass, an active-company-only pass using `scenario_state_get_selected_chairman_company_record` at `0x004337a0`, and a broader any-company pass. After those boolean note checks it also re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` to recover one representative matching peer site, resolves that peer's linked company through `placed_structure_query_linked_company_id` at `0x0047efe0`, and uses the selected company record when formatting the follow-on company-oriented text lane. That current grounded split is enough to tie `3869` `Connected By Another Station`, `3870` `Already Connected`, `3871` `Connected By Another Company`, `3872` `Already Connected by Another Company`, and `3873` `Not Connected` to this formatter boundary rather than to the station-detail overlay body. The helper also writes one caller-owned color field and label-priority scalar before returning style code `3`, so it currently reads as a world-label or hover-summary formatter for city connection-bonus state rather than a generic text helper. | objdump + caller inspection + RT3.lng strings + city-bonus note correlation + filter-combination decoding + peer-selector correlation |
| 196 | 0x0043f640 | 3797 | world_render_station_candidate_service_map_overlay | render | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner. | objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check |
| 197 | 0x00439140 | 1086 | simulation_frame_accumulate_and_step_world | simulation | cdecl | inferred | objdump + analysis-context | 4 | Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup. | objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation |
| 198 | 0x00433b00 | 117 | shell_can_open_trainbuy_window_or_warn | shell | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Shared availability gate above the shell-side `Trainbuy.win` family. The helper first rejects scenario states where the train-buy action is globally disabled through `[0x006cec78+0x4aa3]`, surfacing localized id `334` `That action is not allowed in this scenario.` through the shared shell modal path when blocked. It then checks whether the active company or world object state supplied by the caller allows train purchase; if no company is active it raises id `337` `You can't buy a train without starting a company first!`, and if no track has been placed it raises id `338` `You can't buy a locomotive until some track has been placed!`. Only the success path returns nonzero to the callers at `0x004406d3` and `0x004de7d9`, both of which immediately enter `shell_open_or_focus_trainbuy_window` at `0x00512c50`. | objdump + caller inspection + RT3.lng strings + train-buy gate correlation |
| 199 | 0x0050f740 | 6 | shell_has_live_trainbuy_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Tiny presence probe for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper returns the live-flag dword at `0x006d3ae4`, which is set during `shell_open_or_focus_trainbuy_window` at `0x00512c50` and cleared after that family tears the singleton down. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, building-detail, load-screen, settings, custom-modal, and file-options probes. | objdump + caller inspection + strings correlation + singleton correlation |
| 200 | 0x0050f750 | 11 | shell_mark_trainbuy_window_dirty | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Tiny dirty-latch setter paired with `shell_has_live_trainbuy_window`. The helper stores `1` into `0x006d3adc`, which current nearby call patterns treat as the `Trainbuy.win` refresh or service request latch once the live singleton family rooted at `0x006d3ac8` exists. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is consumed on the message-`0` service path inside the family handler at `0x00512202` through the `0x00512c09` branch. | objdump + caller inspection + nearby-family correlation + singleton correlation + service-path inspection |
| 201 | 0x0050f760 | 45 | shell_trainbuy_window_query_selected_locomotive_id | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`. | objdump + caller inspection + strings correlation + selected-row correlation |
| 202 | 0x0050f790 | 241 | shell_trainbuy_window_compute_selected_upgrade_total_and_count | shell | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Computes the current selected-train upgrade summary beneath the shell-side `Trainbuy.win` family. The helper counts all flagged train entries in the `0x2000`-byte selection array rooted at `0x006d1aa8`, resolves the currently selected locomotive choice through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, and then multiplies the resulting selected-train count by the per-train upgrade cost from `0x004619c0` after converting the current and target locomotive ids through `0x004337b0` and `0x004337a0`. It writes the total upgrade cost through the first out-parameter and the number of selected trains through the second. Current grounded callers are the summary formatter at `0x0050f890` and the purchase-or-upgrade confirmation path inside `shell_trainbuy_window_handle_message`. | objdump + caller inspection + RT3.lng strings + selection-array correlation + upgrade-cost correlation |
| 203 | 0x0050f890 | 368 | shell_trainbuy_window_render_selected_train_upgrade_summary | shell | cdecl | inferred | objdump + caller inspection + RT3.lng strings | 4 | Formats the selected-train upgrade summary text in the shell-side `Trainbuy.win` family. After resolving the currently selected locomotive id through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, the helper calls `shell_trainbuy_window_compute_selected_upgrade_total_and_count` at `0x0050f790` and then builds the player-facing status string from localized ids `1338` `No trains currently selected to upgrade.`, `1339` `Total Cost to Upgrade the %1 Selected Trains to %2 is %3.`, and `1340` `Total Cost to Upgrade the 1 Selected Train to %1 is %2.`. It publishes the resulting heap-backed text through the callback-driven shell control path rooted at control resource `0x275c`. Current grounded callers are the family refresh path at `0x00511500` and the row-selection branch at `0x00512ac7`. | objdump + caller inspection + RT3.lng strings + upgrade-summary correlation |
| 204 | 0x0050fc00 | 1003 | shell_trainbuy_window_render_selected_train_route_and_state_panel | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Renders the richer selected-train detail panel beneath the shell-side `Trainbuy.win` family. The helper resolves the currently selected train and its linked locomotive definition, formats one header block through the shared shell text path at `0x005519f0`, and then builds the lower route or cargo state block through `0x0053de00`, `0x0041d540`, and `0x00552560`. When the runtime latch at `[0x006cec74+0x180]` is set it also appends up to three localized fragments through ids `1341..1343`, gated by bytes `[train+0x30..0x32]`, before laying the final text out. Current grounded callers are the per-row hover or selection refresh paths beneath `Trainbuy.win`; the evidence is strong enough to treat it as the selected-train route-and-state renderer even though the exact player-facing captions for the three optional fragments are still unrecovered. | objdump + caller inspection + nearby-family correlation + selected-train correlation |
| 205 | 0x00511500 | 2941 | shell_trainbuy_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Constructs the shell-side `Trainbuy.win` singleton later published at `0x006d3ac8`. The constructor binds the window resource through `0x0053fa50`, caches three shell runtime handles in `0x006d3abc..0x006d3ac4`, seeds the live singleton pointer at `0x006d3ac8`, builds one filtered locomotive-choice list under `0x006d3ae8`, and then wires the family controls and callbacks through `0x00540120`. Current grounded control ownership is broad enough to treat this as the full `Trainbuy.win` family rather than a small helper: it binds the main action and selection controls under resources `0x2afa..0x2aff`, the selected-train summary path through `shell_trainbuy_window_render_selected_train_upgrade_summary` at `0x0050f890`, the per-row hover helpers at `0x0050fa00` and `0x0050fc00`, the selected-row refresh helper at `0x00511170`, and the selection-paging helper at `0x00512080`. Current grounded caller is `shell_open_or_focus_trainbuy_window` at `0x00512c50`. | objdump + caller inspection + strings correlation + control-wiring inspection + singleton correlation |
| 206 | 0x00512080 | 372 | shell_trainbuy_window_refresh_controls | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Refreshes the visible control state for the shell-side `Trainbuy.win` family. The helper consumes and clears the temporary refresh gate at `0x006d3ae1`, clamps the current selected locomotive-row index from control resource `0x2aff` against the live filtered choice list length at `0x006d3aec`, rewrites the list-selection state across control `0x88`, updates the current mode-strip and list-state controls rooted at `0x00622b28`, and then tail-calls the selected-row detail refresher at `0x00511170`. Current grounded callers are the family constructor at `0x00511500`, the action path after row or mode changes inside `shell_trainbuy_window_handle_message`, and the initial open path in `shell_open_or_focus_trainbuy_window` at `0x00512dd5`. | objdump + caller inspection + strings correlation + list-state correlation |
| 207 | 0x00512c50 | 615 | shell_open_or_focus_trainbuy_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation + RT3.lng strings | 4 | Shared opener for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper first rejects duplicate opens through the live flag at `0x006d3ae4`, seeds the family globals `0x006d3ad0..0x006d3ad8`, `0x006d3acc`, `0x006d3aa8`, `0x006d1aa0`, `0x006d1aa4`, `0x006d3af0`, `0x006d3af4`, `0x00622b24`, and the filtered locomotive-choice list at `0x006d3ae8`, allocates an `0x80`-byte shell window object, constructs it through `shell_trainbuy_window_construct` at `0x00511500`, refreshes it through `shell_trainbuy_window_refresh_controls` at `0x00512080`, and publishes it to the shell runtime at `0x006d401c`. Current grounded callers are the direct train-buy shell command branches at `0x004406ee` and `0x004de7f4` after `shell_can_open_trainbuy_window_or_warn` at `0x00433b00`, plus the sibling train-side action family around `0x00514c97` and `0x00514d7e`. The current family semantics are broader than a bare locomotive picker: nearby message and summary paths show that the same window also stages selected-train upgrade state and train-route editing affordances, but the strongest resource-name anchor remains `Trainbuy.win`. | objdump + caller inspection + strings correlation + RT3.lng strings + singleton correlation + control-family correlation |
| 208 | 0x00512f80 | 193 | shell_trainbuy_window_refresh_selection_side_toggle | shell | thiscall | inferred | objdump + caller inspection + control-flow inspection | 4 | Refreshes the small side-toggle strip beneath `Trainbuy.win` and stores the chosen side in `0x006d3b28`. The helper converts the caller-supplied boolean into two opposing style states on controls `0x6593` and `0x6594`, rewrites one small layout block through `0x0053fe90`, and keeps the current side latched for the surrounding message paths that call it with `0` and `1` at `0x00514fed` and `0x00514fd8`. Current grounded caller is the neighboring train-side window family rooted at `0x006d3b20`, which reuses the same selected-train context but is not yet safely named. | objdump + caller inspection + control-flow inspection + side-toggle correlation |
| 209 | 0x005130f0 | 62 | shell_trainbuy_window_query_selected_train_record | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Returns the currently selected train record or `0` when the active shell detail controller at `0x006d0818` does not hold one valid train id in `[this+0x90]`. The helper validates that selected id against the train collection at `0x006cfcbc` and then resolves the live record through `0x00518140`. Current grounded callers include the neighboring train-side shell window family around `0x005146d6`, `0x00514ce2`, and `0x00515176`, which repeatedly reuse the same selected-train pointer for route, upgrade, and warning flows. | objdump + caller inspection + nearby-family correlation + selected-train correlation |
| 210 | 0x00513130 | 51 | shell_trainbuy_window_query_selected_train_id | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Returns the currently selected train id from the active shell detail controller at `0x006d0818` when that id is positive and still present in the train collection at `0x006cfcbc`; otherwise returns `-1`. Current grounded callers are the same neighboring train-side shell families that package selected-train requests for local and multiplayer follow-on work. | objdump + caller inspection + nearby-family correlation + selected-train-id correlation |
| 211 | 0x00513170 | 44 | shell_trainbuy_window_has_valid_selected_train | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Boolean validity probe above `shell_trainbuy_window_query_selected_train_id`. The helper returns `1` only when the active shell detail controller at `0x006d0818` currently holds one positive train id in `[this+0x90]` and that id is still live in the train collection at `0x006cfcbc`. Current grounded callers include the train-side command family around `0x00514c66`, `0x00514cb5`, `0x00514d9c`, and `0x0051515c`, where it gates nearly every selected-train verb before deeper ownership or route checks run. | objdump + caller inspection + nearby-family correlation + selected-train-id correlation |
| 212 | 0x005131a0 | 125 | shell_trainbuy_window_selected_train_belongs_to_selected_company | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Boolean ownership probe for the currently selected train. After resolving the selected train record through the same `0x006d0818` plus `0x006cfcbc` path as `shell_trainbuy_window_query_selected_train_record`, the helper compares that record's linked company id at `[train+0x51]` against the current scenario-selected company from `0x004337a0`. It returns `1` only when they match. Current grounded callers include the neighboring train-side command family, where failure falls into the explicit warning path at `0x00513220`. | objdump + caller inspection + nearby-family correlation + company-match correlation |
| 213 | 0x00513220 | 351 | shell_trainbuy_window_warn_selected_train_not_owned_by_current_company | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Shared warning modal raised when a selected train does not belong to the current scenario-selected company. The helper resolves one player-facing label through `0x004a8bd0` when a live selected train exists, falls back to the static string block at `0x005c87a8` otherwise, formats localized id `0x250`, and then opens the standard callback-driven shell modal through `shell_open_custom_modal_dialog_with_callbacks` at `0x004c98a0`. Current grounded caller is the ownership-failure branch immediately after `shell_trainbuy_window_selected_train_belongs_to_selected_company` at `0x00514a35`. | objdump + caller inspection + nearby-family correlation + modal correlation |
| 214 | 0x00513720 | 168 | shell_trainbuy_window_refresh_selection_column_empty_state_labels | shell | thiscall | inferred | objdump + caller inspection + control-flow inspection | 4 | Refreshes the paired empty-state labels and styles on controls `0x65a1` and `0x65a2`. The helper inspects the currently active side resource `0x65a3/0x65a4`, checks whether its list selection at `[resource+0x1d6]` is negative, and then switches the two visible placeholder strings between localized ids `0x25b..0x25e` while also rewriting both controls' styles through `0x00540120`. Current grounded callers are the neighboring train-side shell window family constructor at `0x005145f3` and the row-selection action lane at `0x005148f3`. | objdump + caller inspection + control-flow inspection + placeholder-label correlation |
| 215 | 0x00514110 | 67 | shell_train_detail_window_refresh_selected_train_name_label | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Small dynamic-label refresher beneath the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. After validating the currently selected train id from the shell detail controller at `0x006d0818`, the helper resolves control `0x659d` inside the live `TrainDetail.win` singleton and forwards the caller-supplied subject string through `0x004bffc0`. Current grounded caller is the family constructor at `0x00514420`, which binds this helper as the dynamic-text callback for control `0x659d`. | objdump + caller inspection + strings correlation + callback binding |
| 216 | 0x00514160 | 704 | shell_train_detail_window_refresh_controls | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Refreshes the visible control state for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The helper rewrites the two top selection bands `0x65a3` and `0x65a4` from the current side latch at `0x006d3b24`, rebuilds the selected train's nested row state from the current train record resolved through the shell detail controller at `0x006d0818`, installs the per-row callbacks and renderers for the metric rows `0x65b6`, `0x65b9`, `0x65bc`, and `0x65bf`, updates the placeholder and summary text controls `0x659a`, `0x659b`, and `0x659d`, and then refreshes the current row selection plus the paired empty-state labels through `0x004bf320` and `shell_trainbuy_window_refresh_selection_column_empty_state_labels` at `0x00513720`. Current grounded callers are the family constructor at `0x00514420`, the opener at `0x00514620`, and several action paths inside the family message dispatcher at `0x00514690`. | objdump + caller inspection + strings correlation + callback binding + row-state correlation |
| 217 | 0x00514420 | 512 | shell_train_detail_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Constructs the shell-side `TrainDetail.win` singleton later published at `0x006d3b20`. The constructor seeds the local vtable at `0x005d1990`, caches three shell runtime handles in `0x006d3b14..0x006d3b1c`, binds the `TrainDetail.win` resource directly through `0x0053fa50` using the embedded string at `0x005d19c0`, and then wires the family controls and callbacks through `0x00540120`. Current grounded bindings are broad enough to treat this as the full `TrainDetail.win` family: it installs row-click callbacks on `0x65a3` and `0x65a4`, metric renderers on `0x65ab` and `0x65ac`, the selected-train callback on `0x659c`, the dynamic-name label callback on `0x659d`, seeds the side-toggle state through `shell_trainbuy_window_refresh_selection_side_toggle` at `0x00512f80`, and then refreshes the full window through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current grounded callers are the shell detail-panel transition manager at `0x004ddda1` and the direct opener at `0x00514620`. | objdump + caller inspection + strings correlation + callback binding + singleton correlation |
| 218 | 0x00514620 | 110 | shell_open_or_focus_train_detail_window | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Shared opener or focus path for the shell-side `TrainDetail.win` singleton. When the caller supplies one valid train id present in the train collection at `0x006cfcbc`, the helper can seed the selected train subject through `0x004a7390`; when a live `TrainDetail.win` singleton already exists at `0x006d3b20` and the current shell runtime subject matches the incoming one, it simply refreshes that window and pings the shell runtime. Current grounded direct caller is the surrounding shell command path at `0x0046cbda`, and the existing constructor edge at `0x004ddda1` confirms that this opener sits above the same `TrainDetail.win` family rather than the neighboring `Trainbuy.win` singleton. | objdump + caller inspection + strings correlation + singleton correlation |
| 219 | 0x00514690 | 1920 | shell_train_detail_window_handle_message | shell | thiscall | inferred | objdump + caller inspection + control-flow inspection + RT3.lng strings | 4 | Primary message dispatcher for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The handler processes shell messages `0`, `0xca`, `0xcb`, and the recurring service message `0x3e9`; routes the top-level side-toggle, list-selection, and metric-row controls through a dispatch table over resources `0x659c..0x6947`; repeatedly reuses the currently selected train via the helper family at `0x005130f0..0x00513220`; and fans out into several now-bounded train verbs. Current explicit branches include one selected-train engine-replacement or trainbuy handoff lane that checks scenario gate `[0x006cec78+0x4a97]`, raises localized ids `593` `That action is not allowed in this scenario.` and `594` `You can not replace the engine while the train is broken-down.` on failure, and otherwise re-enters `shell_open_or_focus_trainbuy_window` at `0x00512c50` or the neighboring local follow-on path at `0x00436820`; one selected-train retirement lane that checks `[0x006cec78+0x4a9b]`, rejects blocked states through ids `595` and `597`, confirms through id `596`, and then either tears the train down locally through the train collection plus `shell_detail_panel_transition_manager` mode `2` or packages multiplayer opcode `0x37`; plus one tighter route-edit lane over the shared `0x33`-stride route-entry family, where removal re-enters `train_route_list_remove_entry_and_compact` at `0x004b3000` and staged insertion re-enters `train_route_list_insert_staged_entry_at_index` at `0x004b3160`, then validates the resulting route through `train_route_list_validate_reachability_and_station_pair` at `0x004b2c10` and commits the follow-on train state through `train_set_route_operating_mode_and_scalar` at `0x004ab980`, with multiplayer opcode mirrors `0x3d`, `0x3f`, and `0x41`. It also consumes the family refresh path through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current evidence is broad enough to treat this as the full `TrainDetail.win` message owner even though several deeper per-action verbs remain semantically open. | objdump + caller inspection + control-flow inspection + dispatch-table inspection + selected-train helper correlation + RT3.lng strings |
| 220 | 0x004a01a0 | 789 | route_entry_collection_try_build_path_between_optional_endpoint_entries | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy route-entry collection method over the global route store at `0x006cfca8`. The helper accepts up to two optional endpoint-entry pointers or ids, two endpoint coordinate pairs, a route-policy or mode byte, and optional output slots for the chosen endpoint-entry ids. It first resolves any supplied route-entry ids through `0x00518140` and projects them back to compact coordinate pairs through `0x0048a170`, rejects early when either endpoint lands on an invalid world tile through `0x00449980`, and computes one span scalar through `0x004952f0`. When the leading endpoint entry is absent it can synthesize one fresh route entry from the supplied coordinates and policy arguments through `0x00493cf0`; after that it resolves the chosen entry, copies four `3*dword` route-shape or bounding blocks from that entry into the collection-owned builder-state area at `[this+0x139]..[this+0x167]` through `0x005394b0`, stores the chosen endpoint coordinates at `[this+0x11d]` and `[this+0x121]`, latches one active-builder flag at `[this+0x118]`, and stages one linked entry field from `[entry+0x202]` into `[this+0x125]`. On one newly synthesized-entry path and policy bytes `1/2` it also touches the auxiliary route-entry family at `0x006cfcb4` through `0x004a42b0`, `0x00494f00`, and `0x004a4340`. Current caller evidence now narrows one more policy case: both the later world-side caller at `0x00480cd0` and the linked-site refresh helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` enter this helper with both optional endpoint-entry ids unset and literal policy byte `2`, so the strongest current read for that byte is a full linked-site route-anchor rebuild between optional endpoint entries rather than the narrower direct endpoint-anchor creation or replacement lane carried by literal byte `1` in `0x00493cf0`. The helper then resets the collection's transient path-search state through `0x00495480`, re-enters the deeper route-search core at `0x0049d380`, optionally writes the chosen endpoint-entry ids back through the caller-supplied output pointers on success, and finally tears down the transient search state through `0x00495540` and `0x0049ad90`. Current grounded callers are the early route-search lane inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, two neighboring retry branches at `0x004030d0` and `0x00403330`, a paired startup-connection branch at `0x00403ac0`, that later world-side caller at `0x00480cd0`, and the linked-site refresh helper at `0x00480bb0`. This now looks like the shared route-entry search or synthesis owner above the deeper path-search core rather than a generic route-store mutator. | objdump + caller xrefs + callsite inspection + route-entry search correlation + builder-state correlation + partial-mode-byte correlation + linked-site refresh correlation + linked-site policy-byte split correlation |
| 221 | 0x004a3db0 | 272 | route_entry_collection_service_recent_entry_state_promotions_and_followon_refreshes | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Collection-wide post-change sweep over the global route-entry store at `0x006cfca8`. The helper first snapshots collection field `[this+0x90]` into `[this+0x94]`, then, when shell-state gate `[0x006cec74+0x94]` is set, walks every live route entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. The current changed-entry lane is now bounded: for entries newer than collection threshold `[this+0x102]` via `[entry+0x240]` and still carrying state byte `[entry+0x216] == 1`, it promotes that state through `0x0048b830(entry, 2)` and then releases any queued side list at `[entry+0x244]` through `0x00489f40`. After that sweep it drains the collection-owned linked list at `[this+0x98]`, resets `[this+0x88] = -1`, and, when shell runtime `0x006d401c` is live while collection latch `[this+0xed]` is clear, posts shell status id `0xbb` through `0x00538e00`. When any entry was promoted it also re-enters `0x004358d0` on the active mode object at `0x006cec78`, triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6`, and then tails into `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` on `0x006ada90`. Current grounded callers include the city-connection route-builder tail at `0x00404564`, the linked-site route-anchor refresh tail at `0x00480d1c`, and TrackLay-side follow-ons at `0x0050d7ed` and `0x0050db24`, so this is now the safest current read for the route-entry collection's recent-entry state-promotion and follow-on refresh sweep rather than a generic collection walk. | objdump + caller inspection + local disassembly + route-entry collection correlation + state-promotion correlation + runtime-effect trigger-kind correlation + route-link followon correlation |
| 222 | 0x00489f80 | 11 | route_entry_assign_aux_tracker_group_id | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 3 | Tiny route-entry helper that writes the caller-supplied auxiliary tracker id into route-entry field `+0x212`. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, and neighboring tracker-update branches at `0x004996e0`, `0x004a4380`, `0x004a4ce0`, and `0x004a4ff0`. This now looks like the direct route-entry aux-tracker group-id assignment helper rather than a generic field store. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 223 | 0x00493cf0 | 456 | route_entry_collection_create_endpoint_entry_from_coords_and_policy | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Creates one fresh route-entry endpoint record from caller-supplied coordinates and a small policy tuple. The helper rejects when either coordinate pair falls outside the live world bounds in `0x0062c120`, optionally validates the supplied company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0`, allocates a new route-entry-like record from the current collection through `0x00518900` with type `0x257`, applies one company-side setup branch through `company_adjust_available_track_laying_capacity_with_floor_zero` `0x00423ec0` when the company id is nonzero, and then commits the detailed endpoint payload through `0x00490ac0`. It can also re-enter `0x00491e60` when the created record or the owning collection keeps one follow-on latch set, and if the collection field `[this+0x88]` is still unset it seeds that field from the created record's word at `+0x240`. Current mode-byte evidence is still partial but tighter now. Literal policy byte `1` is the strongest current match for direct linked-site endpoint-anchor creation or replacement, because the linked-site constructor and its nearby repair branches at `0x00480463`, `0x00480a77`, and `0x00480b69` all pass that byte before rebinding one chosen anchor through `0x0048abc0`. The TrackLay-side callers at `0x0050df1e` and `0x0050eec6` are tighter now too: they derive the passed policy byte from the shared TrackLay mode `0x00622b0c` through `route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte` `0x004955b0`, which currently gives the strongest read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`. Bytes `1/2` are also the ones later reused by `0x004a01a0` to enable the auxiliary tracker lane, while the company-side charge split is no longer vague: when a company id is present, ordinary company-bound synthesis passes `-1` into `0x00423ec0`, while byte `4` instead passes `-2`, so the current strongest read is that policy byte `4` consumes a larger company-side available-track-laying-capacity unit rather than skipping the company setup branch outright. The older builder-state path at `0x0046f2d1` still passes a dynamic byte from `[esi+0x05]`. The function returns the newly created route-entry id or `-1` on failure. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, those neighboring route-building branches, and the TrackLay-side callers at `0x0050df1e` and `0x0050eec6`, so this now looks like the shared endpoint-entry synthesis helper rather than a generic collection allocator. | objdump + caller xrefs + callsite inspection + route-entry creation correlation + partial-mode-byte correlation + caller-pattern correlation + route-build-capacity correlation + linked-site policy-byte split correlation + TrackLay mode correlation |
| 224 | 0x00494e40 | 61 | aux_route_entry_tracker_reset | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 2 | Zeroes or reinitializes one small auxiliary route-entry tracker record. The helper seeds the two endpoint-entry ids at `+0x04` and `+0x08` to `-1`, clears the small refcount at `+0x10`, clears the cached route-key and class-signature words at `+0x18` and `+0x1e`, resets the boolean latch at `+0x1c` to `0`, and clears the trailing payload band through `+0x42`. Current grounded callers are the tracker allocator paths at `0x004a42b0` and several neighboring `0x006cfcb4` setup sites, so this is the clearest current initializer for the auxiliary route-entry tracker family. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 225 | 0x00494e90 | 15 | aux_route_entry_tracker_seed_owner_entry_id | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 2 | Seeds one auxiliary route-entry tracker with its owner or primary route-entry id. The helper writes the caller-supplied id into tracker field `+0x00` and clears the small accumulator fields at `+0x42` and `+0x46`. Current grounded callers are the tracker allocator paths at `0x004a42b0`, which use it immediately after allocating one `0x006cfcb4` record keyed by a route-entry id. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 226 | 0x00494eb0 | 15 | aux_route_entry_tracker_adjust_refcount | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 2 | Adds the caller-supplied delta into the small refcount field at tracker offset `+0x10` and returns the updated total. Current grounded callers are the collection-side tracker updater `0x004a4340`, where a zero result triggers the tracker's destruction path. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 227 | 0x00494ed0 | 26 | aux_route_entry_tracker_contains_endpoint_entry_id | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 2 | Small membership probe over one auxiliary route-entry tracker. The helper returns `1` when the caller-supplied route-entry id matches either tracker endpoint slot `+0x04` or `+0x08`, and `0` otherwise. Current grounded callers include several tracker-regroup and repair branches around `0x00490d62`, `0x0049a9ed`, `0x0049f162`, and `0x004a4ce0`, where it acts as the cheap endpoint-membership test beneath adjacent-chain transfer and duplicate-split logic. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 228 | 0x00494f00 | 176 | aux_route_entry_tracker_merge_or_bind_endpoint_entry | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Binds one route-entry id into the two-endpoint auxiliary tracker record. The helper resolves the supplied route-entry through `0x006cfca8`, derives one route-key-like value through `0x0048aa70`, reads the route-entry signature fields at `+0x22e` and byte `+0x44`, and then either seeds both endpoint slots `+0x04/+0x08` on the first bind or merges the new entry into one side when the signature, route-key, and boolean class latch match the tracker's existing state. On failure it returns `0`; on success it returns `1`. Current grounded callers are the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring `0x006cfcb4` tracker update branches around `0x0049f1ce`, `0x0049f38d`, `0x0049f90b`, `0x004a4685`, `0x004a4830`, `0x004a4982`, `0x004a5175`, and `0x004a5189`. This now looks like the tracker-side endpoint bind or merge helper rather than a generic route-entry accessor. | objdump + caller xrefs + callsite inspection + tracker-family correlation |
| 229 | 0x00494fb0 | 97 | aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Refreshes the small boolean class latch at tracker offset `+0x1c` and notifies the owning route-entry group when that latch changes. When the route-store latch `[0x006cfca8+0xf1]` is clear, the helper resolves the current endpoint-entry ids from `+0x04` and `+0x08`, recomputes whether the bound endpoint pair carries the nonzero route-entry byte `+0x44` on both sides, writes the resulting boolean back into `+0x1c`, compares it against the previous latch value, and on change calls `0x004a6360` on the auxiliary tracker collection `0x006cfcb4` with the owner entry id at `+0x00`. Current grounded callers are the neighboring route-state branch at `0x004915e0` and the compatible endpoint-slot rewrite helper `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0`. This now looks like the tracker-side boolean class-latch refresh plus owner-notify path rather than a generic predicate helper. | objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-notify correlation |
| 230 | 0x00495020 | 188 | aux_route_entry_tracker_refresh_cached_match_fields_and_maybe_split_duplicate_pair | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + field-layout inspection | 3 | Refreshes one auxiliary tracker's cached match metadata and clears its trailing relationship payload band. Under two scenario-threshold branches keyed by `[0x006cec78+0x46c34]`, the helper seeds or refreshes tracker cache fields from the currently bound endpoint pair: it derives one route-key-like value through `0x0048aa30`, reuses one endpoint signature word from route-entry field `+0x22e`, and falls back to constant `1` when no endpoint slot is available on the active branch. After that it zeroes the trailing payload band at `+0x24..+0x46`. When both endpoint slots `+0x04` and `+0x08` still point to the same route-entry id and the tracker refcount `+0x10` is greater than `1`, it tail-calls the deeper split or reseed path at `0x004a51a0` with the owner route-entry id at `+0x00`. Current grounded caller is the broader tracker-side branch at `0x004a41b0`. The current objdump shape keeps the exact `+0x18/+0x1e` destination split slightly irregular on the second threshold path, so this row stays conservative about the final field assignment while still grounding the helper as cached-match refresh plus duplicate-pair split prep. | objdump + caller xrefs + callsite inspection + field-layout inspection + tracker-family correlation |
| 231 | 0x004950f0 | 128 | aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Rewrites one matching endpoint slot in an auxiliary tracker after compatibility checks. The helper validates the replacement route-entry id, derives its route-key-like value through `0x0048aa70`, requires that value plus the route-entry signature word `+0x22e` to match the tracker's cached comparison fields, and then only replaces endpoint slot `+0x04` or `+0x08` when the caller-supplied old endpoint id currently occupies that slot. After any replacement it re-enters `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0` so the boolean class latch at `+0x1c` stays in sync. It returns `1` when a slot was replaced and `0` otherwise. Current grounded callers include the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, the neighboring route-state helpers at `0x00490bf0` and `0x004996e0`, and the tracker-side link-rewrite family at `0x004a4ce0`. This now looks like the compatibility-checked endpoint-slot rewrite helper beneath the auxiliary tracker family rather than a generic record mutator. | objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-slot rewrite correlation |
| 232 | 0x004955b0 | 43 | route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Small mapper from the live TrackLay primary mode into one of the endpoint-synthesis policy bytes consumed by `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`. The helper returns `1` immediately when the caller-supplied mode dword is `1`; otherwise it inspects two route-store state fields at `[this+0x1e1]` and `[this+0x1fd]` before either keeping that same `1` fallback or returning `4`. Current grounded callers are the TrackLay-side branches at `0x0050df00` and `0x0050eea8`, where the input mode comes directly from the shared TrackLay state at `0x00622b0c` already bounded as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40`. That makes the strongest current read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`, with one route-store-state-dependent fallback still preventing a fully closed user-facing name. | objdump + caller xrefs + callsite inspection + TrackLay mode correlation + partial-policy-byte correlation |
| 233 | 0x004952f0 | 208 | math_compute_quadrant_adjusted_heading_angle_from_xy_pair | map | cdecl | inferred | objdump + caller xrefs + arithmetic inspection | 4 | Computes one quadrant-adjusted heading angle from two float XY point pairs. The helper handles the vertical-line degeneracy explicitly by returning `pi/2` or `3*pi/2`, otherwise computes one arctangent ratio through the CRT helper at `0x005a1270` and then adds either `pi` or `2*pi` when the caller's delta pair lands in the corresponding quadrant. The result is a normalized heading-like angle in the `0 .. 2*pi` range. Current grounded callers include the route-entry search family at `0x004a01a0`, `0x0049d380`, and `0x0049c900`, plus several neighboring route and world-side geometry branches. | objdump + caller xrefs + arithmetic inspection + constant correlation |
| 234 | 0x004953c0 | 95 | math_normalize_subtracted_angle_delta_and_report_wrap | map | thiscall | inferred | objdump + caller xrefs + arithmetic inspection | 4 | Subtracts one angle from another and normalizes the resulting delta back into the principal `[-pi, pi]` range. When the optional pointer in `ECX` is nonnull the helper clears it to `0`, then sets it to `1` only when the delta had to be wrapped by adding or subtracting `2*pi`. Current grounded callers include the route-entry search family at `0x0049d380` and `0x0049c900`, several route-node or waypoint geometry branches, and neighboring world-side angle tests. This now grounds `0x004953c0` as a reusable wrapped-angle-delta helper rather than another anonymous quality check. | objdump + caller xrefs + arithmetic inspection + constant correlation |
| 235 | 0x0049d380 | 1134 | route_entry_collection_search_path_between_entry_or_coord_endpoints | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy internal route-search core beneath the route-entry synthesis family. The helper accepts a leading route-entry id, one company id, two endpoint coordinate pairs, a route-policy tuple, one optional external target entry id, and several scratch or output buffers. It begins by validating the company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0` when present, then packages the current search context into the collection-owned builder state, including one current-search latch at `[this+0x1d5]` and one distance-like scalar at `[this+0x1d1]`. From there it runs three bounded internal stages. First, it enters the deeper candidate path sweep at `0x0049bd40`; this can return a direct matching route-entry id or leave the search unresolved. Second, when that first stage does not settle the search, it rehydrates the returned route entry through `0x0048a170`, evaluates point-to-point distance, span, and angle-like quality terms through `math_measure_float_xy_pair_distance` `0x0051db80`, `0x004952f0`, `0x004953c0`, and `0x005a152e`, and only accepts the result when those quality gates pass. Third, when the quality gates or initial sweep fail, it can fall back to route-entry extension helpers `0x00494cb0` and `0x0049c900`, plus route-state propagation through `0x0048e600`, while rewriting several collection-side path blocks rooted at `[this+0x169]`, `[this+0x175]`, `[this+0x181]`, `[this+0x18d]`, `[this+0x199]`, `[this+0x1a5]`, `[this+0x1b1]`, and `[this+0x1bd]`. The function returns one resolved route-entry id or `-1`, and current direct callers are only internal route-entry family wrappers at `0x004a0470`, `0x004a0870`, `0x004a0b2a`, and `0x004a0cef`. In current evidence this is the search core that the higher wrapper `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` hands off to after endpoint reuse or synthesis, rather than a user-facing route mutator by itself. | objdump + caller xrefs + callsite inspection + path-search correlation + builder-state correlation + distance-helper correlation + track-laying-capacity correlation |
| 236 | 0x0049bd40 | 982 | route_entry_collection_run_initial_candidate_path_sweep | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Runs the first candidate route sweep beneath `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`. The helper clears any prior temporary path list through `0x0049ad90`, seeds two caller-owned status dwords, resolves the starting route-entry id through the collection, rejects one trivial or degenerate local-delta case, and then seeds an initial extension attempt through `0x00494cb0`. From there it builds one temporary candidate chain in `[this+0x1cd]`, derives route quality terms from point-to-point distance through `math_measure_float_xy_pair_distance` `0x0051db80`, re-enters the route-node search against the auxiliary tracker collection `0x006cfcb4` through `0x004a6630`, and on a passing result publishes one follow-on route-entry id through the caller-supplied output slot. Current evidence now narrows the internal quality policy too: when the route-state gate at `[this+0xe9]` stays clear the helper selects a larger quality multiplier of `1.8` on route-policy byte `4` or field `[0x006cec78+0x4c74]`, and otherwise uses `1.4`; the same branch also folds in one signed angle-bias term `+/-0.181000038854627` before the later acceptance checks. That field is still the same player-facing TrackLay preference slot grounded elsewhere as `Auto-Show Grade During Track Lay`, but on this route-search lane it now reads more concretely as a temporary search-quality override: the shared city-connection builder `0x00402cb0` and the broader company periodic pass `0x004019e0` both mirror electric-locomotive context into it specifically to force this same larger initial-sweep multiplier branch. Current grounded direct caller is the search core `0x0049d380`, where this helper is the first stage before the later quality-gate and extension fallbacks. This now looks like the initial candidate path sweep rather than a generic collection iterator. | objdump + caller xrefs + callsite inspection + candidate-sweep correlation + tracker-family correlation + quality-threshold constant correlation + distance-helper correlation + temporary-override correlation |
| 237 | 0x0049c900 | 829 | route_entry_collection_try_extend_search_frontier_toward_target_coords | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Tries to extend the current route-search frontier toward one target coordinate pair. The helper starts from two endpoint coordinate pairs plus one caller-owned result slot, initializes that result slot to `-1`, computes span and angle-like quality terms through `0x004952f0`, `0x005a152e`, and the same constant families used by the search core, and then repeatedly advances the search sample window until one candidate route extension passes the quality thresholds. Current evidence now narrows those thresholds too: this helper reuses the same signed angle-bias family `+/-0.181000038854627` seen in the initial candidate sweep before deciding whether to probe a covering entry. On successful passes it re-enters `route_entry_collection_try_find_route_entry_covering_point_window` `0x00494cb0`, verifies the returned entry through `0x0048ba40`, `0x004953c0`, and neighboring state bytes, and publishes the accepted route-entry id through the caller-owned result pointer. On failure it leaves that pointer at `-1`. Current grounded direct callers are the search core `0x0049d380` and the neighboring route wrapper at `0x004a0740`, which together make this the clearest current extension or frontier-advance helper beneath the route-entry search family rather than a free-standing world query. | objdump + caller xrefs + callsite inspection + frontier-extension correlation + quality-threshold constant correlation |
| 238 | 0x00494cb0 | 398 | route_entry_collection_try_find_route_entry_covering_point_window | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Searches the current route-entry collection for one entry whose sampled span covers the caller's point window. The helper rejects immediately when the supplied window radius is nonpositive, quantizes the caller's center coordinates into world-grid bounds, iterates the resulting rectangular tile window inside `0x0062c120`, and repeatedly re-enters `0x004921a0` on each candidate tile or route bucket until it finds one acceptable route-entry id. Current grounded callers include the station-attachment validation lane at `0x00403d30`, the placement validator at `0x00417ba1` and `0x0041a2c9`, the world-side route mutation lane at `0x00480d88`, the initial candidate sweep `0x0049bd40`, the search core `0x0049d724`, and several neighboring route-search branches. This now looks like the shared route-entry point-window coverage query beneath both placement-side track attachment and the heavier route-entry search family rather than a generic tile scan. | objdump + caller xrefs + callsite inspection + world-grid correlation + route-window correlation |
| 239 | 0x004a42b0 | 79 | aux_route_entry_tracker_collection_allocate_entry | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Allocates one new tracker record in the auxiliary route-entry collection at `0x006cfcb4` and seeds it for one owner route-entry id. The helper resets a small local tracker template through `aux_route_entry_tracker_reset` `0x00494e40`, allocates one live record from the collection through `0x00518900`, resolves that record, seeds its owner entry id through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90`, and returns the new tracker id. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x0049e174`, `0x0049e3d8`, `0x0049e427`, `0x0049e45c`, `0x0049f1b0`, `0x0049f3b5`, `0x0049f91a`, `0x004a466d`, `0x004a4814`, `0x004a4966`, and `0x004a5054`, so this is now the clearest current allocator for the auxiliary route-entry tracker family. | objdump + caller xrefs + callsite inspection + tracker-family correlation |
| 240 | 0x004a4340 | 55 | aux_route_entry_tracker_collection_adjust_refcount_or_destroy | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Looks up one tracker record in the auxiliary route-entry collection at `0x006cfcb4`, adjusts its small refcount through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`, and destroys the record through the collection vtable when the resulting count reaches zero. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x00490da5`, `0x0049a9b8`, `0x0049abca`, `0x0049f178`, `0x0049f1a2`, `0x0049f1e0`, `0x0049f37e`, `0x0049f3a7`, `0x004a4f9c`, `0x004a4fb0`, and `0x004a5161`. This now looks like the shared refcount or destroy path for the auxiliary route-entry tracker family rather than another anonymous collection helper. | objdump + caller xrefs + callsite inspection + tracker-family correlation |
| 241 | 0x004a4380 | 619 | aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Broader prepass beneath the auxiliary route-entry tracker regrouping family at `0x006cfcb4`. Starting from one existing tracker id, the helper snapshots the source tracker's cached match tuple at `+0x18/+0x1c/+0x1e` plus its endpoint slots `+0x04/+0x08`, walks the adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family, and watches for a subchain whose route-key-like value from `0x0048aa70`, signature word `+0x22e`, or boolean class byte `+0x44` no longer matches the source tracker. When that mismatch survives the surrounding guards, it allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, seeds or binds the moved entries through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90` and `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, reassigns the traversed route entries through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalances the two trackers' counts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`, where this helper runs as the early split prepass keyed by the current route entry's tracker id. This now looks like the chain-splitting helper that carves a mismatching adjacent subchain into one fresh tracker group rather than a generic collection walk. | objdump + caller xrefs + callsite inspection + tracker-family correlation + regrouping prepass correlation |
| 242 | 0x004a45f0 | 1420 | aux_route_entry_tracker_collection_refresh_route_entry_group_membership | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy regrouping pass over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper starts from one route-entry record, rejects the trivial case where both adjacent route-entry fields `[entry+0x206]` and `[entry+0x20a]` are unset, optionally runs `aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group` `0x004a4380` keyed by the route entry's current tracker id in `[entry+0x212]`, and then refreshes ownership around that id. On the simpler branch it can allocate one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, bind one or more route-entry ids into it through `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, assign the resulting tracker id back into route-entry field `+0x212` through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalance tracker refcounts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. The current endpoint-bind semantics are tighter now too: the bind helper groups entries only when their route-key-like value from `0x0048aa70`, route-entry signature word `+0x22e`, and boolean class latch derived from byte `+0x44` all agree. On the larger branch this pass walks adjacent route-entry links through the `+0x206/+0x20a/+0x20e` family, can re-enter `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate compatible neighboring subchains between tracker groups, uses `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` to rewrite compatible endpoint slots, and can re-enter the nearby cached-match refresh path `0x00495020` before dropping empty tracker records through the collection vtable. Current grounded caller is `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where this pass runs immediately after literal-policy-`2` route-anchor rebuild and bind. This now looks like the auxiliary tracker regrouping pass beneath the broader linked-site route-anchor rebuild lane rather than a generic collection sweep. | objdump + caller xrefs + callsite inspection + tracker-family correlation + linked-site refresh correlation + endpoint-match-tuple correlation + chain-transfer correlation |
| 243 | 0x004a4c00 | 224 | aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate | map | thiscall | inferred | objdump + callsite inspection + field-layout inspection | 3 | Compatibility gate used before adjacent tracker-chain transfers. Given two route-entry records, the helper validates both current tracker ids in the auxiliary tracker collection at `0x006cfcb4`, resolves the two tracker records, and then requires a matching cached comparison tuple across both trackers: byte `+0x1d` must be nonzero on both sides, dwords `+0x18` and `+0x1e` must match, and boolean latch byte `+0x1c` must match. It also requires both candidate route entries to keep their special side fields at `+0x20e` and `+0x222` unset at `-1`. Only when all of those checks pass does it return `1`; otherwise it returns `0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links` `0x004a6360`, where this gate sits directly above the adjacent-chain transfer helper `0x004a4ce0`. This now looks like the reusable adjacent-chain transfer compatibility gate rather than a generic pairwise predicate. | objdump + callsite inspection + field-layout inspection + tracker-family correlation + transfer-gate correlation |
| 244 | 0x004a4ce0 | 777 | aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Reusable cross-group migration helper beneath the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids plus one cached match tuple, the helper first verifies that collection-busy latches are clear, validates the destination tracker's cached fields at `+0x18/+0x1c/+0x1d/+0x1e`, then walks one adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family while using `aux_route_entry_tracker_contains_endpoint_entry_id` `0x00494ed0` to avoid trampling the destination tracker's existing endpoint entries. Compatible traversed entries are reassigned into the destination group through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, source and destination tracker populations are rebalanced through `aux_route_entry_tracker_collection_adjust_refcount_or_destroy` `0x004a4340` and the raw `+0x14` count field, and the destination endpoint slots can be rewritten through `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` before any emptied source tracker is destroyed. Current grounded callers include the owner-refresh family at `0x004a6360` plus neighboring route-state branches at `0x0049ac78`, `0x0049ff6e`, and `0x004a645a..0x004a65a3`. This now looks like the adjacent-chain transfer helper between compatible tracker groups rather than a generic collection mutator. | objdump + caller xrefs + callsite inspection + tracker-family correlation + adjacent-chain transfer correlation |
| 245 | 0x004a4ff0 | 454 | aux_route_entry_tracker_collection_reseed_group_from_route_entry_component | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Repair or reseed helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. Starting from one route-entry id whose current tracker membership is missing or invalid, the helper allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, assigns that tracker id into the starting entry through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, walks the connected route-entry component through `0x0048e140` and `0x0048e160`, and migrates each adjacent member that still carries the stale tracker id into the new group while counting the moved entries. It then updates the involved tracker populations, binds the new component's endpoint entries back into the fresh tracker through two calls to `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, and returns. Current grounded callers include the route-state repair branch at `0x0048b896` and the broader tracker traversal pass at `0x004a6244`. This now looks like the component-level tracker-group reseed helper used when a route-entry component has lost valid tracker ownership rather than a generic regrouping walk. | objdump + caller xrefs + callsite inspection + tracker-family correlation + reseed correlation |
| 246 | 0x004a5fc0 | 928 | aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Collection-wide traversal refresh for the auxiliary route-entry tracker family at `0x006cfcb4`. The helper clears the collection dirty latch at `[this+0x8c]`, allocates one temporary queue array at `[this+0x94]`, resets every live tracker's traversal label field at `+0x0c` to `-1`, and then repeatedly walks connected tracker groups until every live record has one stable component label. While traversing, it destroys dead tracker records whose active count has fallen nonpositive, follows adjacent route-entry links outward from each tracker endpoint through the `+0x206/+0x20a/+0x20e` route-entry family, and when one neighboring route entry carries an invalid tracker id it repairs that side immediately through `aux_route_entry_tracker_collection_reseed_group_from_route_entry_component` `0x004a4ff0` before continuing the walk. The refreshed component labels are stored back into tracker field `+0x0c`, and neighboring collection-side queries reuse them after the dirty latch has been cleared. Current grounded callers are the adjacent tracker-query helper at `0x004a6320` and neighboring owner-refresh branches that first test `[this+0x8c]` before trusting cached component labels. This now looks like the collection-wide connected-component refresh and invalid-group reseed pass rather than a generic sweep. | objdump + caller xrefs + callsite inspection + tracker-family correlation + traversal-label correlation + reseed correlation |
| 247 | 0x004a6360 | 592 | aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Owner-side adjacent-group refresh beneath the auxiliary route-entry tracker family at `0x006cfcb4`. Starting from one owner route-entry id, the helper validates the current tracker, requires its tracker-side enable byte `+0x1d` to be nonzero, resolves the two bound endpoint entries from tracker slots `+0x04` and `+0x08`, and first requires those endpoint entries to agree on the boolean class state derived from route-entry byte `+0x44`. It then inspects adjacent route-entry links hanging off both endpoint sides through the `+0x206/+0x20a` family and, whenever a neighboring route entry belongs to a different tracker group, runs `aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate` `0x004a4c00` before re-entering `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate that compatible adjacent chain into the owner's tracker group. Current grounded caller is `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0`, which invokes this helper only when the tracker's boolean class latch at `+0x1c` changes. This now looks like the owner-adjacent compatible-group refresh path triggered by latch changes rather than a generic tracker walk. | objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-refresh correlation + compatibility-gate correlation |
| 248 | 0x004a62c0 | 79 | aux_route_entry_tracker_query_tracker_component_labels_match | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Small dirty-aware equality test over tracker component labels in the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids, the helper first refreshes stale labels through `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when collection dirty latch `[this+0x8c]` is set, resolves both tracker records, and returns `1` only when both ids are live and tracker field `+0x0c` matches across the pair. Invalid tracker ids return `0`. Current grounded callers include the alternate recursive pair-metric branch at `0x004a5900`, where this helper gates same-component recursion before adjacent-neighbor expansion. | objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label equality correlation |
| 249 | 0x004a6320 | 64 | aux_route_entry_tracker_collection_query_component_label_by_tracker_id | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Dirty-aware query helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper first checks collection dirty latch `[this+0x8c]` and re-enters `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when the cached component labels are stale. It then validates the caller-supplied tracker id through the collection, resolves the live tracker record, and returns the connected-component label stored in tracker field `+0x0c`; invalid tracker ids return `-1`. Current grounded callers are the heavier pair-selection family around `0x004a6630`, where this helper is the reusable query side of the component-label sweep rather than another traversal owner. | objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label query correlation |
| 250 | 0x004a65b0 | 128 | aux_route_entry_tracker_dispatch_route_entry_pair_metric_query | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Build-compatibility-switched lower metric query beneath the auxiliary route-entry tracker pair-selection family. The helper forwards one fixed route-entry pair, one companion output pair, and the surrounding score or scratch arguments into one of two heavier internal algorithms: it dispatches to `0x004a5280` when the shared build-version query at `runtime_query_hundredths_scaled_build_version` `0x00482e00(0x006cec74)` reports at least `0x67`, and otherwise dispatches to `0x004a5900`. The recovered cutovers now line up with executable build values `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`, and the version source itself can come from either the local `RT3.EXE` version resource or the multiplayer session-side companion path at `0x0046a4b0`, so this branch now reads most safely as a pre-`1.03` versus `1.03+` route-metric compatibility dispatcher rather than any gameplay time or era gate. Current grounded caller is the broader chooser at `0x004a6630`, which can invoke this helper repeatedly across multiple endpoint combinations, keep the smallest non-`-1` returned score, and publish the chosen route-entry pair through out pointers. Current evidence is therefore tight enough to treat this as the reusable route-entry-pair metric dispatcher beneath that chooser, while the deeper user-facing meaning of the returned metric still lives mostly in the linked-transit and route-validation consumers rather than inside this switch itself. | objdump + caller xrefs + callsite inspection + tracker-family correlation + pair-metric correlation + version-gate correlation + multiplayer-session-version correlation |
| 251 | 0x004a5280 | 1664 | aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk. | objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation |
| 252 | 0x004a5900 | 1728 | aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan. | objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation |
| 253 | 0x004a6630 | 892 | aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep. | objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation |
| 254 | 0x004a9460 | 65 | train_current_route_context_uses_strict_reachability_mode | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open. | objdump + caller xrefs + callsite inspection + route-context correlation |
| 255 | 0x004a94b0 | 381 | train_finalize_aux_route_entry_buffer_preserving_subflags | simulation | thiscall | inferred | objdump + caller xrefs + route-entry inspection | 3 | One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open. | objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation |
| 256 | 0x004ab980 | 760 | train_set_route_operating_mode_and_scalar | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open. | objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation |
| 257 | 0x004b2b80 | 29 | train_route_list_count_live_site_reference_entries | simulation | thiscall | inferred | objdump + caller xrefs + route-entry inspection | 4 | Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter. | objdump + caller xrefs + route-entry inspection + callsite inspection |
| 258 | 0x004b2c10 | 656 | train_route_list_validate_reachability_and_station_pair | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 4 | Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan. | objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split |
| 259 | 0x004b2f00 | 250 | train_route_list_select_entry_and_refresh_linked_site_state | simulation | thiscall | inferred | objdump + caller xrefs + state-layout inspection | 4 | Shared selector helper for one train-owned route-entry list whose records are `0x33` bytes wide. The helper clamps the requested selected index against the current count at `[this+0x4]`, stores the new selection in `[this+0x8]`, and only when route-entry flag byte `+0x28` has its sign bit clear does it extract the previous and new placed-structure ids from field `+0x29` and forward that old/new site pair into `0x004819b0`; sign bit set entries skip that placed-structure extraction path. It then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. When the caller requests it, it also marks the owning train record's byte `[train+0x1b9]`. Current grounded callers include the local `TrainDetail.win` route-entry branch at `0x00514a96`, the multiplayer-side route-entry handlers at `0x00471730` and `0x004097f9`, and the removal helper `train_route_list_remove_entry_and_compact` at `0x004b3000`. The same route family is now also tied to localized reachability warnings `3089..3091`, so this reads as a train route-stop or waypoint selection helper rather than a generic row selector. | objdump + caller xrefs + state-layout inspection + placed-structure-id correlation + route-warning correlation + route-entry flag split |
| 260 | 0x004b3000 | 341 | train_route_list_remove_entry_and_compact | simulation | thiscall | inferred | objdump + caller xrefs + state-layout inspection | 4 | Removes one entry from the same `0x33`-stride train-owned route list and compacts the remaining records. The helper validates the caller-supplied index against current count `[this+0x4]`, repairs the selected index `[this+0x8]`, re-enters `train_route_list_select_entry_and_refresh_linked_site_state` at `0x004b2f00` when the removed row was the selected one, allocates a shorter replacement buffer, copies the prefix and suffix segments around the removed row, decrements the list count, frees the old buffer, and then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. Current grounded callers include the local `TrainDetail.win` route-entry removal branch at `0x00515211` and the multiplayer-side handler at `0x00471823`. | objdump + caller xrefs + state-layout inspection + compacting-buffer correlation + route-list correlation |
| 261 | 0x004b3160 | 530 | train_route_list_insert_staged_entry_at_index | simulation | thiscall | inferred | objdump + caller xrefs + state-layout inspection + RT3.lng strings | 4 | Inserts one staged `0x33`-byte route-entry record into the same train-owned route list at one caller-selected index. Before insertion the helper seeds parts of the staged record from the prior terminal route entry and preserves the currently grounded lower route-entry subflags `0x40`, `0x20`, and `0x10` in field `+0x28`. That same flag byte also carries the top-level entry split: sign bit clear entries use one live placed-structure id in field `+0x29`, while sign bit set entries use one direct route-node payload in field `+0x2b`. Only the live site-reference branch can re-enter the narrower tutorial gate `tutorial_validate_train_route_station_indicator_step` at `0x00516d00`, and only when the staged placed-structure id is station-or-transit-like and the shell tutorial family rooted at `0x006d3b4c` is active. The helper then allocates a `(count+1)` replacement buffer, copies the prefix rows, writes the staged record at the requested insertion index, copies the suffix rows, frees the old buffer, bumps the count, repairs the selected index, and refreshes the linked train-side state. Current grounded callers include the local `TrainDetail.win` insertion or staging branch at `0x00515417`, the multiplayer-side handlers at `0x004718e5` and `0x004097eb`, and the nearby validation path that surfaces localized reachability warnings `3090` `This train cannot reach the station you've selected.` and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the route-stop or waypoint insertion helper above that validation family rather than as a generic record copier. | objdump + caller xrefs + state-layout inspection + RT3.lng strings + insertion-buffer correlation + route-warning correlation + route-entry flag split + subflag preservation |
| 262 | 0x00516be0 | 284 | tutorial_advance_step_and_refresh_expected_control_ids | shell | cdecl | inferred | objdump + caller xrefs + local disassembly + tutorial-table inspection | 4 | Advances one active shell tutorial step and refreshes the small expected-control cache under `0x00622b34..0x00622b3c`. The helper first returns immediately when the tutorial-active flag at `0x006d3b4c` is zero; otherwise it increments the current tutorial step index at `0x006d3b50`, consults the `0x40`-byte descriptor table rooted at `0x00622b48`, and skips several currently grounded step codes when their extra world or shell-state predicates fail. After choosing the next live step it copies the previous expected control id from `0x00622b34` into `0x00622b38`, then loads the new expected control id and one current alternate-accepted control id from descriptor offsets `+0x34` and `+0x38` into `0x00622b34` and `0x00622b3c`. Current shell-command correlation is now tight enough to support that narrower reading: the generic shell control path around `0x004de199` and `0x004de724` compares incoming control ids directly against `0x00622b3c` and suppresses the tutorial-only `3587` rejection when they match, which makes `0x00622b3c` look like a current companion control id rather than a page or mode selector. The helper also rate-limits one small shell-side nudge through `0x0045ea20` while the tutorial runs. Current grounded callers are the generic shell control path at `0x00540cca` and the train-route tutorial validator at `0x00516d93`, which makes this the current best owner for the tutorial step-advance and expected-control cache instead of leaving `0x00622b34/38/3c` as anonymous globals. | objdump + caller xrefs + local disassembly + tutorial-table inspection + control-cache correlation + shell-command correlation |
| 263 | 0x00516d00 | 143 | tutorial_validate_train_route_station_indicator_step | shell | thiscall | inferred | objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings | 4 | Small shell-side tutorial gate used before one live station-or-transit site id is committed into the train route-entry list. The helper only matters while the tutorial state family rooted at `0x006d3b4c` is active: it consults the current tutorial step index at `0x006d3b50`, reads that step's code from the `0x40`-byte tutorial descriptor table rooted at `0x00622b48`, and accepts only the currently grounded step codes `0x172` and `0x17c`, which align with localized tutorial prompts `3777` `Click on the yellow station indicator for Milan.` and `3778` `Now click on the station indicator for Turin`. For accepted steps it stages the caller-supplied site id into `0x006d3b5c` and, in the second step, advances the surrounding tutorial state through `0x00516be0` only when the incoming site differs from the currently staged one. For incompatible tutorial steps it opens one callback-driven shell modal through `0x004c98a0` and returns `0`, which causes `train_route_list_insert_staged_entry_at_index` at `0x004b3160` to abort before the record is inserted. Current evidence is therefore tight enough to treat this as the tutorial-side train-route station-indicator validator rather than a general `TrainDetail.win` row-kind gate. | objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings + modal correlation |
| 264 | 0x00517d40 | 66 | indexed_collection_entry_id_is_live | simulation | thiscall | inferred | objdump + caller inspection + collection-bitset inspection | 4 | Shared indexed-collection presence test over the common collection layout that uses `[this+0x14]` as the upper id bound and `[this+0x34]` as the tombstone or disabled-bitset. The helper rejects nonpositive or out-of-range ids and otherwise returns `1` only when the bit for the requested id is clear, i.e. when the entry is currently live. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it guards ordinary candidate ids before `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and neighboring collection walkers that treat the same ids as positive live-record selectors rather than zero-based dense ordinals. | objdump + caller inspection + collection-bitset inspection + callsite correlation |
| 265 | 0x00517cf0 | 3 | indexed_collection_slot_count | simulation | thiscall | inferred | objdump + caller inspection + collection-layout inspection | 4 | Tiny shared accessor that returns the current slot-count field `[this+0x18]` from the common indexed-collection layout. Current grounded callers use it as the upper bound for zero-based slot walks before resolving one nth live entry id through `indexed_collection_get_nth_live_entry_id` `0x00518380`. | objdump + caller inspection + collection-layout inspection + slot-walk correlation |
| 266 | 0x00518140 | 89 | indexed_collection_resolve_live_entry_by_id | simulation | thiscall | inferred | objdump + caller inspection + collection-layout inspection | 4 | Shared indexed-collection record resolver over the same common collection layout. The helper rejects nonpositive, out-of-range, or tombstoned ids through the `[this+0x14]` bound and `[this+0x34]` bitset, then returns one live record pointer from the payload rooted at `[this+0x30]`. When collection flag dword `[this+0x04]` is nonzero it treats that payload as a flat `stride=[this+0x08]` record array and returns `base + stride*id`; otherwise it treats the payload as an array of record pointers stored in `stride=[this+0x08]` slots and returns the pointer loaded from `base + stride*id`. Current grounded callers include the company, profile, train, and structure-candidate families, where it is the common bridge from one positive collection id to one concrete live record pointer. | objdump + caller inspection + collection-layout inspection + direct-vs-indirect payload correlation |
| 267 | 0x00518380 | 364 | indexed_collection_get_nth_live_entry_id | simulation | thiscall | inferred | objdump + caller inspection + collection-layout inspection | 4 | Shared nth-live-entry selector over the same indexed-collection layout. With traversal mode `0` it walks slot ids in forward order, skipping tombstoned ids through the bitset at `[this+0x34]`, and returns the positive entry id whose zero-based live ordinal matches the caller-supplied index; recent results are memoized in the small cache bands rooted at `[this+0x68]` and `[this+0x78]`. With nonzero traversal mode it reuses the auxiliary link banks rooted at `[this+0x38]`, `[this+0x48]`, and `[this+0x58]` to step through one alternate live-order chain before returning the resulting id. Current grounded callers across company, profile, structure-candidate, and placed-structure families mostly use traversal mode `0`, where this is the shared bridge from one zero-based live ordinal to one positive collection entry id. | objdump + caller inspection + collection-layout inspection + cache-band inspection + alternate-chain correlation |
| 268 | 0x0051c920 | 223 | localization_lookup_display_label_by_stem_or_fallback | shell | thiscall | inferred | objdump + caller inspection + language-table correlation + static-table inspection | 4 | Shared shell-side label helper that turns one ASCII stem string into one player-facing display label. The helper case-folds the first letter, scans the static `(stem, string-id)` table rooted at `0x006243c8`, compares candidate stems case-insensitively, and returns the localized text for the first matching string id through `0x005193f0` when that localized entry is nonempty. The current table correlation already grounds entries such as `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng ids `3202..3220`. When no table entry matches, the helper falls back to localized id `3866` `Could not find a translation table entry for '%1'`. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it sits directly above candidate field `[record+0x04]`, and several neighboring list and detail renderers that need one display label from the same stem family. | objdump + caller inspection + language-table correlation + static-table inspection + RT3.lng correlation |
| 269 | 0x0051d3c0 | 44 | calendar_point_pack_tuple_to_absolute_counter | support | fastcall | inferred | objdump + caller inspection + local arithmetic correlation | 3 | Tiny packed-calendar helper that converts one local tuple rooted at the caller pointer in `ECX` into the same absolute calendar counter family later stored at `[world+0x15]`. It reads one year word plus four packed calendar subfields from `[tuple+0x00/+0x02/+0x04/+0x05/+0x06]`, combines them as one mixed-radix `12 x 28 x 3 x 60` progression, and returns the resulting scalar for direct subtraction against `[0x006cec78+0x15]`. That is now the strongest current read for the world-side calendar model: a packed year-plus-subfield point converted into one absolute counter rather than a plain year or month stamp. Current grounded finance caller is the stock-issue cooldown gate inside `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, where it converts the current issue tuple at `[company+0x16b/+0x16f]` before comparing that scalar against the active world counter. | objdump + caller inspection + local arithmetic correlation + finance-cooldown correlation + world-calendar-counter correlation + mixed-radix decode |
| 270 | 0x0051d460 | 131 | calendar_point_unpack_absolute_counter_to_tuple | support | fastcall | inferred | objdump + caller inspection + local arithmetic correlation | 3 | Inverse packed-calendar helper for the absolute counter family rooted at `[world+0x15]`. It accepts one absolute calendar counter in `ECX`, decomposes it back into the same mixed-radix year-plus-subfield tuple, and returns the reconstructed pair of dwords in `EAX:EDX` for storage into fields such as `[world+0x0d]` and `[world+0x11]`. Current local arithmetic now bounds the inverse against the same `12 x 28 x 3 x 60` model as `0x0051d3c0`, which keeps this tuple in the world-side calendar-point family rather than as an unrelated packed timestamp. Current grounded callers are `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, which refreshes `[world+0x0d/+0x11]` from the selected absolute counter at `[world+0x15]`, plus the target-resolution wrappers `0x0051d550` and `0x0051d5f0` used by `simulation_advance_to_target_calendar_point` `0x0040ab50`. | objdump + caller inspection + local arithmetic correlation + world-calendar-tuple correlation + target-resolution correlation + mixed-radix decode |
| 271 | 0x004f2e80 | 14 | shell_has_live_overview_window | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Tiny presence probe for the shell-side `Overview.win` singleton rooted at `0x006d12bc`. The helper returns `1` when that live overview object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside other shell-window probes, and the overview family itself around `0x004f3a10`, which uses the same singleton to suppress duplicate opens. | objdump + caller inspection + nearby-family correlation + singleton correlation |
| 272 | 0x004f2e90 | 11 | shell_mark_overview_window_dirty | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Tiny dirty-latch setter paired with `shell_has_live_overview_window`. The helper stores `1` into `0x006d12cc`, which current nearby call patterns treat as the `Overview.win` refresh or service request latch once the live overview singleton at `0x006d12bc` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`. | objdump + caller inspection + nearby-family correlation + singleton correlation |
| 273 | 0x004f38a0 | 67 | shell_overview_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Constructs the shell-side `Overview.win` object later published at `0x006d12bc`. The constructor seeds the local vtable at `0x005d1368`, binds the shell window resource through `0x0053fa50`, clears the selected subject field at `[this+0x7c]`, and installs the shared control callback `0x004f3880` on control `0x88bf`. Current grounded caller is `shell_open_or_focus_overview_window` at `0x004f3a10`, and current string-table correlation leaves `Overview.win` as the strongest owner name for this singleton family. | objdump + caller inspection + strings correlation + singleton correlation |
| 274 | 0x004f38f0 | 562 | shell_overview_window_handle_message | shell | thiscall | inferred | objdump + caller inspection + control-flow inspection | 4 | Primary message dispatcher for the shell-side `Overview.win` family rooted at `0x006d12bc`. The handler processes the usual shell message ids `0`, `0xca`, and `0xcb`; uses the current subject object at `[this+0x78]`; opens follow-on detail lanes through `0x004f2ea0`; and raises simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when the requested drill-down path is currently invalid. It also consumes the family dirty latch at `0x006d12cc` on the recurring service path. Current grounded caller is the shell runtime after construction through `shell_open_or_focus_overview_window`. | objdump + caller inspection + control-flow inspection + dirty-latch correlation |
| 275 | 0x004f3a10 | 272 | shell_open_or_focus_overview_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Shared opener for the shell-side `Overview.win` singleton. When a valid overview subject exists under the live world-side owner at `0x006cea4c` and no current overview window is open, the helper allocates an `0x80`-byte shell object, constructs it through `shell_overview_window_construct` at `0x004f38a0`, publishes it through the shell runtime at `0x006d401c`, and stages the selected subject pointer into the live singleton at `0x006d12bc` before routing it into the family message path at `0x004f2ea0`. When an overview window already exists it leaves the current singleton in place. Current grounded callers include the world-side action branches at `0x004396ae` and `0x004414c6`, both of which pass one subject object resolved from `0x006cea4c` before opening the overview path. | objdump + caller inspection + strings correlation + singleton correlation + publish-path inspection |
| 276 | 0x004b99c0 | 88 | structure_candidate_collection_get_nth_active_candidate_id | map | cdecl | inferred | objdump + caller inspection + collection iteration | 4 | Returns the zero-based nth active candidate id from the structure-candidate collection at `0x0062ba8c`. The helper iterates the collection through `0x517cf0` and `0x518380`, skips candidates whose active byte in the returned record is clear, decrements the caller-supplied ordinal only across the surviving entries, and finally returns the matching candidate id or `0` when the requested active slot does not exist. Current grounded callers are the shell-side building-detail branches at `0x004ba01f`, `0x004bbcfd`, and `0x004bbd56`, where ordinals `page-3` are translated back into live candidate ids before the selected-building service and capability rows are refreshed. | objdump + caller inspection + collection iteration + active-candidate correlation |
| 277 | 0x004b9a20 | 833 | shell_building_detail_refresh_flagged_service_capability_rows | shell | thiscall | inferred | objdump + caller inspection + control-range inspection | 3 | Shared `BuildingDetail.win` refresh helper for the flagged service or capability row bands driven from the currently selected building subject at `0x006cfe04`. The helper repeatedly restyles controls in the `0x7d07..0x7d1c` range through `0x540120`, using route-entry flag byte `+0x28` from the selected building subject as the decision source. Current local control correlation now bounds that mask family more tightly than a generic bit consumer: `0x7d07/0x7d08` split the zero-versus-nonzero `0x30` mask, `0x7d11/0x7d12` split the bit-`0x20`-only case, `0x7d13/0x7d14` split the exclusive-or `0x20^0x10` case, `0x7d17/0x7d1a` track bit `0x20`, `0x7d18/0x7d1b` track bit-`0x10`-only, and `0x7d19/0x7d1c` track the combined `0x30` case. The later repeated row family rooted at `0x7f58..0x801f` also consults bit `0x40` together with the currently selected candidate or service id in subject field `+0x24`, but current evidence now narrows that lane too: it is a selected-ordinal highlight band rather than a generic restyle loop. The special express-side triplet at `0x7f58..0x7f5a` is the fixed table-driven branch; after that the helper falls through into the ordinary active-candidate/service rows. When the selected id is below `0x384`, the helper translates it through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0` and highlights ordinal `3 + active-candidate-rank` for the current subject id; otherwise it treats `0x384..` as the parallel express-side family directly. Current grounded callers include the broader building-detail refresh path at `0x004bae97`, the constructor-adjacent refreshes at `0x004bbcf3` and `0x004bbd0d`, and neighboring handler branches at `0x004bb8e3`, `0x004bbe5c`, and `0x004bc039`. Current evidence is therefore strong enough to treat this as the shared shell-side consumer of route-entry subflags `0x10`, `0x20`, and `0x40` even though the ordinary candidate-row captions still remain open. | objdump + caller inspection + control-range inspection + route-entry flag correlation + active-candidate correlation + control-family triplet correlation + row-mask partition correlation + selected-ordinal highlight correlation |
| 278 | 0x004ba3d0 | 2380 | shell_building_detail_refresh_subject_cargo_and_service_rows | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 3 | Large `BuildingDetail.win` refresh helper for the selected subject row families centered on controls `0x7d06`, `0x7d96..`, `0x7d0e`, and the adjacent `0x7d6a/0x7d6b` and `0x7d9d` visual lanes. The helper walks the selected building subject at `0x006cfe04`, iterates the per-subject id list rooted at `[subject+0x01]`, validates ordinary ids through the structure-candidate collection at `0x0062ba8c` with `indexed_collection_entry_id_is_live` `0x00517d40`, resolves them into concrete live candidate records through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then uses candidate field `[record+0x04]` as the shared stem for both the ordinary row asset path `%s.imb` and the neighboring display-label lookup through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. Only when that ordinary candidate branch fails does it fall back to the fixed express-side special ids `0x384..0x386`. Current table correlation now bounds that fixed branch more sharply: `0x00621df8` seeds the short-label controls `0x7dc8..0x7dca` with localized ids `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while `0x00621e10` seeds the adjacent asset-name controls `0x7e90..0x7e92` with `AnyCargo`, `AnyFreight`, and `PassMail` before `%1.imb` formatting. The helper also uses `Cargo.imb`, `Caboose.imb`, and the adjacent asset string `Dining.imb` while rebuilding the visible row payloads; current RT3.lng alignment now ties the longer descriptive popup/help side to `497/498` for freight/express and the two special service rows to localized labels `911` `Dining Car` and `912` `Caboose`. One resource-side boundary is tighter now too: the extracted `BuildingDetail.win` blob currently exposes only a sparse embedded text table with the help line `0xbb8`, the asset-name string `0xbb9`, and one standalone caption entry `0xbba` `Cargo`, which is the strongest current resource-side anchor for the row header around `0x7d06` and simultaneously reinforces that the deeper ordinary rows are being labeled from live candidate-record stems rather than from a larger hidden caption table. Current subflag correlation is tighter too: the extra visual lanes `0x7d6a`, `0x7d6b`, and `0x7d9d` are driven from the same selected-subject flag byte at `+0x28`, with `0x7d9d` on the bit-`0x20` branch using `Caboose.imb` and the sibling bit-`0x10` special lane using `Dining.imb`. The helper then re-enters both `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20` and the flagged-row helper `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current grounded callers include the main building-detail refresh at `0x004baedd`, constructor-adjacent and handler-side refreshes at `0x004bb8dc`, `0x004bbc89`, `0x004bbd6a`, and `0x004bc02b`. Current evidence is therefore strong enough to treat this as the selected-building cargo or service row owner even though several ordinary candidate-row captions remain unrecovered. | objdump + caller inspection + strings correlation + control-range inspection + candidate-id correlation + collection-helper correlation + stem-label correlation + subflag-row correlation + asset-string block correlation + RT3.lng correlation + table-entry correlation + win-resource extraction |
| 279 | 0x004ba270 | 311 | shell_building_detail_handle_subject_value_row_band_action | shell | cdecl | inferred | objdump + callsite inspection + local disassembly | 3 | Small `BuildingDetail.win` row-band action callback over the control-id family `0x7d07..0x7d14`. The helper switches on the clicked control id minus `0x7d07`, updates the selected building subject rooted at `0x006cfe04`, and treats subject bytes `+0x21`, `+0x22`, and `+0x23` as one current selection plus one bounded low/high pair. On change it increments the family dirty latch at `0x006cfe0c`, writes the refreshed current or bound value back through the shared shell control helper on code `0x66`, and when the side list helper at `0x006cfe08` is active it re-enters the neighboring follow-up refresh path at `0x004b9ec0`. Current direct installation site is the `0x7d0e` widget branch inside `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004bacc9`, which keeps this bounded as the live action owner for the paired value rows rather than another passive formatter. | objdump + callsite inspection + local disassembly + selected-subject field correlation |
| 280 | 0x004bad20 | 461 | shell_building_detail_refresh_subject_pair_value_rows | shell | thiscall | inferred | objdump + caller inspection + control-range inspection | 3 | Shared `BuildingDetail.win` helper for the mutually exclusive subject-value row pairs around controls `0x7d05..0x7d14`. The helper first styles the leading pair `0x7d05/0x7d06`, then chooses between the value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and `0x7d13/0x7d14` from the selected building subject at `0x006cfe04`, using the same flag byte at `+0x28` that drives the neighboring cargo or service rows. On the nonzero selector branch it instead refreshes the current-selection status around `0x7d0d/0x7d0e` from the subject count byte and the subject field at `+0x21`, then tails back into `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`. Current payload values for the mutually exclusive pairs come from subject fields `+0x22` and `+0x23`, and current grounded caller correlation keeps this bounded as one shared pair-value row owner rather than a separate top-level widget family. | objdump + caller inspection + control-range inspection + subject-field correlation + flag-branch correlation |
| 281 | 0x004b9d70 | 14 | shell_has_live_building_detail_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Tiny presence probe for the shell-side `BuildingDetail.win` singleton rooted at `0x006cfe00`. The helper returns `1` when that live detail object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, load-screen, settings, custom-modal, and file-options probes. | objdump + caller inspection + strings correlation + singleton correlation |
| 282 | 0x004b9d80 | 11 | shell_mark_building_detail_window_dirty | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Tiny dirty-latch setter paired with `shell_has_live_building_detail_window`. The helper stores `1` into `0x006cfe10`, which current nearby call patterns treat as the `BuildingDetail.win` refresh or service request latch once the live singleton at `0x006cfe00` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`. | objdump + caller inspection + nearby-family correlation + singleton correlation |
| 283 | 0x004b9e10 | 166 | shell_building_detail_submit_aux_owner_subject_sync_request | shell | cdecl | inferred | objdump + caller inspection + state-block inspection | 3 | Small side-owner sync helper for `BuildingDetail.win`. When the auxiliary owner at `0x006cd8d8` is present and the local dirty counter `0x006cfe0c` is nonzero, the helper allocates a `0x3f`-byte request block, stamps a small header through `0x005216c0` and `0x00513130`, stores one mirrored-subject mode bit in request word `+0x08`, stores the current building-detail ordinal from `0x00621df4`, then copies the full staged building subject record from `0x006cfe04` into the request body before queueing it through `0x00469d30` on the owner-local request list at `[0x006cd8d8+0x8f48]`. Current direct callers are the `0x7d01` and `0x7d09/0x7d0a` branches inside `shell_building_detail_window_handle_message` `0x004bb9e0`, and both now clearly source that mode bit from the side-list mirror latch at `[0x006cfe08+0x0c]`, which keeps this bounded as an auxiliary-owner subject-sync path that preserves local mirror-state rather than a generic widget refresh. The helper also currently suppresses submission when the neighboring live-flag dword at `0x006d3ae4` is nonzero. | objdump + caller inspection + state-block inspection + side-owner queue correlation + mirror-latch correlation |
| 284 | 0x004b9ec0 | 272 | shell_building_detail_propagate_selected_subject_state_into_side_list | shell | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Shared follow-up helper for `BuildingDetail.win` when the sibling side-list owner at `0x006cfe08` is active and its mirror latch at `+0x0c` is nonzero. The helper walks every indexed side-list subject through `0x004b2b60`, copies the currently selected subject state from `0x006cfe04` into each sibling record, mirrors the current service or capability id at `[subject+0x24]`, and propagates the mutable subflag family in byte `+0x28` with bits `0x40`, `0x20`, and `0x10` preserved from the active subject. It also copies the current-selection fields `+0x21/+0x22/+0x23` and the live id list rooted at `+0x01`, which is why the paired value-row action helper at `0x004ba270` and several handler-side selector branches re-enter this path after mutating the active subject. Current grounded callers are `shell_building_detail_handle_subject_value_row_band_action` at `0x004ba270` and the handler-side refresh branches at `0x004bbc9d`, `0x004bbd81`, and `0x004bbe55`. | objdump + caller inspection + local disassembly + selected-subject field correlation + side-list iteration correlation + mirror-latch correlation |
| 285 | 0x004b9fd0 | 672 | shell_building_detail_present_flagged_service_capability_popup | shell | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Popup callback installed on the larger `BuildingDetail.win` flagged-row band. The helper takes one clicked control id in the `0x7f58..0x801f` family, resolves either one fixed express-side descriptor from table `0x00621e04` for the first three rows or one active candidate/service id from the selected subject at `0x006cfe04+0x24`, and then formats an explanatory shell popup before returning through `0x538c70`. Current table correlation now closes that first triplet more cleanly: `0x00621e04` supplies localized ids `494`, `497`, and `498`, so the fixed popup/help branch is specifically `Any Cargo`, `Any Freight\\n(Freight is everything but Passengers, Mail, and Troops)`, and `Any Express\\n(Express is Passengers, Mail, and Troops)` for controls `0x7f58..0x7f5a`. Current language-table correlation also tightens the ordinary popup split: one single-line availability popup uses localized id `3922` `%1\\nLoads available at %2: %3`, while the ordinary candidate branch uses localized id `2981` `%1\\nLoads available at %2: %3 Current Price: %4` and can append localized id `2982` `Price at next station, %1: %2 (%3%4)`. On that ordinary branch it resolves the current candidate through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0`, compares the selected site against the current subject site at `+0x29`, queries local service metrics through `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and conditionally computes the nearby-site delta line before presenting the final text. Current direct installation sites are the callback-registration branches at `0x004bb43f` and `0x004bb8a6`, which keeps this bounded as the live explanatory popup owner for the `0x7f58..0x801f` selector rows rather than another passive formatter. | objdump + caller inspection + local disassembly + callback-registration correlation + popup-path correlation + candidate-metric correlation + RT3.lng correlation + table-entry correlation |
| 286 | 0x004bb9e0 | 2183 | shell_building_detail_window_handle_message | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Primary message dispatcher for the shell-side `BuildingDetail.win` family rooted at `0x006cfe00`. The handler switches over shell messages `0`, `0xca`, and `0xcb`; updates the staged building subject in `0x006cfe04` and its list helper at `0x006cfe08`; refreshes the visible control ranges `0x7d..0x8051`; and consumes the dirty latch at `0x006cfe10` on the recurring service path. Its action cases are now tighter than a generic navigation bucket. The `0x7d01` branch is no longer just an isolated oddball either: extracted `BuildingDetail.win` text now makes `Set the initial cargo amount for 'Disable Cargo Economy' scenarios.` the strongest current caption candidate for that control, the message path can mirror that action through `shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner live, and one later rejection path now clearly raises localized id `3587` `This option is only available by following the tutorial.` behind the active tutorial flag at `0x006d3b4c` plus the cached previous expected-control id at `0x00622b38`. The `0x7d02/0x7d03` pair flips selected-subject bit `0x40` and re-enters `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20`, which makes that pair the real top-level mode switch between the bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`. The `0x7d09/0x7d0a` pair steps neighboring building subjects through `0x004b2b60`, skipping disallowed subjects on the local iteration path, and the same branch can also mirror the new selected subject through `0x004b9e10` when that auxiliary owner is present. The `0x7d0f/0x7d10` pair flips selected-subject bits `0x20` and `0x10`, i.e. the same special-service subflags later rendered as `Caboose` and `Dining Car`, and then re-clamps the paired value widgets through the same shared refresh path. The `0x7f58..0x801f` selector band changes the current service or capability id at `[subject+0x24]` before re-entering `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20`; current refresh-side correlation now shows that band as one selected-ordinal picker over three fixed express rows plus the ordinary active-candidate rows rather than an undifferentiated list. The `0x8020..0x8051` action band is now tighter too: it is primarily a per-row removal family over the selected subject's live id list rooted at `+0x01`, zeroing one indexed entry, compacting the remaining dword ids, decrementing count byte `+0x00`, clamping the current-selection byte `+0x21`, and then refreshing the visible row bands. Two special row indices inside that same band re-route into the adjacent `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction when the current `0x20/0x10` service-bit state requires it. The handler can also open simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when one building-side action is disallowed. Current grounded callers are the shell runtime after construction and the explicit dirty-latch service path. | objdump + caller inspection + strings correlation + control-range inspection + dirty-latch correlation + selected-subject mutation correlation + RT3.lng correlation + selected-ordinal correlation + remove-entry compaction correlation + auxiliary-owner sync correlation + tutorial-rejection correlation + expected-control-cache correlation |
| 287 | 0x004baef0 | 2793 | shell_building_detail_window_refresh_controls | shell | thiscall | inferred | objdump + caller inspection + control-range inspection | 4 | Primary refresh path for the shell-side `BuildingDetail.win` family. The helper rebuilds the top-level control bands under `0x7d02..0x8051`, including the paired mode switch `0x7d02/0x7d03` from subject flag `0x40`, the smaller special-service toggles `0x7d0f/0x7d10` from subject bits `0x20` and `0x10`, the current-selection status widget around `0x7d0d/0x7d0e`, the selected-building cargo or service rows through `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`, the paired subject-value rows through `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20`, and the flagged service or capability rows through `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current control-building correlation now makes the leading special-row bands explicit too: the short-label triplet `0x7dc8..0x7dca`, its adjacent asset/icon triplet `0x7e90..0x7e92`, and the popup/selectable triplet `0x7f58..0x7f5a` are the fixed express-side branch before the broader ordinary candidate rows. Current branch structure is tighter too: when subject bit `0x40` is set the refresh ends on the selected-subject cargo/service family rooted at `0x004ba3d0`, while the clear branch instead ends on the flagged capability-selector family rooted at `0x004b9a20`. It also hides or shows the larger control ranges `0x7dc8..0x7f57`, `0x7f58..0x801f`, and `0x8020..0x8051` through the shared shell control toggles at `0x53fe00`. Current grounded callers are the main constructor-side and focus refreshes at `0x004bbace`, `0x004bc0cc`, and `0x004bc0de`, and the message dispatcher at `0x004bb9e0`. | objdump + caller inspection + control-range inspection + subject-flag correlation + helper-family correlation + branch-end correlation + control-family triplet correlation |
| 288 | 0x004bc0a0 | 71 | shell_building_detail_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Constructs the shell-side `BuildingDetail.win` object later published at `0x006cfe00`. The constructor seeds the local vtable at `0x005d05e0`, binds the window resource through `0x0053fa50`, and immediately refreshes the visible subject and control bands through `0x004baef0`. Current grounded caller is `shell_open_or_focus_building_detail_window` at `0x004bc100`, and current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family. | objdump + caller inspection + strings correlation + singleton correlation |
| 289 | 0x004bc100 | 203 | shell_open_or_focus_building_detail_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Shared opener for the shell-side `BuildingDetail.win` singleton. The caller supplies the building-detail list helper in `ECX`, one current building subject in `EDX`, and one selected ordinal on the stack. The helper seeds the shared family globals at `0x006cfe04`, `0x006cfe08`, and `0x00621df4`, validates that the supplied building subject resolves to one live world object through the placed-structure collection at `0x006cec20`, allocates a `0x78`-byte shell object when no detail window is live, constructs it through `shell_building_detail_window_construct` at `0x004bc0a0`, publishes it through the shell runtime at `0x006d401c`, and tears it back down on return while clearing `0x006cfe00`. Current grounded callers include the world-side branch around `0x004bbace`, which updates the current building subject before opening this detail family. Current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family. | objdump + caller inspection + strings correlation + publish-path inspection + singleton correlation |
| 290 | 0x004384d0 | 570 | world_run_post_load_generation_pipeline | map | cdecl | inferred | objdump + strings + caller xrefs | 4 | Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first runs the preliminary candidate-availability prepass at `0x00437743` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection pass `world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`. | objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation |
| 291 | 0x00437743 | 93 | world_preseed_named_candidate_availability_records_from_live_pool | map | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The helper iterates the live candidate pool at `0x0062b268` in reverse order, derives one small boolean mode from candidate bytes `[candidate+0xba]` and `[candidate+0x32]`, and then re-enters `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on the active scenario state `0x006cec78` using the candidate name at `+0x04`. The whole pass is skipped once global threshold `0x00620e94` reaches `0x26ad`. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass rather than another visible progress phase. | objdump + local disassembly + caller correlation + candidate-pool correlation |
| 292 | 0x00438890 | 644 | shell_active_mode_run_profile_startup_and_load_dispatch | map | thiscall | inferred | objdump + caller xrefs + debugger comparison | 4 | Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, posts several shell progress or status updates through `0x5193f0/0x540120`, enumerates one shell-managed list off `0x006d4020+0x429b0`, and then switches over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438fbe` that allocates `0x0062c120` when absent, runs `0x0044faf0`, and then forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(0, 0)` immediately after dismissing the current detail panel and servicing `0x004834e0(0, 0)`. `0x0046b8bc` remains the distinct multiplayer-preview relaunch owner, also entering as `(0, 0)` before a later staged `0x00445ac0` call. | objdump + caller xrefs + manual-load breakpoint comparison + owner-tail disassembly + caller-shape comparison + selector-jump-table decode + tutorial-string correlation + selector-writer correlation |
| 293 | 0x00435603 | 10 | scenario_state_ensure_derived_year_threshold_band | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Tiny guard wrapper over one derived scenario-state year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. When the small mode or threshold byte at `[this+0x3a]` is already `>= 2` the helper returns immediately; otherwise it falls back into the heavier rebuild body at `0x004351c0`, which refreshes those companion thresholds from the current year and shell-controller-side values before continuing. Current grounded callers are the post-fast-forward selected-year tail at `0x00437170`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, the compact runtime-effect side branch at `0x00431e03`, and the shell-command lane at `0x004661c0/0x004661e9`, so this is the safest current read for the small year-threshold ensure wrapper rather than a generic boolean probe. | objdump + local disassembly + caller correlation + year-threshold-band correlation |
| 294 | 0x00435630 | 648 | scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables | map | thiscall | inferred | objdump + caller xrefs + state-layout inspection | 4 | Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book payload at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared maximum annual production float that precedes the first line, counts active lines across five repeated `0x30`-byte line records, and then imports those five lines into one parallel runtime array of `0xbc`-byte descriptors. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves nonempty cargo strings through the global cargo collection at `0x0062ba8c`, and builds paired runtime halves for the mode families `2/3` and `1/3`. Current mode gating is now tight enough to treat the polarity as grounded rather than provisional: the source token at `line+0x08` is the supplied-cargo field because it is the branch activated for `Supply Only` and `Production Demand->Supply`, while the source token at `line+0x1c` is the demanded-cargo field because it is the branch activated for `Demand Only` and `Production Demand->Supply`. The constructor and handler now tighten the amount semantics too: `line+0x04` is the per-line annual-demand field only in mode `1`, but it becomes the annual-supply field in modes `2/3`. The importer matches that split by copying `line+0x04` directly into the supply-side runtime half for modes `2/3`, while the production-mode demand half is normalized to `1.0` rather than reusing the entered amount. That makes the five editor-side row entries look like generic cargo-line slots rather than five fixed named production roles. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`. | objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation |
| 295 | 0x00437b20 | 218 | simulation_run_chunked_fast_forward_burst | simulation | thiscall | inferred | objdump | 3 | Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `0x006cec74+0x178` and active-mode flag `[0x006cec78+0x4af7]`, then repeatedly advances the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path. | objdump + caller context + RT3.lng strings + phase ordering |
| 296 | 0x00434680 | 435 | world_set_game_speed_mode | simulation | thiscall | inferred | objdump + strings | 3 | Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.` | objdump + RT3.lng strings + multiplayer handoff |
| 297 | 0x00434850 | 19 | world_adjust_game_speed_mode_delta | simulation | thiscall | inferred | objdump | 3 | Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled. | objdump + callee inspection |
| 298 | 0x00437220 | 279 | world_build_chairman_profile_slot_records | map | thiscall | inferred | objdump + strings + caller xrefs | 4 | Post-load chairman-profile materialization pass reached under banner id `319` `Setting up Players and Companies...`. The helper first refreshes one local occupancy map through `0x0047bc80`, optionally waits on the multiplayer preview owner at `0x006cd8d8`, then walks the 16 selector bytes at `[0x006cec7c+0x87]` together with the per-slot staging table rooted at `[this+0x69d8]`. Current slot-field semantics are tighter now: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte that combines with the separate per-slot gate at `[this+0x0bc3+slot*9]` to surface `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field copied into the resolved profile. Zero selectors take the random unused-profile path; nonzero selectors map directly onto one persona index; and campaign mode at `[0x006cec7c+0xc5]` can override back through the scenario slot table. Each resolved profile record is pulled from the global persona collection at `0x006ceb9c`, formatted through `0x0050a16f`, and seeded from the static persona table at `0x005f2d28`, whose localized ids include `2730` `Unassigned`, the named-chairman range `2731+`, and the adjacent biography range `2495+`. Both this helper and the neighboring selector seeder treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat marker rather than a generic role byte. The helper leaves one per-slot record family live in the resolved persona objects, stores per-profile numeric tuning from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finishes by writing the selected profile id to `[this+0x25]` plus the linked owner-company id from `[profile+0x1dd]` to `[this+0x21]`. Current grounded callers are the main post-load generation pipeline at `0x004384d0` and the saved-runtime tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. | objdump + RT3.lng strings + caller xrefs + table inspection + shell editor cross-check |
| 299 | 0x004377a0 | 693 | world_seed_default_chairman_profile_slots | map | thiscall | inferred | objdump + caller xrefs + strings | 4 | Seeds the 16 scenario-side chairman selector bytes at `[0x006cec7c+0x87]` from the local chairman-slot table rooted at `[this+0x69d8]` before the later profile-record materialization pass runs. In editor-map mode the helper first compacts the 16 local 9-byte slot records so occupied slots bubble forward whenever a later slot has either the ordinary seat-enable byte `[slot+0x02]` or the special occupied-seat byte `[slot+0x03]` set and an earlier slot has neither; it then clears selectors for empty slots and assigns deterministic defaults for occupied ones, using selector `1` for the first occupied slot and selector `0x64+n` for later occupied slots. The same slot layout is now bounded more tightly by the editor window family around `0x004cc2d0`: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory flag with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field. Current grounded writes seed `[slot+0x03]` on slot zero and the compaction pass moves it only by swapping whole 9-byte records, which matches the selector policy: one distinguished first slot gets selector `1`, and the remaining occupied slots get the `0x64+n` opponent range. After the selector seeding pass it walks the selector array, resolves each chosen persona through the global collection at `0x006ceb9c`, constructs or refreshes the per-profile record through `0x00476140`, copies the numeric tuning field from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finally seeds the scenario-state summary pair from the first persona entry: `[this+0x25]` becomes the selected profile id while `[this+0x21]` becomes the linked owner-company id through `[profile+0x1dd]`. Current grounded caller is the neighboring world bring-up path around `0x00438692`, where this helper runs after the setup-side burst branch and immediately before the localized `Calculating Heights...` progress update. | objdump + caller xrefs + RT3.lng strings + slot-table inspection + shell editor cross-check |
| 300 | 0x00434870 | 23 | scenario_state_get_selected_chairman_company_record | map | thiscall | inferred | objdump + global-state inspection | 4 | Returns the currently selected company record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x21]` as a company id and resolves that id through the live company collection at `0x0062be10`; zero or negative ids return null. This is the clearest direct accessor yet for the summary field written by the post-load chairman-profile lane. | objdump + global-state inspection + caller correlation |
| 301 | 0x00434890 | 35 | scenario_state_set_selected_chairman_profile | map | thiscall | inferred | objdump + global-state inspection | 4 | Sets the currently selected chairman profile on the shell-side scenario state object at `0x006cec78`. The helper stores the incoming persona id into `[this+0x25]`, resolves that persona through the global profile collection at `0x006ceb9c`, and then copies the linked owner-company id from `[profile+0x1dd]` into `[this+0x21]`. This grounds the summary pair used by the post-load chairman-profile setup lane: `[state+0x25]` is the selected chairman profile id and `[state+0x21]` is the corresponding owning company id. | objdump + global-state inspection + caller correlation |
| 302 | 0x004348c0 | 23 | scenario_state_get_selected_chairman_profile_record | map | thiscall | inferred | objdump + global-state inspection | 4 | Returns the currently selected chairman profile record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x25]` as a profile id and resolves it through the global persona collection at `0x006ceb9c`; zero or negative ids return null. This pairs directly with scenario_state_set_selected_chairman_profile at `0x00434890`. | objdump + global-state inspection + caller correlation |
| 303 | 0x00436590 | 372 | scenario_state_compute_issue_opinion_multiplier | simulation | thiscall | inferred | objdump + caller inspection | 4 | Computes one bounded opinion multiplier for a caller-selected issue slot on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, clamps that raw value to a floor of `-99`, normalizes it into a multiplier around `1.0`, and then optionally folds in up to three issue-specific override tables: a company-side term from `[company + issue*4 + 0x35b]`, a chairman-profile term from `[profile + issue*4 + 0x2ab]`, and a territory-side term from `[territory + issue*4 + 0x3b5]`. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. The final multiplier is clamped to a small positive floor near `0.01` before return. Current grounded callers include the broader support-adjusted share-price helper at `0x00424fd0`, the merger vote resolver at `0x004ebd10` with issue id `0x3a`, and several other company-policy and shell-side opinion branches. The merger-side `0x3a` use now lines up directly with `RT3.lng` id `726`, which says public merger votes depend on their attitude toward the management of the two companies, so this issue slot is now best read as the merger-management-attitude multiplier. | objdump + caller inspection + issue-table correlation + merger-text correlation |
| 304 | 0x004768c0 | 53 | chairman_profile_owns_all_company_shares | simulation | thiscall | inferred | objdump + caller inspection | 4 | Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`. | objdump + caller inspection + ownership-predicate correlation |
| 305 | 0x00436710 | 163 | scenario_state_sum_issue_opinion_terms_raw | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar. | objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation |
| 306 | 0x00437a60 | 41 | world_toggle_pause_or_restore_game_speed | simulation | thiscall | inferred | objdump + strings | 3 | Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`. | objdump + RT3.lng strings |
| 307 | 0x00448aa0 | 28 | world_sample_companion_float_grid_value_by_cell | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny float-raster sampler over the companion world grid rooted at `[this+0x1605]`. The helper uses width field `[this+0x15d9]`, flattens the caller-supplied cell coordinates with an extra `+1` row stride, reads one `float` from that raster, and returns it in `st(0)`. Current grounded callers include `world_compute_transport_and_pricing_grid` `0x0044fb70`, the flagged-cell sample collector `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, the projected-rectangle helper `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, and several neighboring shell or presentation branches, so this is the safest current read for the shared companion float-grid sampler rather than a transport-only helper. | objdump + caller inspection + field correlation + float-raster correlation |
| 308 | 0x00448af0 | 206 | world_query_compact_grid_flag_bitset_membership_by_mode | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Boolean compact-bitset query over three neighboring world-grid flag banks. The helper uses dimensions `[this+0x215d/+0x2161]` to flatten the caller-supplied cell coordinates into one bit index, rejects out-of-bounds cells, and then checks one or more compact bitset banks depending on the caller mode argument: mode `0` checks both `[this+0x2139]` and `[this+0x213d]`, mode `1` checks `[this+0x213d]` only, mode `2` checks `[this+0x2139]` only, and mode `3` checks `[this+0x2141]` only. It returns `1` when any selected bank contains the bit and `0` otherwise. Current grounded callers include the post-load `319` cleanup lane inside `world_run_post_load_generation_pipeline` `0x004384d0`, the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the projected-runtime scratch builder `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`, several neighboring world-scan or presentation branches around `0x004512b5..0x00451393`, and later world-side routes or scenario handlers, so this is the safest current read for the shared compact grid-flag-bitset membership query rather than one specific road- or route-only gate. | objdump + caller inspection + field correlation + compact-bitset correlation + post-load-cleanup correlation |
| 309 | 0x00448c20 | 132 | world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small secondary-raster mutator over one world cell. After rejecting cells whose current secondary class already lies in subset `1/4` through `world_secondary_raster_query_cell_class_in_set_1_4` `0x00534e50`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `4` when the old class was `2`, or to `1` otherwise. It then notifies the shell-side world presentation through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and several shell-side map-editing or painting branches around `0x004f9c17` and `0x004fbcc9`, so this is the safest current read for the shared class-`1/4` demotion helper rather than a more player-facing terrain brush. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 310 | 0x00448cb0 | 132 | world_secondary_raster_reclass_cell_to_low3bit_3_or_5_and_clear_primary_companion_plane | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Sibling of world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane for the `3/5` class family. After rejecting cells already in subset `3/5` through `world_secondary_raster_query_cell_class_in_set_3_5` `0x00534f00`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `5` when the old class was `2`, or to `3` otherwise. It then emits the same shell-presentation refresh through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side world-editing branches around `0x004f9c05` and `0x004fbce4`. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 311 | 0x00448d40 | 78 | world_secondary_raster_write_primary_companion_plane_byte_and_clear_low3bit_class_tag | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Writes one caller-supplied byte into the primary companion plane at `[this+0x1655]` for the selected world cell, then clears the low 3 class bits in the parallel packed secondary record at `[this+0x165d]`. The written byte comes from `0x00532a30` in the grounded callers, and the helper finishes by notifying the shell-side world presentation through the virtual owner at `0x0062be68`. Current grounded callers are shell-side painting and editing branches around `0x004f9c0e` and `0x004fbcfa`, so this is the safest current read for the shared primary-companion-byte write helper rather than a player-facing terrain label. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 312 | 0x00448d90 | 43 | world_secondary_raster_set_cell_byte2_bit0x10 | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small write-side companion to world_secondary_raster_query_cell_byte2_bit0x10_set `0x00448f30`. The helper resolves one packed secondary cell record at `[this+0x165d]`, sets bit `0x10` in byte `2`, and then notifies the shell-side world presentation. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and one shell-side scan branch around `0x004fc45d`. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 313 | 0x00448dc0 | 43 | world_secondary_raster_clear_cell_byte2_bit0x10 | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Clear-side companion to world_secondary_raster_set_cell_byte2_bit0x10. The helper resolves one packed secondary cell record at `[this+0x165d]`, clears bit `0x10` in byte `2`, and then notifies the shell-side world presentation. Current grounded caller is the shell-side scan branch around `0x004fc464`. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 314 | 0x00448df0 | 33 | world_secondary_raster_query_cell_byte2_low_nibble | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny nibble query over byte `2` of the packed secondary cell record rooted at `[this+0x165d]`. The helper flattens the caller-supplied coordinates, reads byte `2`, masks to the low nibble, and returns that `0..15` value. Current grounded callers are shell-side editing branches around `0x004faab3`, `0x004fabff`, `0x004faf9c`, `0x004fb007`, `0x004fb021`, and `0x004fca0e`, where the nibble is compared against small brush-state counts before the sibling write helper runs. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 315 | 0x00448e20 | 47 | world_secondary_raster_xor_cell_byte2_low_nibble_mask | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small low-nibble update helper over byte `2` of the packed secondary cell record rooted at `[this+0x165d]`. The helper XORs the caller-supplied low-nibble mask with the current low nibble and writes the merged result back without disturbing the upper nibble. Current grounded callers are shell-side editing branches around `0x004faba7` and `0x004fac18`. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 316 | 0x00448e60 | 30 | world_secondary_overlay_vector_x_byte_plane_set_cell_value | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small write helper for the signed X-component byte plane rooted at `[this+0x1661]`. It flattens one world-cell coordinate through width `[this+0x15dd]` and stores the caller byte directly. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side editing branches around `0x004faa59`. Later world-side rebuild logic in `0x00536710` treats this plane together with `[this+0x1665]` as a 2D signed vector field rather than a generic scratch buffer. | objdump + caller inspection + field correlation + vector-plane correlation |
| 317 | 0x00448e90 | 30 | world_secondary_overlay_vector_y_byte_plane_set_cell_value | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Write-side sibling of world_secondary_overlay_vector_x_byte_plane_set_cell_value over the signed Y-component byte plane rooted at `[this+0x1665]`. The helper flattens one world-cell coordinate through width `[this+0x15dd]` and stores the caller byte directly. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side editing branches around `0x004faa6e`, while the later rebuild pass `0x00536710` consumes this plane together with `[this+0x1661]` as a paired local vector field. | objdump + caller inspection + field correlation + vector-plane correlation |
| 318 | 0x00448ec0 | 27 | world_secondary_overlay_vector_x_byte_plane_query_cell_value | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny signed-byte accessor for the X-component overlay vector plane rooted at `[this+0x1661]`. Current grounded callers include neighboring world-side presentation or setup branches around `0x00446458` and shell-side editing branches around `0x004fa9cc`, so this is the safest current read for the X-component vector-plane cell query. | objdump + caller inspection + field correlation + vector-plane correlation |
| 319 | 0x00448ee0 | 27 | world_secondary_overlay_vector_y_byte_plane_query_cell_value | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny signed-byte accessor for the Y-component overlay vector plane rooted at `[this+0x1665]`. Current grounded callers include neighboring world-side presentation or setup branches around `0x00446478` and shell-side editing branches around `0x004fa9e0`, so this is the safest current read for the Y-component vector-plane cell query rather than a generic companion-byte accessor. | objdump + caller inspection + field correlation + vector-plane correlation |
| 320 | 0x00448f00 | 40 | world_secondary_raster_query_cell_low3bit_tag_nonzero | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny predicate over the secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, reads the first byte of the 3-byte cell record, masks its low 3 bits, and returns `1` when that low-bit tag is nonzero and `0` otherwise. Current grounded callers consistently treat the zero case as the countable or eligible path: the region-border overlay count rebuild `0x004881b0`, the map-editor stats reports at `0x004d0472` and `0x004d1bd3`, and several neighboring world-side scans or scoring branches around `0x00403550`, `0x00450ffc`, and `0x00454599`. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 321 | 0x00448f30 | 42 | world_secondary_raster_query_cell_byte2_bit0x10_set | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small companion predicate over the same secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, reads byte `2` of the 3-byte cell record, and returns `1` when bit `0x10` is set and `0` otherwise. Current grounded callers include neighboring world-side setup or presentation branches around `0x00446498` and `0x00451090`, plus one shell-side scan at `0x004fc43c`, so this is the safest current read for the shared secondary-raster bit-`0x10` predicate rather than a more player-facing terrain label. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 322 | 0x004490f0 | 18 | world_query_sidecar_plane_cell_count | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny size helper for the sidecar byte-plane family hanging off the live world object. It returns `([this+0x15d9]+1)*([this+0x15d5]+1)`, which is the per-plane cell count used by the four-plane sidecar raster copies. Current grounded callers include the shell-side plane-copy branches around `0x004f5ad6..0x004f5cc7`, so this is the safest current read for the shared sidecar-plane cell-count query rather than a generic world-size helper. | objdump + caller inspection + field correlation + sidecar-plane correlation |
| 323 | 0x00448f60 | 114 | world_load_four_sidecar_byte_planes_from_runtime_bundle | map | thiscall | inferred | objdump + caller inspection + bundle-tag correlation | 4 | Loads four sidecar byte-plane buffers tied to the live world raster from one runtime bundle owner. The helper opens chunk family `0x9471..0x9472` through `0x00531360`, computes one plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four destination plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and fills those four buffers through repeated `0x00531150` reads before closing the chunk family. Current grounded callers are the `.smp` restore path inside world_load_saved_runtime_state_bundle `0x00446d40` and the neighboring world-side bundle-load branch at `0x0044d350`, so this is the safest current read for the shared four-plane runtime-bundle load helper rather than a generic deserializer. | objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation |
| 324 | 0x00448fe0 | 108 | world_serialize_four_sidecar_byte_planes_into_runtime_bundle | map | thiscall | inferred | objdump + caller inspection + bundle-tag correlation | 4 | Save-side sibling of world_load_four_sidecar_byte_planes_from_runtime_bundle. The helper opens chunk family `0x9471..0x9472` for output through `0x00531340`, computes the same one-plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four source plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and writes those four buffers through repeated `0x00531030` calls before closing the chunk family. Current grounded callers are the `.smp` serializer inside world_runtime_serialize_smp_bundle `0x00446240` and the neighboring world-side bundle-save branch at `0x00449714`, so this is the safest current read for the shared four-plane runtime-bundle serializer rather than a generic writer. | objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation |
| 325 | 0x00444dc5 | 11 | world_query_global_stage_counter_reached_late_reactivation_threshold | map | cdecl | inferred | objdump + caller inspection + threshold correlation | 3 | Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]`. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_databases` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper. | objdump + caller inspection + threshold correlation + global-stage-counter correlation |
| 326 | 0x0044c670 | 2544 | world_service_secondary_grid_marked_cell_overlay_cache | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Recurring world-side service pass over the secondary raster rooted at `[this+0x2135]` after `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` has cached min/max/count bounds into `[this+0x21c6..+0x21d6]`. The helper first requires shell-state gate `[0x006cec78+0x4af3]`, then consumes the cached bounds to normalize the marked-cell band and rewrite per-cell bits in the same secondary raster. Its later overlay side is tighter now too: after resolving scaled surface dimensions through `shell_world_presentation_query_scaled_surface_dimensions` `0x00534c50`, it walks one local 3-by-32 sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only secondary-raster classes `4..0x0d`, folds several interpolated samples through repeated `0x0051db80` evaluation into one strongest local score, writes packed overlay pixels into the staged surface buffer, and only then publishes that staged overlay through `shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer` `0x00534af0`. The lower helper cluster beneath that owner is now explicit too: `0x00533e70` clears coarse overlay chunks in a rectangle, `0x00534160` ensures one coarse chunk and seeds local marks, and `0x00534e90` is the neighboring marked-bit predicate over the same 3-byte raster family. Current grounded callers are the recurring simulation-maintenance route-style branch at `0x0040a9f4` inside `simulation_service_periodic_boundary_work` `0x0040a590` and one startup-side world branch at `0x00448168`, so this is the safest current read for the shared secondary-grid marked-cell overlay-cache service rather than a one-shot startup helper or a fully player-facing panel renderer. | objdump + local disassembly + caller inspection + secondary-raster correlation + recurring-maintenance correlation + staged-overlay publish correlation |
| 327 | 0x00443a50 | 4979 | world_entry_transition_and_runtime_bringup | map | cdecl | inferred | objdump + analysis-context | 4 | First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The later `319` tail is tighter now too: before the final world and shell reactivation it runs one post-bundle status-and-runtime-refresh phase that posts shell progress ids `0x196` and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the scenario-side port-or-warehouse cargo recipe runtime tables through `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, runs the named-candidate availability preseed through `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, and then enters one later staged-profile or availability rehydrate band before the broader reactivation sweep. That rehydrate band posts progress ids `0x32dc/0x3714/0x3715`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, and then rehydrates the named locomotive-availability collection at `[world+0x66b6]` before the later world-wide service passes continue. That later reactivation tail is narrower now too: it includes `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, then `world_rebuild_all_grid_cell_candidate_cargo_service_bitsets` `0x0044c450`, then `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, then the recurring secondary-raster overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, before the later route-style rebuild, shell-window, and briefing branches. Only after that later tail does it re-enter the one-shot world-entry runtime-effect service through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `8`, after which shell-profile latch `[0x006cec7c+0x97]` is cleared. This is therefore the current safest read for the full shell-to-gameplay world-entry transition and runtime bringup owner rather than only the front half of file staging and world allocation. | objdump + analysis-context + caller xrefs + strings + post-load-pipeline correlation + late-tail phase-order correlation + staged-profile-rehydrate correlation |
| 328 | 0x00442400 | 930 | shell_setup_load_selected_profile_bundle_into_payload_record | shell | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads the smaller startup payload and preview-surface chunks rooted at ids `0x0001` and `0x03c2`, while the map-style side reads the larger setup payload chunks rooted at ids `0x0004`, `0x2ee0`, and `0x2ee1`, with the exact chunk mix gated by the parsed bundle-header word in the local scratch. Current grounded caller is `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`. | objdump + local disassembly + caller inspection + chunk-family correlation |
| 329 | 0x004425d0 | 139 | shell_setup_validate_selected_profile_bundle_and_stage_launch_profile | shell | cdecl | inferred | objdump + local disassembly + caller inspection | 3 | Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs. | objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation |
| 330 | 0x0044c450 | 96 | world_rebuild_all_grid_cell_candidate_cargo_service_bitsets | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Late world-reactivation sweep inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The helper walks the full live world grid rooted at `[this+0x2129]` through dimensions `[this+0x2145/+0x2149]`, resolves each cell pointer, and re-enters `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` on every cell record. Current grounded caller is the later world-entry tail at `0x444b24`, immediately after `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0` and before the route-style link rebuild at `0x468300`, so this is the current safest read for the world-wide grid-cell cargo-service-bitset refresh wrapper rather than another generic world-grid loop. | objdump + local disassembly + caller inspection + world-grid correlation + cargo-service correlation |
| 331 | 0x0044c4b0 | 192 | world_clear_and_reseed_region_center_world_grid_flag_bit | map | cdecl | inferred | objdump + local disassembly + caller inspection | 3 | Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub. | objdump + local disassembly + caller inspection + region-grid correlation |
| 332 | 0x0044ce60 | 272 | world_scan_secondary_grid_marked_cell_bounds | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Secondary world-raster bounds scan beneath the later world-entry reactivation tail. The helper clears cached fields `[this+0x21c6/+0x21ca/+0x21ce/+0x21d2/+0x21d6]`, requires the shell-state gate `[0x006cec78+0x4af3]` to be nonzero, and then scans the byte raster rooted at `[this+0x2135]` through dimensions `[this+0x2155/+0x2159]`. Every cell whose byte has any bits in mask `0x3e` contributes to the cached min-X, min-Y, max-X, max-Y, and marked-cell-count slots at those same `0x21c6..0x21d6` fields. Current grounded callers are the later world-entry tail at `0x444c36`, one neighboring startup-side world branch at `0x448168`, and the small count accessor at `0x42f8d8`, so this is the safest current read for the shared marked-cell bounding-box scan over the secondary world raster rather than a fully player-facing overlay owner. | objdump + local disassembly + caller inspection + secondary-raster correlation |
| 333 | 0x00444dd0 | 3301 | map_bundle_open_reference_databases | map | cdecl | inferred | ghidra-headless | 3 | Opens and registers a broad reference-database bundle for the active map path. The routine formats %1\\%2 paths allocates bundle state through 0x00530c80 and wires many global datasets including gpdLabelDB gpdCityDB and related city geographic and map reference tables before later shell and map loaders continue. | ghidra + rizin + llvm-objdump + strings |
| 334 | 0x00445ac0 | 790 | shell_map_file_entry_coordinator | map | cdecl | inferred | objdump + analysis-context | 4 | Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. It accepts either an incoming filename seed or a generated Quicksave base name and then chooses between the heavier world-entry branch at 0x00443a50 and the sibling saved-runtime restore branch at 0x00446d40. Bit 0x1 in its flag argument now grounds the Quicksave path from the shared string table at 0x005ca9cc. The non-Quicksave interactive path is tighter now too: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using load mode 4=.gmp when EditorPanel.win is live and the paired non-editor open modes 8=.gms 9=.gmc and 10=.gmx. The shell-state master flag `[0x006cec74+0x68]` now reinforces that same mapping on the direct Quicksave branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence now makes the non-editor trio much less anonymous: `.gmx` aligns with sandbox mode because the sibling shell branch at 0x004dc923 gates on 0x006cec7c+0x82 and surfaces string 3898 `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because 0x004dc9cd gates on 0x006cec7c+0xc5 and surfaces string 3018 about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family. When a live runtime world is already active the helper appends .smp instead of the non-runtime extensions before the restore branch continues. | objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection |
| 335 | 0x00445de0 | 1115 | shell_map_file_world_bundle_coordinator | map | cdecl | inferred | objdump + analysis-context | 4 | Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. It accepts either an incoming filename seed a generated Quicksave base name from flag bit 0x1 or the localized `Autosave` seed from flag bit 0x2 string id 387. Its non-Quicksave interactive path is now tighter: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using save mode 3=.gmp for the editor-map package path 0=.gms for standalone scenarios 1=.gmc for campaign-scenario saves and 2=.gmx for sandbox saves plus one auxiliary 11=.gmt branch reached only through the separate 0x00434050 check on the side owner at 0x006cd8d8. The shell-state master flag `[0x006cec74+0x68]` now reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. That `.gmt` path no longer looks like another scenario family: when the auxiliary owner is present the coordinator packages the chosen path into the owner-local request block near 0x006cd8d8+0x8f48 and submits it through 0x00469d30; only when that owner is absent does it fall back to map_bundle_open_reference_databases at 0x00444dd0. The campaign mapping is now backed by the numbered `%s%02d.gmc` helper at 0x00517c70 which formats one campaign-progress slot from 0x006cec7c+0xc4 before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string 3898 on 0x006cec7c+0x82. When a live runtime world is active the mainline branch still appends .smp and invokes world_runtime_serialize_smp_bundle at 0x00446240. This makes the helper the save-side sibling of shell_map_file_entry_coordinator rather than another restore dispatcher, with `.gmt` now bounded as an auxiliary preview-surface side path instead of a fourth gameplay save family. | objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct save branch inspection |
| 336 | 0x00455f60 | 96 | world_region_resolve_center_world_grid_cell | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Small region-to-grid resolver that converts one region's cached center coordinate pair into a pointer into the live world-grid cell table rooted at `[0x0062c120+0x2129]`. It reads the cached floats at `[this+0x1ea]` and `[this+0x1e2]`, scales and rounds them through `0x005a10d0`, multiplies the Y-like term by world width `[0x0062c120+0x2145]`, adds the X-like term, and returns the corresponding grid-cell pointer. Current grounded callers include the world-entry region-center flag reseed pass `0x0044c4b0` and several older site- or route-style world-grid query helpers, so this is now the safest current read for the shared region-center world-grid-cell resolver. | objdump + local disassembly + caller inspection + world-grid correlation |
| 337 | 0x00446240 | 2807 | world_runtime_serialize_smp_bundle | map | cdecl | inferred | objdump + analysis-context | 3 | Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it allocates a bundle through 0x00530c80 seeds many typed records through repeated 0x00531030 and 0x00531340 calls walks world collections under 0x0062c120 and 0x006ada80 and emits runtime-state payloads through helpers such as 0x00534e50 0x00534ec0 0x00534f00 and 0x00534f40; the raster side is tighter now too, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters world_serialize_four_sidecar_byte_planes_into_runtime_bundle `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before finalizing through 0x00530a00. Current grounded caller is 0x00445de0 on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path. | objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation |
| 338 | 0x00446d40 | 5401 | world_load_saved_runtime_state_bundle | map | cdecl | inferred | objdump + analysis-context | 4 | Loads one saved runtime world-state bundle from the `.smp` branch selected by shell_map_file_entry_coordinator. The helper dismisses the shell detail controller releases the prior world runtime drives shell mode and status transitions builds a bundle through 0x00530c80 and repeated 0x00531150 reads allocates a new world root at 0x0062c120 through 0x0044cf70 and then fills that root through repeated grid and object writes, including the secondary-raster class mutators world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane `0x00448c20` and world_secondary_raster_reclass_cell_to_low3bit_3_or_5_and_clear_primary_companion_plane `0x00448cb0`, the byte2-flag and companion-byte writers `0x00448d90`, `0x00448e60`, and `0x00448e90`, and the broader restore-side world-cell helper `0x0044de30`; the raster side is tighter now too, because the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, and then, for versioned bundles at `>= 0x3ec`, re-enters world_load_four_sidecar_byte_planes_from_runtime_bundle `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into the world-owned pointer band `[world+0x1631 + index*4]`. This is the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow. | objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation |
| 339 | 0x0044fb70 | 1117 | world_compute_transport_and_pricing_grid | map | cdecl | inferred | objdump + strings + callsite inspection | 3 | Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop. | objdump + caller context + RT3.lng strings |
| 340 | 0x00487540 | 221 | world_region_border_overlay_reset_companion_record | map | thiscall | inferred | objdump + caller xrefs + field-reset inspection | 4 | Shared companion-record initializer under the region-border overlay family rooted at `0x006cfc9c`. The helper zeroes the live region id and accumulated contribution fields, seeds the enable and remap dwords at `[this+0x31]` and `[this+0x35]` to `1`, seeds the budget-like dword `[this+0x39]` to `0x186a0`, clears the paired float or score bands at `[this+0x45/+0x49/+0x4d/+0x51]` and `[this+0x1fd/+0x201/+0x205/+0x209]`, zeros the later summary slots at `[this+0xd51..+0xd69]`, resets `[this+0xd4d]` to `1`, and clears the two large tail arrays rooted at `[this+0x3b5]` and `[this+0xd6d]`. Current grounded callers are the plain wrapper `0x00487620` and the id-setting wrapper `0x00487650`, both used under world_region_border_overlay_rebuild. | objdump + caller xrefs + field-reset inspection |
| 341 | 0x00487650 | 16 | world_region_border_overlay_reset_companion_record_and_assign_region_id | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Thin wrapper around world_region_border_overlay_reset_companion_record. After resetting the full companion record, the helper stores the caller-supplied live region id into `[this+0x00]` and returns. Current grounded callers are the region-border overlay setup loops at `0x00487d77` and `0x0048836e`. | objdump + caller xrefs + wrapper inspection |
| 342 | 0x004881b0 | 272 | world_region_border_overlay_refresh_raw_region_cell_counts_from_world_grid | map | thiscall | inferred | objdump + caller xrefs + raster-count inspection | 4 | Shared region-raster counting pass over the companion region set `0x006cfc9c`. The helper zeroes one `0x3e8`-entry local count table, sweeps the active world raster at `[0x0062c120+0x2131]` across `[world+0x2155/+0x2159]`, keeps only cells whose secondary-raster low-3-bit tag predicate `world_secondary_raster_query_cell_low3bit_tag_nonzero` `0x00448f00` returns `0`, and bins each surviving cell by the compact region id `cell_byte >> 3`. It then walks the companion region records, stores the corresponding raw cell count into `[entry+0x3d]`, and clears `[entry+0x41]` before later owners fold or reuse those totals. Current grounded callers are the region-border overlay rebuild at `0x004882e0`, the world-build paths around `0x004431ea`, `0x004476ad`, `0x0044f657`, and `0x0044fb43`, plus one shell-side caller at `0x004fcc05`. | objdump + caller xrefs + raster-count inspection + caller correlation + secondary-raster predicate correlation |
| 343 | 0x00487de0 | 752 | world_region_border_overlay_emit_segment_geometry_from_region_grid | map | cdecl | inferred | objdump + caller xrefs + grid-neighbor inspection | 4 | Heavy inner geometry pass under world_region_border_overlay_rebuild. The helper first clears or prepares the current overlay surface through `0x00533cf0` on the active world presentation rooted at `0x0062c120`, then walks the companion region-set family at `0x006cfc9c`, counting entries whose enable byte `[entry+0x31]` is nonzero or whose accumulated contribution pair `[entry+0x3d]+[entry+0x41]` stays positive. It seeds a local remap table from either the live region id `[entry+0x00]` or the fallback remap id `[entry+0x35]`, scans the world raster at `[world+0x2131]` across `[world+0x2155/+0x2159]` in two axis directions, compares neighboring mapped ids, and emits border-segment geometry through `0x00536ea0` whenever adjacent cells belong to different mapped regions. Current grounded caller is `0x004882c6` under world_region_border_overlay_rebuild. | objdump + caller xrefs + grid-neighbor inspection + geometry-emitter inspection |
| 344 | 0x004882e0 | 199 | world_region_border_overlay_rebuild | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Rebuilds the border-overlay companion for the numbered region set owned by `0x0062bae0`. After pumping shell progress through `0x004834e0` the helper seeds or refreshes the companion record family at `0x006cfc9c`, using world_region_border_overlay_reset_companion_record_and_assign_region_id `0x00487650` to reset each resolved record before folding active contribution counts back into `[entry+0x3d]+[entry+0x41]`. It then refreshes the raw per-region cell-count band through world_region_border_overlay_refresh_raw_region_cell_counts_from_world_grid `0x004881b0`, and only after that hands the actual world-grid border-segment emission to `world_region_border_overlay_emit_segment_geometry_from_region_grid` `0x00487de0`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x00447560`, which makes this look like a region-border overlay rebuild rather than another generic player or company manager pass. | objdump + caller xrefs + RT3.lng strings + grid-neighbor inspection |
| 345 | 0x00533cf0 | 180 | world_region_border_overlay_clear_all_chunk_segment_queues | map | thiscall | inferred | objdump + caller xrefs + queue teardown inspection | 4 | One-owner teardown helper under world_region_border_overlay_emit_segment_geometry_from_region_grid. The helper walks every coarse chunk bucket in the world-presentation table `[this+0x167d]`, and for each bucket with queued nodes it repeatedly pops the queued payload pointers through `0x00556ef0/0x00556f00`, frees those segment records through `0x005a1145`, and then resets the bucket through `0x005570b0`. Current grounded caller is `0x00487df8`, which uses it to clear the prior border-overlay segment queues before rebuilding them from the live region grid. | objdump + caller xrefs + queue teardown inspection |
| 346 | 0x00536ea0 | 96 | world_region_border_overlay_allocate_and_queue_segment_record | map | thiscall | inferred | objdump + caller xrefs + intrusive-queue inspection | 4 | One-owner record allocator under world_region_border_overlay_emit_segment_geometry_from_region_grid. The helper allocates one `0x31`-byte segment record through `0x005a125d`, copies the caller-supplied endpoint and orientation fields into that record, optionally expands cached float coordinates through repeated `0x00534490` calls when the final byte flag is nonzero, resolves one coarse bucket in `[this+0x167d]` from the segment midpoint, and appends the finished record to that bucket through `intrusive_queue_push_back` `0x00556e10`. Current grounded caller is `0x00488072` inside the border-overlay geometry emitter. | objdump + caller xrefs + intrusive-queue inspection + segment midpoint bucketing |
| 347 | 0x005331e0 | 592 | world_rebuild_overlay_sample_triplet_cell_for_scale | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Scale-specific local reducer under the secondary-overlay multiscale support family. Given one selected cell plus one scale index, the helper clamps a local neighborhood to the live world bounds, walks the per-scale float surface rooted at `[this+0x15ed + scale*4]`, accumulates three float channels across that neighborhood, normalizes by sample count, rescales the local vector magnitude against shared constants, and writes one packed three-float sample record into the matching per-scale triplet buffer family rooted at `[this+0x15f1 + (scale-1)*4]`. Current grounded callers are `0x00533845` and `0x00533929`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`. | objdump + caller inspection + field correlation + multiscale-support correlation |
| 348 | 0x00532590 | 455 | world_presentation_reset_overlay_runtime_state_and_pointer_roots | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Broad hard-reset owner beneath the world-presentation overlay family. The helper clears the live overlay-state bytes `[this+0x1588/+0x1599/+0x159b/+0x15b4]`, reseeds `[this+0x159a]` to `1`, resets scalar fields like `[this+0x154c/+0x155c/+0x15d9/+0x15d5]`, nulls the main pointer roots `[this+0x478]`, `[this+0x1558..+0x1570]`, `[this+0x159c/+0x15a0]`, `[this+0x15e1]`, the support-family roots `[this+0x1605/+0x15f1/+0x1619/+0x162d]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, both mask planes `[this+0x1655/+0x1659]`, the packed raster `[this+0x165d]`, the vector byte planes `[this+0x1661/+0x1665]`, and the neighboring overlay tables `[this+0x1669..+0x1685]`, then zero-fills the local `0x100` slot band at `[this+0x08]` and the `0x1b`-entry companion slot table at `[this+0x40c]`. Current grounded callers are the local constructor at `0x00534f73` and the broader presentation reinitializer `0x00537e70`, so this is the safest current read for the shared overlay-family hard reset rather than a narrow resize helper. | objdump + caller inspection + field correlation + overlay-reset correlation |
| 349 | 0x00532d90 | 464 | world_normalize_secondary_overlay_float_summary_plane_globally | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Global normalization pass over the base secondary-overlay float summary plane rooted at `[this+0x1605]`. The helper first scans the full live plane across `[this+0x15d9/+0x15d5]` to find one global maximum, clamps that maximum into a stable range, synthesizes a `0..100` weight table from the resulting scale factor, and then reruns the full plane to remap every positive cell through that table. Current grounded caller is `0x005385ea` inside the larger secondary-overlay rebuild owner around `0x00538360`, immediately before the companion radius-expansion pass `0x00532f60`. | objdump + caller inspection + field correlation + global-normalization correlation |
| 350 | 0x00532f60 | 403 | world_expand_positive_secondary_overlay_float_summary_by_radius | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Radius-style expansion pass over the same base secondary-overlay float summary plane rooted at `[this+0x1605]`. Given one caller radius, the helper walks the full live plane, keeps only positive source cells, samples their local neighborhood with distance falloff, and writes back the strongest surviving propagated value into the same float plane. Current grounded caller is `0x005385fd` inside the larger secondary-overlay rebuild owner around `0x00538360`, immediately after `world_normalize_secondary_overlay_float_summary_plane_globally` `0x00532d90`. | objdump + caller inspection + field correlation + radius-expansion correlation |
| 351 | 0x00532ad0 | 81 | world_presentation_allocate_overlay_slot_from_static_template | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small shared slot allocator over the local `0x100` overlay pointer band at `[this+0x08]`. The helper finds the first empty slot, forwards the caller-supplied static template row into `0x0053c1c0` together with the fixed tuple `(0, 0, 0x7f)`, stores the resulting object pointer into `[this+0x08 + slot*4]`, and increments live count `[this+0x04]`. Current grounded callers are the neighboring setup owners `0x00535070`, `0x005356e0`, and `0x00535890`, the broader reinitializer `0x00537e60`, and one earlier world-presentation branch at `0x00454f40`, so this is the safest current read for the shared static-template overlay-slot allocator rather than one narrow UI control helper. | objdump + caller inspection + field correlation + static-template correlation |
| 352 | 0x00532c80 | 529 | world_allocate_base_secondary_overlay_planes_for_current_dimensions | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Lower secondary-overlay allocator or reset owner for the current world-grid dimensions. The helper clears shift field `[this+0x15e1]`, optionally overwrites live grid dimensions `[this+0x15d9/+0x15d5/+0x15dd]` from caller width and height, allocates the base float-summary plane `[this+0x1605]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, the two one-byte mask planes `[this+0x1655]` and `[this+0x1659]`, and the packed secondary 3-byte raster `[this+0x165d]`, then seeds those planes with their default byte patterns: `0x02` for the primary mask plane, `0x01` for the secondary mask plane, and zero for the packed raster. Current grounded callers are the broader presentation reinitializer `0x00537e60` and the shell-side size-reset path around `0x00537f1a`, so this is the safest current read for the base secondary-overlay plane allocator rather than the wider multiscale support owner. | objdump + caller inspection + field correlation + mask-plane default correlation |
| 353 | 0x00533430 | 368 | world_rebuild_overlay_float_plane_cell_for_scale | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Scale-specific float-plane sibling under the secondary-overlay multiscale support family. The helper clamps one local neighborhood around the selected cell, reads the contributing float samples from the per-scale plane rooted at `[this+0x1601 + (scale-1)*4]`, averages that neighborhood, and stores the resulting float into the companion per-scale summary plane family rooted at `[this+0x1605 + (scale-1)*4]` for the same cell. Current grounded callers are `0x0053384f` and `0x00533933`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`. | objdump + caller inspection + field correlation + multiscale-support correlation |
| 354 | 0x005335a0 | 320 | world_rebuild_overlay_rank_u16_plane_cell_for_scale | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Scale-specific 16-bit smoothing sibling under the same multiscale support family. The helper reads one per-scale unsigned-word plane from the family rooted at `[this+0x1615 + (scale-1)*4]`, gathers the clamped eight-neighbor ring around the selected cell, averages those values, and stores the resulting word into the companion smoothed-plane family rooted at `[this+0x1619 + (scale-1)*4]`. Current grounded callers are `0x00533859` and `0x0053393d`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`. | objdump + caller inspection + field correlation + multiscale-support correlation |
| 355 | 0x00533890 | 224 | world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Rectangle-wide multiscale support-surface rebuild above the raw secondary-overlay byte planes. The helper clamps the caller rectangle to the live world bounds, then for scale levels `1..4` downshifts that rectangle and re-enters three scale-specific reducers: `world_rebuild_overlay_sample_triplet_cell_for_scale` `0x005331e0` refreshes the five-entry packed sample-triplet buffer family rooted at `[this+0x15f1..+0x1601]`, `world_rebuild_overlay_float_plane_cell_for_scale` `0x00533430` refreshes the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, and `world_rebuild_overlay_rank_u16_plane_cell_for_scale` `0x005335a0` refreshes the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`. Current grounded caller is `0x005375b2` inside the larger rect owner `0x005374d0`, and the same helper also has one tiny local wrapper at `0x00533845..0x00533859`, so this is the safest current read for the shared multiscale secondary-overlay support rebuild rather than another raw cell accessor. | objdump + caller inspection + field correlation + multiscale-support correlation |
| 356 | 0x00533970 | 7 | world_query_world_grid_max_x_cell_index | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny dimension getter over the live world-grid family. The helper returns the cached maximum X cell index from `[this+0x15d9]` directly. Current grounded callers are shell-side presentation and staging branches around `0x0043b0ea`, `0x0044d893`, `0x00523edd`, `0x00524e9b`, `0x00525b4c`, `0x005266ae`, and `0x0056935e`, which consistently pair it with `world_query_world_grid_max_y_cell_index` `0x00533980` rather than treating it as a more player-facing world metric. | objdump + caller inspection + field correlation |
| 357 | 0x00533980 | 7 | world_query_world_grid_max_y_cell_index | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Y-axis sibling of world_query_world_grid_max_x_cell_index. The helper returns the cached maximum Y cell index from `[this+0x15d5]` directly. Current grounded callers are the same shell-side presentation and staging branches that pair it with `0x00533970`, including `0x0043b101`, `0x0044d8af`, `0x00523eeb`, `0x00524ea6`, `0x00525b57`, `0x005273e9`, and `0x00569368`. | objdump + caller inspection + field correlation |
| 358 | 0x00533ae0 | 7 | world_query_secondary_raster_root | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny root-pointer getter for the packed secondary 3-byte cell raster at `[this+0x165d]`. Current grounded callers include shell-side staging branches around `0x00524eb1` and `0x00569351`, while the same root is also consumed directly by the neighboring secondary-raster read/write helpers `0x00448eec..0x00448f57` and several world-side scans, so this is the safest current read for the raw secondary-raster base accessor. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 359 | 0x00533af0 | 7 | world_query_secondary_overlay_vector_x_byte_plane_root | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny root-pointer getter for the signed X-component overlay vector byte plane at `[this+0x1661]`. Current grounded callers are the shell-side staging path around `0x0056933d`, while neighboring byte read/write helpers at `0x00448e60` and `0x00448ec0` plus the rectangle rebuild pass `0x00536710` use the same root directly. | objdump + caller inspection + field correlation + vector-plane correlation |
| 360 | 0x00533b00 | 7 | world_query_secondary_overlay_vector_y_byte_plane_root | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny root-pointer getter for the signed Y-component overlay vector byte plane at `[this+0x1665]`. Current grounded callers are the shell-side staging path around `0x00569347`, and the same root is consumed directly by `world_secondary_overlay_vector_y_byte_plane_query_cell_value` `0x00448ee0`, `world_secondary_overlay_vector_y_byte_plane_set_cell_value` `0x00448e90`, and the rectangle rebuild pass `0x00536710`. | objdump + caller inspection + field correlation + vector-plane correlation |
| 361 | 0x00533b10 | 7 | world_query_companion_float_raster_root | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny root-pointer getter for the companion float raster family rooted at `[this+0x1605]`. Current grounded callers are shell-side presentation and staging branches around `0x00524e87`, `0x0052525b89`, `0x00526bb4`, `0x00528253`, `0x0052ae97`, `0x0052b4fa`, `0x0054dd60`, and `0x0056b2dd`, which consistently pair it with neighboring LUT or dimension getters rather than treating it as a gameplay scalar owner. | objdump + caller inspection + field correlation |
| 362 | 0x00533b20 | 7 | world_query_overlay_normalized_x_coordinate_lut_ptr | map | thiscall | inferred | objdump + caller inspection + allocation-path inspection | 3 | Tiny root-pointer getter for the X-axis normalized coordinate lookup table at `[this+0x15e9]`. The table is allocated in the world-presentation setup path around `0x00537b48` and then filled from the current grid width quarter-count in `0x00537c45..0x00537c5c`. Current grounded caller is the shell-side overlay staging branch at `0x00525b65`, which consumes it together with the Y-axis sibling and the companion sample tables. | objdump + caller inspection + allocation-path inspection + field correlation |
| 363 | 0x00533b30 | 7 | world_query_overlay_normalized_y_coordinate_lut_ptr | map | thiscall | inferred | objdump + caller inspection + allocation-path inspection | 3 | Y-axis sibling of world_query_overlay_normalized_x_coordinate_lut_ptr. The helper returns the normalized coordinate lookup table pointer from `[this+0x15ed]`. The table is allocated in the same setup path around `0x00537b28` and filled from the current grid height quarter-count in `0x00537c82..0x00537c99`. Current grounded caller is the same shell-side overlay staging branch at `0x00525b70`. | objdump + caller inspection + allocation-path inspection + field correlation |
| 364 | 0x00533b40 | 13 | world_query_sidecar_byte_plane_ptr_by_index | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Tiny indexed accessor over the four-plane sidecar byte-raster family rooted at `[this+0x1631]`. The helper treats the caller byte argument as an index `0..3` and returns the corresponding plane pointer from `[this+0x1631 + index*4]`. Current grounded callers include the four-plane bundle load/save siblings `0x00448f60` and `0x00448fe0`, plus shell-side plane-copy branches around `0x004f5ae6`, `0x004f5bfb`, `0x004f5cc7`, and `0x0052b0a4`, so this is the safest current read for the shared sidecar byte-plane pointer accessor rather than a more player-facing raster helper. | objdump + caller inspection + field correlation + sidecar-plane correlation |
| 365 | 0x00533b50 | 7 | world_query_secondary_overlay_primary_mask_byte_plane_root | map | thiscall | inferred | objdump + caller inspection + allocation-path inspection | 3 | Tiny root-pointer getter for the primary mask or occupancy byte plane at `[this+0x1655]`. The plane is allocated in the world-presentation setup path around `0x0053775e` and initialized to byte value `0x02`. Current grounded callers are the shell-side overlay staging branch at `0x00525b9f`, several world-side mutators around `0x00448c38`, `0x00448cc8`, and `0x00448d53`, the later vector-field rebuild path `0x00536710`, and the neighboring world-side scan around `0x005383f0`, which all treat nonzero cells in this plane as blocking, occupied, or already-classified samples. | objdump + caller inspection + allocation-path inspection + field correlation + mask-plane correlation |
| 366 | 0x00533b60 | 7 | world_query_secondary_overlay_secondary_mask_byte_plane_root | map | thiscall | inferred | objdump + caller inspection + allocation-path inspection | 3 | Tiny root-pointer getter for the second one-byte overlay mask plane at `[this+0x1659]`. The plane is allocated in the same setup path around `0x00537799` and initialized to byte value `0x01`. The only grounded getter caller is the shell-side overlay staging branch at `0x00525bad`, and that branch immediately discards the returned pointer before calling `0x005458a0`. Beyond that, current local evidence only grounds allocation, default-seed, bulk copy, bundle save-load, zero-fill, rectangle-clear, teardown, and existence-gate behavior on this plane, not a distinct semantic reader comparable to the primary mask plane at `[this+0x1655]`. Taken together with the asymmetry in `0x00538360`, the safest current read is that this is the separately persisted secondary mask-plane base accessor, not a second actively rebuilt runtime mask root. | objdump + caller inspection + allocation-path inspection + field correlation + negative-consumer correlation + persisted-sibling-plane correlation |
| 367 | 0x00536710 | 1660 | world_rebuild_secondary_overlay_vector_byte_planes_in_rect | map | thiscall | inferred | objdump + caller inspection + field correlation | 4 | Rectangle-wide rebuild pass over the secondary overlay byte-plane family. The helper clamps the caller rectangle to the live world bounds, scans the packed secondary raster at `[this+0x165d]` together with the primary mask plane `[this+0x1655]`, clears or preserves local state according to the low-3-bit class families, writes signed distance-scaled byte components into the paired vector planes `[this+0x1661]` and `[this+0x1665]`, and invalidates four neighboring sidecar byte planes at `[this+0x1631/+0x1635/+0x1639/+0x163d]` where needed. Current grounded callers are the post-build world-side rectangle refresh around `0x0044f6d7` and the two local owner passes at `0x005374bf` and `0x0053759b`, so this is the safest current read for the shared overlay-vector rebuild owner rather than another tiny cell helper. | objdump + caller inspection + field correlation + vector-plane correlation + sidecar-plane invalidation correlation |
| 368 | 0x00535070 | 138 | world_presentation_ensure_primary_overlay_surface_or_fallback_template_slot | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small setup owner under the broader world-presentation reinitializer. The helper clears the local `0x100` overlay slot band `[this+0x08]`, resets live count `[this+0x04]`, and then splits on the shell presentation gate at `[0x006d4024+0x11422e]`: when that gate is armed it allocates one `0xec`-byte surface object, initializes it through `0x00541b00` and `0x005417e0` with the current shell root plus fixed `0x100 x 0x100` dimensions, stores the resulting object in slot `0`, and updates byte `[0x006d4024+0x1146eb]` on failure; otherwise it falls back to one static-template slot allocation through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd26c`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the primary overlay-surface-or-template setup owner rather than a more specific player-facing panel builder. | objdump + caller inspection + field correlation + static-template correlation |
| 369 | 0x005356e0 | 428 | world_presentation_seed_first_overlay_slot_band_from_static_templates | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Static-template slot-band seeder under the broader world-presentation reinitializer. The helper allocates or reuses one anchor slot through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd2b0`, records that anchor index and running count in `[this+0x1568]` and `[this+0x156c]`, then seeds a contiguous slot band from template rows `0x005dd2a4` upward for ids `0x66..0x84`. After that first series it revisits the created slots, clears byte `[slot+0x05]`, runs `0x00542550` on the earlier series, and fills two trailing fallback slots from template rows `0x005dd298` and `0x005dd28c`, storing the resulting indices in `[this+0x1574]` and `[this+0x1578]`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the first template-driven overlay slot-band seeder rather than a stronger UI-label owner. | objdump + caller inspection + field correlation + static-template correlation |
| 370 | 0x00535890 | 177 | world_presentation_seed_second_overlay_slot_band_from_static_templates | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Second static-template slot-band seeder under the broader world-presentation reinitializer. The helper allocates one anchor slot through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd2d0`, stores that anchor index in `[this+0x1560]`, then seeds a contiguous slot band from template rows rooted at `0x005dd2bc` for ids `2..0x20`, finally storing the terminal count `0x20` in `[this+0x1564]`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the second template-driven overlay slot-band seeder rather than a more player-facing overlay panel owner. | objdump + caller inspection + field correlation + static-template correlation |
| 371 | 0x00535430 | 687 | world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Broader four-slot overlay-surface rebuild owner under the world-presentation reinitializer. The helper derives local dimensions through `0x005327a0`, increments the shared shell-side progress counter at `[0x006d4024+0x11427e]`, allocates one temporary RGBA buffer sized from the quarter-scaled dimensions in `[this+0x157c/+0x1580]`, and then fills that buffer either by resampling the caller-supplied source surface or by falling back to a global descriptor at `0x0062bed4` when present. It uses several shell-side resource and range queries through `0x00518de0` and `0x0053c930`, can stage a temporary source surface through `0x0053c1c0`, `0x00541930`, and `0x00541970`, and then emits up to four `0xec`-byte destination surface objects through `0x00543980`, storing them into the local overlay slot band starting at `[this+0x08 + [this+0x155c]*4]`. Current grounded callers are the broader world-presentation reinitializer `0x00537e60` and one neighboring owner at `0x00538060`, so this is the safest current read for the shared four-slot overlay-surface rebuild owner rather than a more specific UI panel constructor. | objdump + caller inspection + field correlation + temporary-surface correlation |
| 372 | 0x00535950 | 112 | world_presentation_allocate_overlay_companion_record_from_static_template | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small allocator over the local `0x1b`-entry overlay companion slot table at `[this+0x40c]`. The helper finds the first empty companion slot, allocates one `0x141`-byte record, seeds it through `0x00554830` from the caller-supplied static template row, stores the resulting pointer into `[this+0x40c + slot*4]`, and increments live count `[this+0x408]`. Current grounded caller is `world_presentation_seed_default_overlay_companion_record_set` `0x005373b0`, which invokes it seven times with static template rows `0x005dd300..0x005dd378`, so this is the safest current read for the shared companion-record allocator rather than a broader overlay rebuild owner. | objdump + caller inspection + field correlation + static-template correlation |
| 373 | 0x00536044 | 468 | world_presentation_release_secondary_overlay_support_buffers | map | thiscall | inferred | objdump + local inspection + field correlation | 3 | Teardown owner for the secondary-overlay support family. The helper frees the five-entry packed sample-triplet family rooted at `[this+0x15f1..+0x1601]`, the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`, the packed local-byte staging buffer `[this+0x162d]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, the neighboring coarse-cell and support tables, both one-byte mask planes `[this+0x1655]` and `[this+0x1659]`, the packed secondary raster `[this+0x165d]`, and the signed vector byte planes `[this+0x1661]` and `[this+0x1665]`, then nulls the corresponding pointers. The body also re-enters several neighboring support-family destructors `0x00535b40/0x00535c70/0x00535d30/0x00535df0/0x00535a10/0x00535f20`, so this is the safest current read for the shared overlay-support teardown owner rather than another generic presentation reset. | objdump + local inspection + field correlation + multiscale-support correlation + teardown correlation |
| 374 | 0x005375c0 | 2144 | world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults | map | thiscall | inferred | objdump + caller inspection + allocation-path inspection | 3 | Broad setup or ensure-owner above the secondary-overlay support family. When the caller-supplied enable byte is nonzero, the helper allocates and zero-fills the five-entry packed sample-triplet family rooted at `[this+0x15f1..+0x1601]`, the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`, the packed local-byte staging buffer `[this+0x162d]`, the four neighboring sidecar byte planes `[this+0x1631..+0x163d]`, the packed secondary 3-byte raster `[this+0x165d]`, the signed vector byte planes `[this+0x1661]` and `[this+0x1665]`, the ranked-overlay and geographic-label coarse cell tables `[this+0x1685]` and `[this+0x1675]`, plus several neighboring support tables. The same body also allocates and seeds the two one-byte mask planes with different defaults: `[this+0x1655]` is filled with byte `0x02`, while `[this+0x1659]` is filled with byte `0x01`. Later in the same body it rebuilds the local support surfaces through `0x00536230`, `0x00536420`, `0x00537420`, and the neighbor object allocator `0x005337f0`. Current grounded callers are the shell world-mode branch at `0x00484e47`, the world-presentation resize or rebuild tail at `0x00537f44`, one neighboring world-side refresh at `0x00538629`, and the `.smp`-side restore or reload branch at `0x00553539`, so this is the safest current read for the shared secondary-overlay support-buffer ensure and default-seed owner rather than a narrower vector-field helper. | objdump + caller inspection + allocation-path inspection + multiscale-support correlation + mask-plane default correlation |
| 375 | 0x00537e60 | 503 | world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Broader world-presentation reinitializer above the secondary-overlay family. The helper publishes one shell progress step, stores the incoming live grid dimensions into `[this+0x15d9/+0x15d5/+0x15dd]`, re-enters `world_allocate_base_secondary_overlay_planes_for_current_dimensions` `0x00532c80` when the dimensions are nonzero, then re-enters `world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults` `0x005375c0` and several neighboring overlay initializers or constant-table publishers (`0x00535070`, `0x00535430`, `0x00532ad0`, `0x005356e0`, `0x00534fc0`, `0x00535890`, `0x005373b0`) before returning. Current grounded callers are the world-side reattach branch at `0x0044922a` and the `.smp` restore-side presentation rebuild path at `0x005532d7`, so this is the safest current read for the shared dimension-apply and secondary-overlay-family reinitializer rather than one narrow resize helper. | objdump + caller inspection + field correlation + overlay-reinitialization correlation |
| 376 | 0x00538360 | 732 | world_rebuild_secondary_overlay_base_float_summary_and_primary_mask | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Broader rebuild owner for the base secondary-overlay float-summary plane rooted at `[this+0x1605]` and the paired one-byte mask planes `[this+0x1655]` and `[this+0x1659]`. The helper samples one caller-supplied coarse lookup field, writes one unclamped float score per live cell into the base summary plane, clears both mask planes across the same rectangle, and updates the packed secondary raster at `[this+0x165d]` as it goes. The later interior pass is the useful asymmetry: after the clear, the helper only repopulates the primary mask plane `[this+0x1655]` for low-3-bit class-`1` cells whose neighboring float-summary samples cross the positive threshold, while the second mask plane `[this+0x1659]` remains only reset or preserved for later owners. After that interior sweep it re-enters `world_normalize_secondary_overlay_float_summary_plane_globally` `0x00532d90`, then `world_expand_positive_secondary_overlay_float_summary_by_radius` `0x00532f60`, calls the neighboring refresh owner `0x0053c000`, and finally re-enters `world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults` `0x005375c0`. This asymmetry now closes the local split: the helper actively rebuilds only the primary runtime mask, while the second plane stays as the separately persisted sibling for later setup, restore, or compatibility paths. | objdump + caller inspection + field correlation + mask-plane asymmetry correlation + local-split-closure correlation |
| 377 | 0x005373b0 | 112 | world_presentation_seed_default_overlay_companion_record_set | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Seeds the default static overlay-companion record set after a broader presentation reinit. The helper zero-fills the local `0x1b`-entry companion slot table at `[this+0x40c]`, clears live count `[this+0x408]`, and then invokes `world_presentation_allocate_overlay_companion_record_from_static_template` `0x00535950` seven times with the static template rows `0x005dd300`, `0x005dd314`, `0x005dd328`, `0x005dd33c`, `0x005dd350`, `0x005dd364`, and `0x005dd378`. Current grounded caller is `0x0053804e` inside `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the shared default companion-record seeder rather than a later border-overlay rebuild owner. | objdump + caller inspection + field correlation + static-template correlation |
| 378 | 0x005374d0 | 240 | world_refresh_secondary_overlay_support_surfaces_and_vector_field_in_rect | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Rectangle-wide owner above the secondary-overlay support family. The helper clamps the caller rectangle to the live world bounds, clears shift field `[this+0x15e1]`, runs `0x00536230` across the selected cells to refresh one packed three-float local sample field rooted at `[this+0x15f1]`, runs `0x00536420` across the same rectangle to rebuild one companion unsigned-word field rooted at `[this+0x1619]`, then rebuilds the signed vector byte planes through `world_rebuild_secondary_overlay_vector_byte_planes_in_rect` `0x00536710`, and finally regenerates the multiscale support surfaces through `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`. Current grounded callers are the late world-side rectangle branch at `0x0044d45c` and the shell-side scan or brush branch at `0x004fc4bf`, so this is the safest current read for the shared secondary-overlay rectangle refresh owner rather than a one-shot startup allocator. | objdump + caller inspection + field correlation + multiscale-support correlation + vector-plane correlation |
| 379 | 0x00533b70 | 7 | world_query_overlay_strip_offset_lut_ptr | map | thiscall | inferred | objdump + caller inspection + allocation-path inspection | 3 | Tiny root-pointer getter for the overlay strip-offset lookup table at `[this+0x15e5]`. The table is allocated in the world-presentation setup path around `0x00537b68` and filled with `i * 0x5c` offsets in `0x00537cb0..0x00537ccc`. Current grounded callers are shell-side presentation and staging branches around `0x00524e92`, `0x00525b7e`, `0x0052ae90`, `0x0052b4ef`, and `0x0054dd50`, which consume it together with the normalized coordinate LUTs and sample-record roots. | objdump + caller inspection + allocation-path inspection + field correlation |
| 380 | 0x00533b90 | 7 | world_query_overlay_sample_triplet_buffer_ptr | map | thiscall | inferred | objdump + caller inspection + allocation-path inspection | 3 | Tiny root-pointer getter for the packed overlay sample-triplet buffer at `[this+0x15f1]`. The buffer is allocated in the world-presentation setup path around `0x00537616` at `3 * 4` bytes per entry, and the neighboring producer `0x005333eb` writes three floats per selected sample record into that buffer. Current grounded caller is the shell-side overlay staging branch at `0x00525b94`, which uses it alongside the normalized coordinate LUTs and strip-offset table rather than as a standalone geometry owner. | objdump + caller inspection + allocation-path inspection + field correlation |
| 381 | 0x00534f40 | 29 | world_secondary_raster_resolve_cell_record_ptr | map | thiscall | inferred | objdump + caller inspection + field correlation | 3 | Small address resolver for the secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, multiplies the linear index by `3`, and returns a direct pointer to that 3-byte cell record. Current grounded callers include neighboring world-side presentation or scan branches around `0x004464b8`, `0x00447120`, `0x0044be9c`, `0x00450f8b`, and `0x004fa7a2`, plus the `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240`, so this is the safest current read for the shared secondary-raster cell-pointer resolver rather than a more player-facing overlay helper. | objdump + caller inspection + field correlation + secondary-raster correlation |
| 382 | 0x004c9da0 | 496 | map_editor_chairman_slot_panel_format_slot_card | map | cdecl | inferred | objdump + RT3.lng strings + control-flow inspection | 4 | Formats one selected chairman-slot card for the shell editor panel rooted under control group `0x5a6e`. The helper reads the 9-byte local slot record rooted at `[0x006cec78+slot*9+0x69d8]`, formats the staged chairman profile label from the static persona table at `0x005f2d28`, appends the localized `Optional` versus `Mandatory` suffix from ids `2997` and `2998` based on `[slot+0x01]` with nonzero=`Optional` and zero=`Mandatory`, then appends one of `Human` `Computer` or `Human or Computer` from ids `3001` `3000` and `2999` based on `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`. It also formats the numeric tuning field from `[slot+0x04]` into the same card. Current grounded caller is the selection callback rooted at `0x004cc230`. | objdump + RT3.lng strings + UI callback inspection |
| 383 | 0x004ca010 | 432 | map_editor_chairman_slot_panel_refresh_selected_slot | map | thiscall | inferred | objdump + RT3.lng strings + UI control inspection | 4 | Refreshes the active detail controls for one selected chairman slot in the shell editor panel. It stores the selected slot index at `[this+0x80]`, publishes the staged profile id from `[slot+0x00]`, the persona icon byte from `0x005f2d29`, and the localized profile label from `0x005f2d47`, then updates the role and policy controls from the same local record. `[slot+0x01]` drives the Optional-versus-Mandatory control pair with nonzero=`Optional` and zero=`Mandatory`; `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]` drive the `Human`, `Computer`, and `Human or Computer` controls; and `[slot+0x04]` is surfaced through the numeric field editor. Current grounded caller is the list-selection callback at `0x004cc230`. | objdump + RT3.lng strings + UI control inspection |
| 384 | 0x004ca1c0 | 514 | map_editor_chairman_slot_panel_refresh_slot_counters | map | thiscall | inferred | objdump + UI control inspection | 3 | Recomputes the aggregate slot counters displayed by the chairman-slot editor panel. The helper walks the 16 local slot records rooted at `[0x006cec78+0x69d8]`, splits them by the Optional-versus-Mandatory byte `[slot+0x01]`, and separately counts slots whose live-seat markers come from the ordinary seat byte `[slot+0x02]` versus the special occupied-seat byte `[slot+0x03]`. It then formats the resulting `%1/%2` summaries through the shared pattern block at `0x005cfda8`, republishes those summaries to the panel controls under groups `0x5a6f`, `0x5a70`, and `0x5a71`, and stores the aggregate counts at `0x006cec78+0x6a68..0x6a7c` for neighboring shell validation. Current grounded callers are the panel constructor at `0x004cc2d0` and the role-policy update handlers in `0x004cecc0`. | objdump + UI control inspection + format-string inspection |
| 385 | 0x004ca540 | 304 | map_editor_available_chairman_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + static-table inspection | 4 | Constructs the shell-side `Player Pool` page in the map-editor control panel. The helper binds the row formatter `0x004ca450` and range callback `0x004ca430` on the shared panel root `0x5aa0`, walks the 40-entry persona table slice at `0x005f2d6e` in `0x27`-byte steps, publishes one localized chairman-name row for each persona, counts enabled scenario-side availability bytes in `[0x006cec78+0x6987..]`, and then republishes the `%1 out of %2 are selected.` summary from localized id `1035` through control `0x5aa4`. The neighboring localized page text `996` `Player Pool` plus help text `1016` `Control of which specific players (i.e. Jay Cooke) allowed in the scenario.` now make this the strongest current shell owner for the scenario's available-chairman pool rather than another generic persona browser. | objdump + RT3.lng strings + static-table inspection + UI callback inspection |
| 386 | 0x004ca670 | 280 | map_editor_scenario_metadata_panel_refresh_briefing_mode | map | thiscall | inferred | objdump + RT3.lng strings + UI control inspection | 4 | Refreshes the briefing-mode controls inside one shell-side map-editor scenario metadata panel. The helper uses the global selector `0x621f50` to choose whether the visible long-text editor is the ordinary scenario briefing or the multiplayer briefing, publishes the corresponding heading from localized ids `1491` `Briefing (dialog appears when scenario starts):` and `3586` `Multi-Player Briefing (dialog appears when scenario starts):` onto control `0x5b73`, flips the paired selector controls around `0x5b71` and `0x5b72`, and republishes the stored single-player and multiplayer briefing texts from `[0x006cec78+0x4f30]` and `[+0x5ae9]` into the paired edit controls `0x5b6d` and `0x5b6f`. Current grounded caller is the broader scenario metadata refresh at `0x004ca790`. | objdump + RT3.lng strings + UI control inspection + state-field correlation |
| 387 | 0x004ca790 | 384 | map_editor_scenario_metadata_panel_refresh_controls | map | thiscall | inferred | objdump + RT3.lng strings + UI control inspection | 4 | Refreshes the shell-side map-editor scenario metadata controls under the shared control band `0x5b69..0x5b74`. The helper first re-enters `map_editor_scenario_metadata_panel_refresh_briefing_mode` at `0x004ca670`, then republishes the scenario description from `[0x006cec78+0x672e]` to control `0x5b69`, the start-year trio from `[+0x66ca]`, `[+0x66d2]`, and `[+0x66ce]` into `0x5b6a`, `0x5b6c`, and `0x5b6b`, the direct campaign-designated byte `[+0x66de]` into control `0x5b6e`, and the inverse of the paired metadata byte `[+0x66f3]` into control `0x5b74`. The resource-side anchor is now explicit too: `editorDetail.win` contains one control record rooted at `0x5b6e` that carries localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.` before the next control record begins at `0x5b74`, which grounds `[+0x66de]` as the actual campaign-scenario flag rather than a generic metadata boolean. The neighboring message dispatcher at `0x004cb4a0` clamps the three year fields to `1829..2100` and maintains `minimum <= default <= maximum`, which aligns the rest of this panel with the localized editor strings `Description:` `Minimum Start Year:` `Default Start Year:` `Maximum Start Year:` and the paired briefing labels in `RT3.lng` ids `1483..1492` and `3586`. | objdump + RT3.lng strings + UI control inspection + state-field correlation + editorDetail.win resource record |
| 388 | 0x004ca910 | 474 | map_editor_building_density_panel_refresh_controls | map | thiscall | inferred | objdump + RT3.lng strings + caller inspection + UI control inspection | 4 | Refreshes the shell-side `Building Density` page in the map-editor control panel. The helper reads two scenario-state bytes at `[0x006cec78+0x4c78]` and `[+0x4c7c]` and reflects them into two separate three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, with both fields seeded to the middle state `1` by constructor-time defaults and persisted through the ordinary map-state bundle path. The localized field captions now make the page materially tighter: `[state+0x4c78]` is the `Starting Building Density Level:` selector from ids `1642` and `1643`, where the default middle state `1` corresponds to the documented `100%` baseline and the lower world-building branches later treat the stored ordinal as a real three-state numeric mode; `[state+0x4c7c]` is the paired `Building Density Growth:` selector from id `1644`, which combines with city or region-specific density changes as described by `1641` and is likewise consumed later as a three-state growth-mode byte rather than a pure UI label. Related localized report text such as `1037`, `1048`, and `1070` points back to this same pair as the map-wide starting-density and later growth controls. | objdump + RT3.lng strings + caller inspection + UI control inspection + save-load correlation |
| 389 | 0x004ca980 | 315 | map_editor_economic_cost_slider_dispatch | map | thiscall | inferred | objdump + RT3.lng strings + .data descriptor table inspection | 3 | Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d`, converts the incoming integer slider delta or position into normalized floats, writes six tuned values into the adjacent scenario-state block at `[0x006cec78+0x0be2]`, `[+0x0be6]`, `[+0x0bea]`, `[+0x0bee]`, `[+0x0bf2]`, and `[+0x0bf6]`, mirrors the first value into `[state+0x0bde]`, and then re-enters the live panel owner through `0x004cadf0` when `0x006cff84` is present. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned. | objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection |
| 390 | 0x004cadf0 | 751 | map_editor_economic_cost_slider_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + caller inspection + .data descriptor table inspection | 4 | Constructs one shell-side map-editor economic cost tuning panel. The helper registers `map_editor_economic_cost_slider_dispatch` at `0x004ca980` on the six slider controls `0x5bcd`, `0x5bcf`, `0x5bd1`, `0x5bd3`, `0x5bd5`, and `0x5bd7`, attaches the neighboring preview or formatter callback `0x004caaf0` on control `0x5be1`, and then republishes the current scenario-state tuning values from `[0x006cec78+0x0be2..0x0bf6]` back into those controls through the shared slider formatting helpers. Current surrounding evidence now grounds this as the live editor-side economic tuning subsystem that was previously only visible through the orphaned help-text family: the adjacent descriptor block at `0x00611c70..0x00612220` pairs the wider lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost`, plus help texts `2433..2437`. Current grounded caller is the larger editor-panel dispatcher at `0x004ce244`. | objdump + caller inspection + slider registration + state-field correlation + RT3.lng strings + .data descriptor table inspection |
| 391 | 0x004cb2b0 | 485 | map_editor_scenario_special_conditions_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + static-table inspection | 4 | Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 36-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`. | objdump + RT3.lng strings + static-table inspection + UI callback inspection |
| 392 | 0x004cb4a0 | 468 | map_editor_scenario_metadata_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2`, writing the scenario description from the edit-control payload into `[0x006cec78+0x672e]`, the single-player and multiplayer briefing texts into `[+0x4f30]` and `[+0x5ae9]`, flipping the briefing selector at `0x621f50` between the single-player and multiplayer views, toggling the direct campaign-scenario byte `[+0x66de]` plus the paired metadata byte `[+0x66f3]`, and committing the three start-year fields `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]` after clamping each incoming value to `1829..2100`. The resource correlation is now explicit too: `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.`, so the direct toggle path at `0x4cb519` is now grounded as the editor-side campaign-designation bit rather than a generic metadata checkbox. Before returning it also normalizes the year trio so `minimum <= default <= maximum` and then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`. | objdump + RT3.lng strings + UI dispatch inspection + state-field correlation + editorDetail.win resource record |
| 393 | 0x004cb6f0 | 496 | map_editor_available_chairman_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + static-table inspection + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block. | objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation |
| 394 | 0x004cb8e0 | 271 | map_editor_scenario_special_conditions_panel_handle_message | map | thiscall | inferred | objdump + static-table inspection + UI dispatch inspection | 4 | Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole special-condition dword array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and then re-enters `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. Two row ids are also special-cased through immediate helper calls after commit, which marks this as the live state owner for the scenario rule-toggle matrix rather than only a passive list callback block. | objdump + static-table inspection + UI dispatch inspection + state-field correlation |
| 395 | 0x004cb9f0 | 134 | map_editor_building_density_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + caller inspection + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Building Density` page. The helper handles the two three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, committing ordinal values `0`, `1`, or `2` into the scenario-state bytes `[0x006cec78+0x4c78]` and `[+0x4c7c]` respectively before re-entering the same page refresh path at `0x004ca910`. The localized captions now pin the semantics more directly: `[state+0x4c78]` is the map-wide `Starting Building Density Level:` selector whose default middle state is the documented `100%` baseline, while `[state+0x4c7c]` is the paired `Building Density Growth:` selector. Current downstream xrefs also show both stored bytes steering later world-generation and growth math as concrete three-state mode selectors rather than only UI summaries. | objdump + RT3.lng strings + caller inspection + UI dispatch inspection + state-field correlation |
| 396 | 0x004cc980 | 943 | map_editor_city_region_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the list-row formatter `0x004cc340` and selection callback `0x004cc930`, populates the visible city-or-region list from `0x0062bae0`, publishes detail fields through controls `0x50dc..0x50e2`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper. | objdump + RT3.lng strings + UI callback inspection + region-collection correlation |
| 397 | 0x004cc250 | 112 | map_editor_chairman_slot_panel_refresh_slot_list | map | thiscall | inferred | objdump + UI control inspection | 4 | Rebuilds the visible slot list in the chairman-slot editor panel. It clears the list control under group `0x5a6e`, then walks the 16 local slot records rooted at `[0x006cec78+0x69d8]` and appends one row for each slot whose active-seat bytes `[slot+0x02]` or `[slot+0x03]` are set. After repopulating the list it re-enters `map_editor_chairman_slot_panel_refresh_slot_counters` at `0x004ca1c0`. Current grounded callers are the panel constructor at `0x004cc2d0` and several message-handler update paths in `0x004cecc0`. | objdump + UI control inspection |
| 398 | 0x004cc2d0 | 99 | map_editor_chairman_slot_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Players` editor panel under control group `0x5a6e`. The helper attaches the selected-slot formatter at `0x004c9da0`, the profile-cycle button at `0x004c9fa0`, and the list-selection callback at `0x004cc230`, then populates the current slot list through `map_editor_chairman_slot_panel_refresh_slot_list` and publishes one top-level panel control. The localized page text `995` `Players` plus help text `1015` `Control of how many players, human and/or A.I., allowed in the scenario.` now make this the clearest current shell owner for the local chairman-slot record family rooted at `0x006cec78+0x69d8`. | objdump + RT3.lng strings + UI callback inspection |
| 399 | 0x004ceb90 | 291 | map_editor_chairman_slot_panel_cycle_selected_slot_profile | map | thiscall | inferred | objdump + static-table inspection | 4 | Cycles the staged chairman profile assigned to the currently selected local slot. Starting from the slot-local profile id at `[slot+0x00]`, the helper wraps through the bounded persona id range `0..40`, skips any profile already marked busy in the static persona table byte at `0x005f2d28`, writes the chosen id back to `[slot+0x00]`, and mirrors the same choice into any already-materialized persona object in `0x006ceb9c`, including its display name, biography text, and icon byte. Current grounded callers are the profile-cycle control in `map_editor_chairman_slot_panel_handle_message` and the neighboring shell callback block around `0x004c9fa0`. | objdump + static-table inspection + UI callback inspection |
| 400 | 0x004cecc0 | 1049 | map_editor_chairman_slot_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell chairman-slot editor panel rooted at `0x5a6e`. The helper handles add and remove slot actions, profile cycling, the Optional-versus-Mandatory toggle, the three-way `Human` `Computer` `Human or Computer` role group, and numeric tuning edits for the selected slot. The current slot-record semantics are bounded directly from these branches: control id `0x5a77` writes `[slot+0x01]=1` for `Optional`, `0x5a78` writes `[slot+0x01]=0` for `Mandatory`, and `0x5a79`, `0x5a7a`, plus `0x5a7b` select `Human`, `Computer`, and `Human or Computer` by combining the ordinary seat byte `[slot+0x02]` with the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`; `0x5a7c` commits the numeric tuning field back to `[slot+0x04]`. The add-slot path allocates a new live slot, seeds `[slot+0x00]` to one persona id, `[slot+0x01]` to `Optional`, `[slot+0x02]` to the broad `Human or Computer` state, mirrors that same broad state into the external gate at `+0x0bc3`, and seeds `[slot+0x04]` to the default `100000` tuning value. The remove path clears the whole 9-byte record rooted at `[slot+0x00]`, resets `[slot+0x04]` back to `100000`, and clears any already-materialized persona object, but it does not directly write the special occupied-seat byte `[slot+0x03]`, which remains seeded elsewhere in the currently grounded code. Current grounded caller is the shell panel callback attachment in `map_editor_chairman_slot_panel_construct` at `0x004cc2d0`. | objdump + RT3.lng strings + UI dispatch inspection |
| 401 | 0x004ce070 | 1549 | map_editor_panel_select_active_section | map | thiscall | inferred | objdump + caller inspection + UI dispatch inspection | 4 | Top-level map-editor control-panel section selector. The helper switches over the active page byte at `[this+0x78]`, tears down or replaces the current page owner at `[this+0x7c]`, and then constructs the bounded editor pages reached so far including the scenario metadata panel `0x004ca790`, city-or-region page `0x004cc980`, territory page `0x004cd070`, available-chairman panel `0x004ca540`, economic tuning panel `0x004cadf0`, locomotives-availability page `0x004cd680`, industry-availability page `0x004cdbd0`, special-conditions panel `0x004cb2b0`, the bounded dual tri-state policy panel rooted at `0x004ca910`, the now-grounded `Port/Warehouse Cargos` page `0x004cf910`, and the resolved report pages at `0x004d3000`, `0x004d3020`, `0x004d3060`, `0x004d3080`, `0x004d30a0`, `0x004d4110`, and `0x004d4130`. Current neighboring shell evidence is enough to treat this as the broad editor-side page owner rather than another local panel helper. | objdump + caller inspection + UI dispatch inspection + page-constructor correlation |
| 402 | 0x004ce380 | 1174 | map_editor_city_region_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Cities/Regions` editor page. The helper routes list-selection and navigation traffic through the city-or-region controls around `0x507e..0x5088`, opens the rename prompt from localized id `1054` `Enter the new name:` for the currently selected city-or-region, and also owns the copy-industry-data flow anchored by localized id `1055` `Choose the city to copy industry data from`. One bounded branch walks the candidate pool at `0x0062b268` and reapplies per-candidate enable or weighting state against the selected city-or-region through `0x004206b0` before re-entering `map_editor_city_region_panel_construct`. Current grounded globals `0x006cff74`, `0x006cff78`, and the region collection `0x0062bae0` make this the live handler for the `Cities/Regions` editor section rather than a generic shell callback block. | objdump + RT3.lng strings + UI dispatch inspection + region and candidate correlation |
| 403 | 0x004ce820 | 1221 | map_editor_territory_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Territories` editor page. The handler uses the selected territory ids in `0x00621f48` and `0x00621f4c`, routes selection and navigation through controls around `0x50dc..0x50df`, opens the territory rename prompt from localized id `1054`, and owns the border-remap or hide-border policy path that warns through localized ids `1056` and `1057` when a territory's borders cannot be hidden because other territories already remap to it. After committing the selected territory's border and remap fields it re-enters `map_editor_territory_panel_construct`, which makes this the live `Territories` page handler rather than another local modal callback. | objdump + RT3.lng strings + UI dispatch inspection + territory-state correlation |
| 404 | 0x004cd070 | 1280 | map_editor_territory_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Territories` editor page. The helper uses `0x00621f48` and `0x00621f4c` as the selected-territory latches, falls back to the first live territory in the territory collection at `0x006cfc9c`, and shows the empty-page warning from localized id `1046` `You currently have no territories to edit.` when no territories exist. In the live path it populates the visible territory list from `0x006cfc9c`, publishes the selected territory's id, name, border mode, remap target, and numeric tuning fields through controls `0x50dc..0x50e5`, and builds the secondary remap list from other territories that reference the currently selected one. Current grounded neighbors make this the main owner for the `Territories` editor section. | objdump + RT3.lng strings + UI callback inspection + territory-collection correlation |
| 405 | 0x004cd680 | 1168 | map_editor_locomotive_availability_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Locomotives` availability page in the map-editor control panel. The helper reflects three scenario-state policy bytes from `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]` into controls `0x5b09..0x5b0b`, binds the row formatter `0x004cd570` and the neighboring callback `0x004ca960` on root control `0x5b05`, and iterates the collection at `0x006ada84` to build the visible locomotive list plus the localized title from id `1050` `Locomotives Available\n\n%1 of %2 available`. The detail path formats each selected locomotive through `EditorDetail.win` and counts live world usage by resolving the record through `0x00461c80` and the world-side lookup at `0x00435030`. Current grounded evidence is therefore strong enough to treat this as the main locomotives-available page rather than a generic detail widget. | objdump + RT3.lng strings + UI callback inspection + locomotive-usage correlation |
| 406 | 0x004cf0d0 | 861 | map_editor_locomotive_availability_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Locomotives` availability page. The helper routes selection and bulk-toggle traffic through controls `0x5b06..0x5b0c`, rewrites the three scenario-state policy bytes at `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]`, and walks the locomotive collection at `0x006ada84` to commit per-row availability changes through the same record family used by the constructor. Bulk branches apply enable or disable policy across the visible locomotive set before the handler re-enters `map_editor_locomotive_availability_panel_construct` at `0x004cd680`, which makes this the live availability-policy owner rather than a local detail callback. | objdump + RT3.lng strings + UI dispatch inspection + locomotive-policy correlation |
| 407 | 0x004cdbd0 | 1357 | map_editor_industry_availability_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Industry (Overall)` availability page in the map-editor control panel. The helper binds the detail-row callback `0x004cc130` and the neighboring callback `0x004c9d80` on root control `0x9c42`, then walks the global candidate pool at `0x0062b268`, skipping the category-1 family and sorting the remaining candidates by label before building the visible industry list. The detail side formats the selected industry through `EditorDetail.win`, appends up to eight compatible city-or-region names from the region collection at `0x0062bae0`, and publishes the localized summary from id `1051` `There are %1 Cities and/or Regions using %2 right now`, while the page title uses id `1052` `Industries Available\n\nIndustries: %1 of %2 available`. Current grounded evidence therefore treats this as the main industry-availability page rather than an unnamed detail browser. | objdump + RT3.lng strings + UI callback inspection + candidate-pool correlation |
| 408 | 0x004cf430 | 714 | map_editor_industry_availability_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Industry (Overall)` availability page. The handler routes navigation and toggle traffic through the control band `0x9c43..0xa40f`, updates candidate-availability state through `0x00434f20` for the currently selected industry rows, and then re-enters `map_editor_industry_availability_panel_construct` at `0x004cdbd0` so the visible count and compatible-city summary refresh against the candidate pool at `0x0062b268`. Current grounded control usage and localized strings now make this the live industry-availability handler rather than another shared editor callback block. | objdump + RT3.lng strings + UI dispatch inspection + candidate-state correlation |
| 409 | 0x004cf910 | 1770 | map_editor_port_warehouse_cargo_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Port/Warehouse Cargos` page in the map-editor control panel. The helper uses the selected recipe-book index latches at `0x006cffa0` and `0x006cffa4`, falls back across the per-book state blocks rooted at `[0x006cec78+0x0fe7+index*0x4e1]`, and populates the visible cargo-page controls under `0x59d8`, `0x5a0a`, and `0x5b74`. Current page-state work now bounds the structure more concretely too: the selected recipe-book index wraps modulo `12`, each recipe-book block stores the shared maximum annual production float at `book+0x3ed`, and the constructor then walks five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`. Each line now grounds as one row-owned mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token at `+0x08`, and one demanded-cargo token at `+0x1c`; the constructor resolves the two token strings against the global cargo collection and then reflects the resulting selector indices back into the page controls. The row-control mapping is now bounded too: the selector and label pair at `+0x14/+0x1e` is the supplied-cargo side because it is the pair enabled in modes `2/3`, while the pair at `+0x28/+0x0a` is the demanded-cargo side because it is the pair enabled in modes `1/3`. The same gating also tightens the single numeric field at `+0x46/+0x32`: it is labeled `Annual Demand:` only for mode `1`, but `Annual Supply:` for modes `2/3`. The localized page-title and help-text cluster now bounds the page much more tightly: `1001` `Port/Warehouse Cargos`, `1021` `Control over what ports and warehouses demand and supply.`, `1499` `Port/Warehouse Cargo Recipe Book:`, `1671` `Rename this cargo recipe book`, `1672` and `1673` for previous or next recipe-book cycling, `1674` and `1675` for the shared maximum annual production field, `1676` `Demanded:`, `1677` `Supplied:`, and `1678` for the per-cargo annual amount field. The same constructor also surfaces the four per-cargo mode labels `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply`, publishes the annual demand or supply captions from `510` and `511`, formats rename and usage summaries through localized ids `507`, `508`, and `509`, and exposes the sandbox toggle text from id `3901` `Sandbox Allowed`. Current mode gating now makes the fourth mode tighter too: `Production Demand->Supply` is the only line state that clearly keeps both supplied-cargo and demanded-cargo branches active, while the shared numeric field stays on the supply side in that mode. That matches the wording around `1674`, `1675`, and `504` that ties it to one shared production-capacity pool and raw-material conversion into supplied output. It also emits the bounded high-production and high-load warnings from ids `505` and `506`, both of which explicitly reference ports or warehouses, which makes this the strongest current owner for the recipe-book or port-cargo editor lane rather than another generic detail page. | objdump + RT3.lng strings + UI callback inspection + recipe-book state correlation + mode-table correlation + control-gating correlation |
| 410 | 0x004d0040 | 1643 | map_editor_port_warehouse_cargo_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Port/Warehouse Cargos` editor page. The helper routes selection and navigation traffic through the same recipe-book control bands rooted at `0x59d8`, `0x5a0a`, and `0x5b74`, opens the rename prompt from localized id `507`, and commits per-book cargo policy, sandbox-allowed state, and recipe-book text changes back into the scenario-state blocks at `[0x006cec78+0x0fe7+index*0x4e1]`. The edit-side dispatch is now tighter than before: the recipe-book selector wraps modulo `12`; the dedicated top-level numeric field under `0x59de` writes the shared maximum annual production float at `book+0x3ed`; and the per-line edit groups commit into five fixed cargo-line records beginning at `book+0x3f1` with stride `0x30`. Those line groups now ground as one mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token string at `+0x08`, and one demanded-cargo token string at `+0x1c`. The concrete control writes are now bounded too: the mode-`2/3` selector pair writes the supplied token through the `+0x14` control into `+0x08`, while the mode-`1/3` selector pair writes the demanded token through the `+0x28` control into `+0x1c`. The same handler keeps the single amount field on the demand side only for mode `1`; in modes `2/3` it writes that same `+0x04` field as annual supply, which matches the constructor captions `510` `Annual Demand:` versus `511` `Annual Supply:`. Current localized row text now makes the bounded edit surface much clearer: the page cycles among recipe books through `1672` and `1673`, renames them through `1671`, updates the shared maximum annual production field under `1674` and `1675`, and edits five fixed per-book line entries whose mode labels are `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply` with annual amount captions `510` `Annual Demand:` and `511` `Annual Supply:` plus row labels `1676` `Demanded:` and `1677` `Supplied:`. The wording on `1675` also tightens the fourth mode specifically: `Production Demand->Supply` is the branch where the shared production-cap field is relevant and raw materials on hand are converted through production lines into supplied output, rather than only free-standing demand or free-standing supply. One bounded branch walks the city-or-region collection at `0x0062bae0` while rebuilding the usage summaries from localized ids `508` and `509`, and the warning branches re-use ids `505` and `506` when production-rate or supply-demand settings become too high for ports or warehouses. Before returning it re-enters `map_editor_port_warehouse_cargo_panel_construct` at `0x004cf910`, which makes this the live handler for the port or warehouse recipe-book page rather than a shared page-table callback. | objdump + RT3.lng strings + UI dispatch inspection + recipe-book state correlation + mode-table correlation + control-write correlation |
| 411 | 0x004cf700 | 370 | map_editor_panel_dispatch_active_section_message | map | thiscall | inferred | objdump + caller inspection + UI dispatch inspection | 4 | Top-level message dispatcher for the active map-editor control-panel section. The helper reuses the same page selector byte at `[this+0x78]` and routes incoming shell messages to the current page-local handlers, including the grounded city-or-region handler `0x004ce380`, territory handler `0x004ce820`, scenario metadata handler `0x004cb4a0`, available-chairman handler `0x004cb6f0`, special-conditions handler `0x004cb8e0`, the bounded dual tri-state handler `0x004cb9f0`, the grounded port-or-warehouse cargo handler `0x004d0040`, and the resolved report-page handlers rooted at `0x004d38c0`, `0x004d3d90`, and the neighboring editor report family. Current grounded caller and page-table evidence now make this the broad editor-side active-page dispatcher rather than another page-local callback block. | objdump + caller inspection + UI dispatch inspection + page-handler correlation |
| 412 | 0x004d0420 | 1618 | map_editor_city_count_stats_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `City Count Stats` editor report. The helper aggregates land-cell and city counts from the active world and region collections, derives per-10K density ratios, and formats the visible summary through localized ids `1059..1070`, including `Total Land Cells`, `Total Cities`, `Average City Building Density`, `Average Region Building Density`, and the projected starting-industry and non-industry building counts. The projected-building side is tighter now too: it walks the live region collection `0x0062bae0`, sums world_region_query_projected_structure_count_scalar_by_category `0x004234e0` for categories `2`, `3`, and `0`, and then combines those projected category scalars with the live-region count byte `[region+0x242]` and density float `[region+0x25a]` to build the final industry and non-industry summary terms. Current grounded caller is the neighboring report-page constructor at `0x004d30a0`. | objdump + RT3.lng strings + caller inspection + world and region count correlation + projected-structure-scalar correlation |
| 413 | 0x004d0a90 | 3416 | map_editor_general_validation_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `General Validation` editor report. The helper walks the current scenario and world state looking for high-level validation failures, including missing industry in a city or region, mismatches between available player slots and the current player-pool setup, missing briefing text, and missing scenario description, then emits the matching warning lines through localized ids such as `1071`, `1073`, `1074`, and `1075`. Current grounded caller is the page constructor at `0x004d3080`, which makes this the actual general-validation report rather than the tree-stats page previously grouped under that label. | objdump + RT3.lng strings + caller inspection + validation-string correlation |
| 414 | 0x004d1b80 | 536 | map_editor_tree_stats_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `Tree Stats` editor report. The helper scans the active world grid through dimensions rooted at `0x0062c120`, accumulates total-tree and density counts into the neighboring global scratch slots at `0x006cffa8` and `0x006cffb8`, and then formats the visible report through localized id `1086`, which includes `Total Trees`, `Trees per any cell`, `Trees per land cell`, and the adjacent performance guidance text. Current grounded caller is the tree-stats page constructor at `0x004d3060`. | objdump + RT3.lng strings + caller inspection + world-grid scan correlation |
| 415 | 0x004d1d60 | 1679 | map_editor_city_region_growth_stats_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `Stats - City/Region` growth report. The helper walks the city or region collection at `0x0062bae0`, reads display names from each entry, and formats the multi-column growth summary through localized ids `1087..1096`, including `Industry Bldg Count`, `Industry Revenue`, `Industry Profit`, `Modified Rail Revenue`, `Weighted Profit Margin`, `Annual Density Adjust`, `Start Density`, `Current Density`, `Start Bldg Count`, and `Current Bldg Count`. The column-to-field mapping is tighter now too: the report prints the weighted-profit-margin scalar from `[region+0x2e2]` as `%3.2f`, the annual-density-adjust scalar from `[region+0x2ee]` as `%3.1f%%`, the start/current density pair from `[region+0x25a/+0x25e]`, and the start/current building-count pair from `[region+0x286/+0x296]`. The neighboring constructor also publishes localized id `1114`, whose explanatory text says cities grow from industry profit margins plus modified rail revenue, so this now looks like the main city-region growth analytics page rather than a generic validation helper. Current grounded caller is `0x004d3020`. | objdump + RT3.lng strings + caller inspection + city-region stat correlation + column-field correlation |
| 416 | 0x004d2430 | 1597 | map_editor_cargo_stats_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `Stats - Cargo` editor report. The helper iterates the cargo or building candidate pool at `0x0062b268`, groups entries by category, and emits the report columns from localized ids `1097..1113`, including `Category`, `Raw Producers`, `Factories`, `Total`, and the adjacent supply-demand and weighted-price summary fields. Current grounded caller is the neighboring page constructor at `0x004d3000`. | objdump + RT3.lng strings + caller inspection + cargo-pool correlation |
| 417 | 0x004d3000 | 32 | map_editor_cargo_stats_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Stats - Cargo` page in the map-editor control panel. The helper binds the report callback `0x004d2430` and attaches the resulting page into the broader editor section owner. Current grounded neighboring labels and report fields align this page with the cargo analytics family rather than with general validation. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 418 | 0x004d3020 | 32 | map_editor_city_region_growth_stats_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Stats - City/Region` page in the map-editor control panel. The helper binds the report callback `0x004d1d60`, and the surrounding page text includes localized id `1114`, whose explanatory note about city growth from industry profit margins and modified rail revenue matches the same report callback. Current grounded evidence therefore treats this as the city-region growth analytics page. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 419 | 0x004d3060 | 100 | map_editor_tree_stats_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Stats - Trees` page in the map-editor control panel. The helper binds the report callback `0x004d1b80` and attaches it into the broader editor page owner. This corrects the earlier overbroad validation naming: current grounded evidence says this constructor owns the dedicated tree-stats page rather than the whole general-validation lane. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 420 | 0x004d3080 | 32 | map_editor_general_validation_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `General Validation` page in the map-editor control panel. The helper binds the report callback `0x004d0a90` and sits alongside the neighboring stats and event-report pages in the same page table. Current grounded warning strings and validation checks make this the actual general-validation page rather than the adjacent tree-stats constructor. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 421 | 0x004d30a0 | 32 | map_editor_city_count_stats_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Stats - City Count` page in the map-editor control panel. The helper binds the report callback `0x004d0420` and sits alongside the other editor report constructors in the active-section page table. Current grounded labels and report fields align it with the city-count and projected-density summary page. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
