94 KiB
Input, Save/Load, and Simulation: Editor Breadth
Editor Breadth
The broader map-editor page owner is now bounded through
map_editor_panel_select_active_section 0x004ce070 and
map_editor_panel_dispatch_active_section_message 0x004cf700, which switch among the grounded
setup pages, Cities/Regions, Territories, the Players and Player Pool setup slices, the
now-grounded Building Density page, the locomotives-available and industry-availability pages,
the economic and special-condition pages, the Port/Warehouse Cargos page, and the later report
pages. The mid-editor ownership is materially clearer now too: the chairman-slot editor is the
Players page, the available-chairman editor is the Player Pool page, and the former unnamed
dual tri-state page now lines up with localized page text 997 Building Density plus help text
1017 and the direct field captions 1642 Starting Building Density Level: and 1644
Building Density Growth:. Both controls are now bounded as stored ordinal bytes 0/1/2 rather
than loose labels: the first three-choice control is the map-wide starting-density selector, with
its default middle state 1 matching the documented 100% baseline from 1643; the second is
the paired overall growth selector whose effects later appear in the city-growth side of the
simulation. map_editor_city_region_panel_construct and
map_editor_city_region_panel_handle_message own the city-or-region editing lane with rename and
copy-industry-data flows. The adjacent economic tuning page is explicit now too:
map_editor_economic_cost_slider_panel_construct 0x004cadf0 registers
map_editor_economic_cost_slider_dispatch 0x004ca980 on six visible slider controls
0x5bcd..0x5bd7, re-publishes the current values from
[world+0x0be2/+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6], and pairs that band with the localized
captions Prime Rate, Merger Premium, and the construction/maintenance cost family
Build Stations Cost through Steam Engine Cost. The dispatch side writes those six floats
directly back into the same state band and mirrors the first lane into [world+0x0bde], which
now ties the editor page directly to the .smp save/load plateau and the post-load/runtime
consumers grounded elsewhere in the atlas. The read-side presentation seam is explicit now too:
map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows 0x004caaf0 is the
control-0x5be1 sibling for that same page. It reads the live six-float band, builds one
preview curve from leading lane [world+0x0be2] plus the stepped multiplier table
[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6], and republishes the six formatted numeric
rows through the neighboring dynamic-text controls 0x5bce/0x5bd0/0x5bd2/0x5bd4/0x5bd6/0x5bd8.
That closes the economic tuning page as one real save/load-facing editor family rather than only
a constructor plus one write-only slider dispatcher. The city-or-region copy side is tighter now too: the
handler first enters
0x00420e00, which rebuilds the selected region's profile collection [region+0x37f], clones
the source region's live label-weight entries when a source region is present, and otherwise
reseeds a fixed default weight set through repeated 0x004206b0 calls. The no-source companion
0x00420ed0 now makes that split explicit: it rebuilds the same subcollection and then picks one
of two fixed default label-weight sets based on region class dword [region+0x23e], using one
all-0.2f family for nonzero-class regions and one class-0 family that starts with 0.3f
before continuing with repeated 0.2f entries. The lower mutator
0x004206b0 then linearly scans the selected region subcollection by profile label, creates a
new profile only when the copied weight is positive, removes an existing profile when the copied
weight is non-positive, updates [entry+0x1e] otherwise, and refreshes the region's derived
availability-summary bytes [region+0x2f6/+0x2fa/+0x2fe] through 0x00420410; map_editor_territory_panel_construct and
the adjacent no-source companion 0x00420ed0 is tighter too: it rebuilds the same collection
root [region+0x37f] but then seeds one of two fixed default profile-label sets directly through
repeated 0x004206b0 calls, splitting by region class dword [region+0x23e]. Nonzero-class
regions take one all-0.2f default set, while class-0 regions take a different set that starts
with one 0.3f weight before continuing with repeated 0.2f entries. That makes 0x420ed0
the true class-split default-profile companion to the source-cloning helper at 0x420e00,
rather than just more of the same editor copy path. Two neighboring collection queries are tight
enough now too. 0x00421d20 counts how many live regions have at least one profile row in
[region+0x37f] whose label matches the candidate-name string for one caller-supplied candidate
id; 0x00421e30 resolves the Nth such matching region. Both helpers reuse the same
0x0041fac0 ordinal label-and-weight copy helper we just grounded, only increment once per
region, and skip nonzero-class regions whose companion count [region+0x242] is nonpositive.
Those two queries are what the editor summary side at 0x004cdd56/0x004cdeab uses before it
formats per-region lists for one selected industry or profile name. The adjacent world-facing
query strip is bounded too: 0x00422010 scans the live region collection for class-0 regions
whose normalized coordinates fall inside one caller-supplied float rectangle, keeps the nearest
region id [region+0x23a] by squared XY distance through 0x0051db80, and returns 0 when no
qualifying region is found; 0x004220b0 is the small wrapper above it that returns the matched
region name [region+0x356] or the fallback localized scratch string at 0x0062ba90.
The adjacent scenario-rule page is tighter on the same save/load axis too:
map_editor_scenario_special_conditions_panel_clear_visible_row_band 0x004cb1a0 and
map_editor_scenario_special_conditions_panel_format_row_by_index 0x004cb1c0 are now the
concrete range and row callbacks behind list control 0xa7fa, so the persisted 49-dword
scenario-rule band [world+0x4a7f..+0x4b3f] is no longer only constructor-shaped in the atlas.
The constructor 0x004cb2b0 binds those callbacks, counts enabled rows directly from that same
dword band, and keeps the trailing scalar [world+0x4b43] in the same page family.
map_editor_territory_panel_construct and
map_editor_territory_panel_handle_message own the territory rename and border-remap lane;
map_editor_locomotive_availability_panel_construct plus
map_editor_locomotive_availability_panel_handle_message now bound the locomotive policy page
over 0x006ada84; map_editor_industry_availability_panel_construct plus
map_editor_industry_availability_panel_handle_message do the same for the industry candidate
pool at 0x0062b268; and map_editor_port_warehouse_cargo_panel_construct plus
map_editor_port_warehouse_cargo_panel_handle_message now ground the recipe-book page that edits
port or warehouse cargo policies through twelve per-book state blocks at
[0x006cec78+0x0fe7+index*0x4e1]. Each book now has a shared maximum annual production float at
book+0x3ed and five fixed cargo-line entries starting at book+0x3f1 with stride 0x30; each
line is bounded as a mode dword, annual amount, a supplied-cargo token at +0x08, and a
demanded-cargo token at +0x1c. The constructor and handler now make those fields materially
tighter too: the row pair shown in Supply Only and Production Demand->Supply is the +0x08
supplied-cargo selector, the row pair shown in Demand Only and Production Demand->Supply is
the +0x1c demanded-cargo selector, and the single amount field at +0x04 is labeled Annual Demand: only in mode 1 but Annual Supply: in modes 2/3. The stronger new runtime-side
result is now a full chain rather than only the importer:
scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables first imports those same five
lines into one repeated array of identical 0xbc-byte runtime descriptors with no row-index
special casing, while mode 3 keeps reseeding the primary token lane until it differs from the
one-row subordinate lane and then writes literal 1.0 into the subordinate amount slot
[desc+0x48]. The candidate-side rebuild pass at
structure_candidate_collection_rebuild_runtime_records_from_scenario_state 0x00412d70 then
projects those descriptors into the live structure collection at 0x0062b268 in two
availability-bank passes. The current local disassembly now shows that this bridge reuses live
candidate slots by prior ordinal field [candidate+0x794] when possible, otherwise allocates one
fresh candidate, clones from the current bank's template source candidate, and only then copies in
the imported recipe-line count, shared production-cap float, and packed 0xbc descriptor strip
from scenario state. The label side is narrower than the earlier note too: current local
disassembly of 0x00412d70 does not consult the recipe-book name at [state+0x0fe8] at all.
Instead it formats display stem [candidate+0x04] directly from one of two fixed built-in roots
chosen by availability bit [candidate+0xba] & 1, together with the current ordinal. Each
rebuilt candidate then feeds
structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables 0x00411ee0, which rebuilds
the per-cargo runtime summary tables. That helper now reads more concretely too: it clears both
emitted cargo-id tables at [candidate+0x79c] and [candidate+0x7a0], clears the per-cargo
float band at [candidate+0xa1..+0xb8], and fills one local 0x35-cargo status scratch from
the descriptor strip. Each subordinate row contributes status 1 when the cargo is only
referenced and status 2 when the row is currently year-active, with the helper keeping the
maximum status per remapped cargo id through 0x0062ba8c+0x9a. It then allocates the two final
compact membership tables from the status>=1 and status>=2 sets with counts stored at
[candidate+0x7a4] and [candidate+0x7a8]. The same scan also makes the production-mode split
explicit on the runtime side: descriptor mode 0 uses the shared production cap at
[candidate+0x2a] divided by the descriptor amount, while nonzero mode bypasses that scaling
path and publishes the row amount directly. At that point the candidate import strip is
structurally closed in current local evidence: the local import and rebuild seam is no longer
where the loader reconstructs runtime descriptor or membership tables, but only what the
unresolved supply-marker token family means before those already-grounded candidates are projected
back into live cargo ids. The immediate sibling
structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790 0x00411ce0, which for
subtype byte [candidate+0x32] == 2 scans the imported descriptor strip and derives two compact
post-import flags from mode 0 presence and whether every mode-0 descriptor keeps at least
one subordinate row. The stream-load side is
tighter in the same way: the constructor-side load owner
structure_candidate_collection_construct_and_stream_load_runtime_records 0x004131f0
seeds global pool 0x0062b268 and immediately re-enters the broader collection importer
structure_candidate_collection_stream_load_rebuild_runtime_summaries_and_refresh_named_availability
0x00412fb0. That owner streams each packed candidate body back through
structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state 0x004120b0, then
reruns the same scenario-side recipe projection at 0x00412d70, the same stem-policy sweep at
0x00412ab0, the collection aggregate subtotal pass over [pool+0x8c..+0x9c], rebuilds the
fixed name catalog at 0x0061dbc2/0x0061dc09 for non-subtype-1 zero-availability candidates
with live ids <= 0x6e via localized string 0x0b53, and only then re-enters the same
named-availability refresh at 0x00412c10 before returning. The broader scenario-state reset
side is explicit now too: 0x00436d10 is the shared reset-and-rebuild owner beneath startup and
world-entry paths. It zeroes the late scenario-state bands, seeds the fixed year defaults and
chairman-slot rows, rebuilds the two named availability collections at [state+0x66b2] and
[state+0x66b6], re-seeds the twelve recipe books at [state+0x0fe7] from the fixed template
at 0x005c9f78, refreshes selected-year state through 0x00409e80, 0x00433bd0,
0x00435603, and the year-gap scalar helper 0x00434130, and only then re-enters
0x00435630, 0x0041e970, 0x00412bd0, and 0x00436af0. The startup side is tighter now too:
0x00438890 does not jump straight into one selector-specific file-load branch. It first
re-enters 0x00436d10, mirrors one shell-managed label list from 0x006d4020+0x429b0 into local
state, allocates the common runtime pools (0x0062ba8c, 0x0062b268, 0x0062b2fc,
0x0062ba88, 0x006ada84, 0x0062c120, 0x006cfcbc, 0x0062be10, 0x006ceb9c,
0x006cea4c, 0x006acd34, 0x0062b244), and pre-seeds named locomotive-availability rows
through 0x004350b0 before the profile selector at [profile+0x01] chooses tutorial,
setup-generation, or file-load lanes. The neighboring placed-structure
side is bounded too: global pool 0x0062b26c comes from
placed_structure_collection_construct_empty_runtime_pool 0x00413230, while the paired tagged
collection owners 0x00413280 and 0x00413440 now own the broader placed-structure stream
load/save path around tags 0x36b1/0x36b2/0x36b3 and the per-entry virtual load/save slots
+0x40/+0x44. The adjacent collection pass 0x00412ab0 is tighter in
the same way: it now reads as a pure stem-policy sweep that refreshes candidate dword [+0xbc]
from defaults 0x1869f/3/4 plus the fixed override table at 0x005edca8..0x005edd20, with the
non-default 3/4 branches driven directly by post-import flag [candidate+0x78c] and subtype
byte [candidate+0x32]. The stream-load side is tighter too: 0x004120b0 now clearly reads the
fixed header fields first, allocates the descriptor strip as count*0xbc + 1, zeroes every
loaded 0xbc descriptor slot before import, resolves primary mode-0 cargo names from
+0x08 -> +0x1c and subordinate row cargo names from +0x30 -> +0x44, clamps descriptor start
year [desc+0x20] upward to the resolved cargo availability floor [cargo+0x21], and only then
reruns 0x00411ee0 plus 0x00411ce0. Its version gates are explicit too: bundles before
0x3ed omit [candidate+0x3b..+0xbb], bundles before 0x3f2 keep the narrow 0x02-byte form
of [candidate+0xc0], nonzero [candidate+0x4b] forces [candidate+0x47] = 1.0 and rescales
[candidate+0x43] to at least 0x1388, and the later stem-index resolution first checks two
built-in alias stems before the full fixed row table at 0x005ed338..0x005edca4. The
current local file-side result is now tighter too: the
grounded recipe-book root at 0x0fe7 is preserved byte-for-byte across the checked map/save
scenario pairs, so the loader can safely treat the twelve 0x4e1-byte books as preserved
scenario payload rather than a drifting save-only band. A conservative summary probe now only
reports per-book head signatures, raw cap dwords at +0x3ed, and five raw line summaries rooted
at +0x3f1 so the file-side structure stays aligned with this grounded ownership. The
player-facing line modes remain Disabled, Demand Only, Supply Only, and
Production Demand->Supply, and the fourth mode is tighter now too: current wording around
1674, 1675, and 504 plus the downstream scaling path says it is the
production-line mode governed by the shared annual production cap, where the entered annual amount
stays on the supply side while the demanded side becomes the normalized input branch. The
candidate-side accumulator pass reinforces that split by applying the shared production cap only
to the supply-half runtime branch and bypassing that scaling on the normalized demand half. The
lower gameplay side is tighter now too: structure_candidate_query_cargo_runtime_summary_channels
0x00412650 is the first grounded consumer beneath that rebuild chain, because it lazily rebuilds
four per-cargo summary banks and returns one direct primary-cargo scalar channel, one cap-share
primary-cargo scalar channel, one nonzero-mode subrow channel, and one zero-mode cap-scaled
subrow channel for a requested cargo id. The internal indexing is tighter now too: the two
primary-cargo banks index from [desc+0x1c], while both subordinate-row banks index each row
directly from [desc+0x44+row*0x1c]. The mode split is tighter in the same way: nonzero-mode
descriptors bypass the primary-cargo banks entirely and only feed the nonzero-mode subrow bank,
while mode-0 descriptors either add their direct scalar to [this+0x03a] or, when subrows are
present, add one cap-share scalar to [this+0x0a4] and one cap-scaled row contribution to
[this+0x178]. There is still no post-resolution failure guard between the importer writes and
the summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if
the imported low-16 marker rows fail the exact matcher at 0x0041e9f0, the resulting 0 ids
will still hit the first summary-bank bucket inside 0x00412650, but the semantic meaning of
cargo id 0 itself remains ungrounded. So the remaining gap here is semantic only, not another
missing import or rebuild owner. The sibling helper
structure_candidate_supports_or_references_cargo_id
0x004129d0 then uses those same banks plus the cached cargo-membership arrays to answer whether
a live candidate materially references a cargo at all. One compare step tighter, the raw line
lanes now split cleanly by scenario family while still preserving map->save identity inside each
checked pair. Alternate USA.gmp and Autosave.gms match at the raw line-content level: books
0..4 keep mixed line areas, their line02 slots carry the recurring nonzero mode words
0x00110000, 0x000b0000, 0x000b0000, 0x00130000, and 0x00180000, and the same line02
slots also carry one recurring supplied token 0x000040a0; the neighboring line00/line01
slots carry the same recurring demanded token lanes such as 0x00010000, 0x72470000,
0x6f430000, 0x694c0000, and 0x694d0000. Southern Pacific.gmp and p.gms also match at
the raw line-content level, but the same rooted line slots stay zero in the checked pair.
Spanish Mainline.gmp and g.gms again match at the raw line-content level yet carry a distinct
nonzero pattern: books 0..4 keep mixed line areas, line-level supplied tokens include
0x00170000, 0x00150000, 0x00004040, and 0x00004000, demanded tokens include
0x00010000, 0x68430000, and 0x6c410000, and the later line02 mode words stabilize at
0x00070000 then 0x00010000. So the loader can now safely treat these raw line lanes as
preserved scenario payload with family-specific signatures, even though the exact cargo-id and
mode-enum semantics still need separate grounding. One inference is tighter now too: when those
demanded-token words are zero in the low 16 bits and printable in the high 16 bits, the byte
order reads as short two-letter stems such as Gr, Co, Li, Mi, Ch, and Al, which fit
the current scenario cargo-name families Grain, Corn, Livestock, Milk, Cheese, and
Alcohol from RT3.lng; the runtime probe now exposes those only as probable ASCII stems, not
as fully grounded cargo-id decodes. The supplied-token side is now bounded as a separate layout
family rather than forced into that same stem model: the Alternate USA family uses one stable
low-16 marker 0x000040a0 only in book00..04.line02, the Southern Pacific family leaves the
supplied lanes zero in the checked pair, and the Spanish Mainline family splits between two
high-16 numeric tokens 0x00170000 and 0x00150000 in book00/01.line01 plus the later low-16
markers 0x00004040, 0x00004000, and 0x00004040 in book02..04.line02. The probe now
exposes those conservatively as token-layout classes high16-ascii-stem, high16-numeric, and
low16-marker, without claiming that the non-stem numeric or marker families are decoded yet.
One more structural layer is stable enough to name conservatively: the checked nonzero recipe
rows repeatedly fall into four line-signature classes. Alternate USA books 0..4 all expose
one demand-numeric-entry at line00 (0x00010000), one demand-stem-entry at line01
(Gr/Co/Li/Mi stems), and one supply-marker-entry at line02 (nonzero mode plus
0x000040a0). Spanish Mainline books 2..4 expose that same three-line pattern with
Ch/Al stems and the 0x00004040/0x00004000 marker family, while books 0/1 only expose the
earlier supply-numeric-entry form at line01. So the loader can now distinguish recurring row
roles such as demand-stem versus supply-marker without pretending the marker payloads themselves
are decoded. The importer-side branch map is tighter now too because local objdump over
0x00435630 shows that only nonzero mode dwords materialize into 0xbc runtime descriptors:
mode 0 lines are skipped entirely, mode 1 enters the demand-only branch, mode 3 enters the
dual demand-plus-supply branch, and every other nonzero mode falls into the supply-side branch.
In the checked corpus that means the recurring demand-numeric-entry and demand-stem-entry
rows in Alternate USA and Spanish Mainline are preserved scenario-side line records but do
not become live runtime descriptors, while the later supply-marker-entry rows are the ones that
actually reach the runtime import path. The runtime probe now exposes that directly as
imports_to_runtime_descriptor plus one conservative runtime_import_branch_kind.
The raw token windows beneath those branch labels are tighter now too. The checked mode-zero
demand rows preserve string-bearing windows at line+0x1c, and the current probe shows those
conservatively as prefixed ASCII previews such as ..Grain, ..Corn, ..Livestock, and
..Milk; local objdump now grounds 0x0041e9f0 itself as
cargo_collection_find_entry_by_exact_name, a direct exact-string walk over the live cargo
collection at 0x0062ba8c. The importer at 0x00435630 feeds both token lanes through that same
matcher after one conservative in-place cleanup pass: empty strings are replaced with the first
live cargo name, and mode 3 loops until the supplied and demanded token strings no longer
compare equal. By contrast, the imported supply-marker-entry rows still feed nonprintable
windows such as .@... from line+0x08 through that same exact matcher, and the resolver path
currently shows no special-case decoding for those marker forms. So the strongest static read is
now: the stem-like demand rows preserve cargo-name text but are skipped because their mode is
zero, while the nonzero imported marker rows are the live descriptor inputs yet likely fail exact
cargo-name resolution unless another upstream transform exists.
The wrapper layer above that query no longer looks like a hiding place for special treatment
either. Local objdump now shows 0x00412960 simply summing the two supply-side floats returned
by 0x00412650, while 0x004129a0 returns the single zero-mode cap-scaled subrow lane directly;
neither wrapper checks for cargo id 0 after the query returns. The broader world-side
accumulator at 0x0041e7be is tighter in the same way: it calls 0x00412650, requires all four
returned channels to be positive before continuing, queries one linked-instance count through
0x00413940, scales the direct-primary, cap-share-primary, nonzero-mode-subrow, and
zero-mode-cap-scaled-subrow lanes by that count, and then writes the finished quartet into
candidate dwords [candidate+0x8e/+0x92/+0x96/+0x9a] while stamping
[candidate+0x8a] from current world field [0x006cec78+0x15]. So the current strongest read
remains structural rather than semantic: unresolved marker rows can still propagate through the
first bank bucket, but the first place that meaning matters is a normal positivity-gated
cargo-channel consumer, not a dedicated null-cargo branch.
The caller side is narrower than before too. The steady-state site bitset owner
placed_structure_rebuild_candidate_cargo_service_bitsets 0x0042c690 starts its inner cargo
loop at id 1 and only walks upward through the current live cargo count, so it never
intentionally queries cargo id 0. The broader placed-structure sweep around 0x00452e60
tightens the same boundary from above: when the requested cargo id is nonzero it resolves the
backing candidate and enters structure_candidate_supports_or_references_cargo_id, but when the
requested id is exactly 0 it skips that cargo-reference helper entirely and falls through to a
different linked-site or station-or-transit gate. Current local objdump now shows that bypass
first requiring one subtype latch through the placed-structure vtable +0x70, then resolving the
linked site id at [site+0x2a8] through the placed-structure collection 0x006cec20, and then
forwarding that linked peer into the narrower predicate at 0x0047fd50. That narrower helper is
tighter than before too: it resolves the linked peer's backing candidate through the peer site id
at [peer+0x04], reads candidate class byte [candidate+0x8c], and returns true only for the
first three class values 0/1/2 while rejecting 3/4 and anything above 4. So current local
callers treat cargo id 0 as a nonstandard request bound to one linked-site reachability or
classification side path, not one ordinary cargo lane they routinely probe.
The vtable-+0x70 latch itself is bounded a bit better now too. It still lacks a direct field
decode, but every local callsite we checked around 0x0040d230, 0x0040dba0, 0x0040dbf0, and
0x0040f670 uses that slot only as the precondition for touching [site+0x2a8] and the
neighboring linked-site helpers 0x0047dda0, 0x0047fd50, and 0x004138b0. That makes the
safest current read a linked-site-bearing or linked-site-capable latch, strongly aligned with the
subtype-1 construction lane that is the only grounded writer of [site+0x2a8], rather than a
broad cargo or route-style predicate.
The neighboring maintenance pair tightens that linked-site read further. Local objdump now
shows 0x0040dba0 and 0x0040dbf0 as complementary tiny helpers that each require the same
vtable-+0x70 latch, resolve optional linked peer id [site+0x2a8] through 0x006cec20,
forward that linked peer (or null) into 0x0047dda0, and then mirror opposite values into local
byte [site+0x42] (0 for 0x0040dba0, 1 for 0x0040dbf0). The route-entry side beneath
them is tighter too: 0x0047dda0 reads route-entry anchor id [peer+0x08], resolves that anchor
through 0x006cfca8, and only dispatches one of two route-entry vtable calls when
0x0048a090(1) reports that all three anchor-slot dwords [entry+0x206], [entry+0x20a], and
[entry+0x20e] are still -1. So the strongest current read is no longer just "linked-site
capable" in the abstract: this latch consistently fronts the local linked-peer class gate
0x0047fd50, the paired [site+0x42] route-entry state toggles, the route-link cleanup sweep
0x004138b0, and the later linked-peer collection families 0x004139a0, 0x00413a00,
0x00413aa0, and 0x00413b40, which count linked peers that pass the station-or-transit gate,
narrow that same subset to candidate class 3/4, or stay on the subtype-4 side and only
inspect raw linked-instance candidate byte 0xb9.
That keeps the cargo id 0 bypass path firmly on the linked-site route-anchor or classification
side rather than on an ordinary cargo lane.
One smaller ownership boundary is tighter too: byte [site+0x42] is not private scratch owned
only by that pair. Local objdump shows tiny direct setters at 0x0040cbc0 and 0x0040cbd0
plus a raw getter at 0x0040cbf0, so the 0x0040dba0/0x0040dbf0 pair is writing one shared
placed-structure state byte rather than inventing a route-entry-only scratch lane. One caution
is tighter now too: there are later mode-gated reads at other addresses that also touch a
+0x42 byte on their own object layouts, but current local evidence does not yet prove those are
the same placed-structure owner family, so the safest current note keeps only the immediate
0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0 cluster grounded together.
The vtable side sharpens that split too. A local .rdata scan shows 0x0040dba0 and
0x0040dbf0 each appearing exactly once, together with 0x0040cbf0, in one method table rooted
at 0x005c8c50; the constructor chain is tighter now too, because 0x0040c950 installs that
same table as one concrete placed-structure specialization above the common base table
0x005cb4c0, while 0x0040c970 tears the same specialization back down to the base before the
temporary object is freed. By contrast the raw set or get trio
0x0040cbc0/0x0040cbd0/0x0040cbf0 also appears in several sibling tables such as 0x005c9750
and 0x005dd1f0. So the strongest current structural read is that byte [site+0x42] belongs
to one broader placed-structure virtual interface, while the linked-peer route-entry toggles are
one specialization-specific override pair inside that family rather than generic setters used by
every sibling.
One negative boundary is tighter now too: the
raw token words in this recipe block do not look like the already grounded shell-side
AnyCargo/AnyFreight/AnyExpress selector-table ids from 0x00621e04/0x00621e10, so the current
best read is that these on-disk line tokens are not just copied UI selector ordinals or the same
small express-side id family in another wrapper. One broader collection pass also now ties
the editor rule side back into runtime filtering:
structure_candidate_collection_refresh_cargo_economy_filter_flags 0x0041eac0 rebuilds
per-candidate flag [candidate+0x56] across the live structure collection, and current grounded
callers show it rerunning directly off the runtime cargo-economy latch at [0x006cec74+0x25f],
which aligns this lane with the editor's Disable Cargo Economy special condition rather than
leaving it as a purely editor-owned recipe page. The first common live gate beneath that filter is
now bounded too: structure_candidate_is_enabled_for_current_year 0x0041e220 is the shared
year-and-filter check used by the collection refresh and later candidate-selection branches, while
structure_candidate_rebuild_local_service_metrics 0x0041e2b0 is a setup-side local service
scorer that already consumes the same enabled candidate records through world-grid sampling. One
steady-state world-side consumer is now grounded as well:
placed_structure_rebuild_candidate_cargo_service_bitsets 0x0042c690 walks linked placed
structures, filters live category-2 candidates through
structure_candidate_is_enabled_for_current_year, and compacts the direct and scaled supply-side
channels from 0x00412960 and 0x004129a0 into per-cargo bitsets on the placed-structure record.
The next site-side owner layer is tighter now too:
placed_structure_refresh_linked_candidate_flag4 0x0042c8f0 refreshes the sibling state bit at
[site+0x0e6], placed_structure_refresh_candidate_service_state 0x0042cdf0 ties that flag
refresh to the cargo-service bitset rebuild,
placed_structure_rebuild_candidate_local_service_tables 0x0042ce00 then performs the heavier
per-site candidate score rebuild over the aligned float and word tables at [site+0x107],
[site+0x02], and [site+0x6c], and placed_structure_refresh_local_service_score_bundle
0x0042d580 is now the local wrapper that chains that rebuild into the neighboring post-passes
before the world-grid owner continues. Those post-passes are tighter too:
placed_structure_apply_route_linked_service_caps 0x0042cc50 is the first route-backed cap pass
over the rebuilt local tables,
placed_structure_redistribute_local_service_pressure_from_neighbors 0x0042c1b0 is the
neighboring-site redistribution pass, and placed_structure_clamp_candidate_service_age_table
0x0042cb30 is the final recent-service clamp over the primary per-candidate word table. Above
that refresh lane, placed_structure_query_candidate_local_service_metrics 0x0047e240 is the
first higher-level query, placed_structure_count_candidates_with_local_service_metrics
0x0047e330 counts how many candidates currently produce that query,
placed_structure_get_nth_candidate_id_with_local_service_metrics 0x0047e620 is the ordinal
selector over that same visible candidate family,
placed_structure_query_cached_express_service_class_score 0x0047e390 caches one parallel class
score for the express family now strongly aligned with Passengers, Mail, and Troops,
placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site
0x0047eb90 rebuilds one peer-site comparison cache over the same local-service inputs, and
placed_structure_select_best_candidate_id_by_local_service_score 0x0047f910 is the best-hit
selector above the direct and directional local-service query pair. Those site-side scores now
have grounded shell read-side consumers too:
shell_station_detail_format_freight_and_express_summary 0x00506be0 formats the visible
Freight: %1 and Express: %1 lines in StationDetail.win, and the same station-detail family
now has a deeper candidate-service lane:
shell_station_detail_set_active_candidate_service_preview 0x00504ae0 stores the active
(station id, candidate id) pair for the world-side preview scan and now grounds the whole
world-side arming strip through
world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active
0x00452f60,
world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero 0x00452d80,
world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active
0x00452db0, and
world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid 0x00452ca0,
shell_station_detail_clear_active_candidate_service_preview 0x00504a90 tears that pair back
down, shell_station_detail_update_candidate_service_entry 0x00504ba0 is the shell-side entry
updater above that preview pair, shell_station_detail_format_candidate_local_service_summary
0x00504bea uses placed_structure_query_candidate_local_service_metrics together with localized
ids 681, 682, and 2813 to build the visible candidate service text,
shell_station_detail_build_to_from_haul_summary_widget 0x00505150 now grounds the paired To
and From hauled-traffic strip widgets, shell_station_detail_present_to_from_haul_stats_popup
0x00504770 owns their click-through annual and lifetime hauled TO/FROM this station popup,
shell_station_detail_refresh_nearby_structure_jump_rows 0x00505470 owns the five-row
nearby-structure jump lane, and shell_station_detail_refresh_candidate_service_rows 0x00505760
is now the larger row-list owner that enumerates active candidate-service entries and wires
shell_station_detail_update_candidate_service_entry into the per-row click path. The broader
owner above those lanes is tighter now too: shell_station_detail_window_refresh_controls
0x00506610 is the real StationDetail.win refresh pass, validating the current station from the
detail manager, publishing the upper summary lane, splitting the 0xb3b7/0xb3b8 action strip by
scenario latch [0x006cec74+0x1db], routing that scenario branch through
shell_station_detail_present_scenario_station_connection_triplet_popup 0x00504590, routing
class 3/4 sites into the alternate branch
shell_station_detail_refresh_class_3_or_4_train_service_matrix 0x00504ec0, and otherwise rebuilding the nearby-structure lane, the paired To/From widgets,
and the candidate-service rows together. The broader message side is bounded now too:
shell_station_detail_window_handle_message 0x00505e50 owns the wide StationDetail.win
switch over message ids 0, 0xca, 0xcb, and 0x3ea, routes candidate-service rows
0xb4dc..0xb5a3 into preview arm or clear or a Ctrl-modified Overview.win handoff, routes
nearby-structure rows 0xb40a..0xb413 into the detail transition and optional world-centering
path, refreshes control 0xb3f8 on the 0x3ea branch, and dispatches the lower
0xb3b5..0xb3bf action band through the selected-station ownership and class-gated helper strip.
The compact siblings under that pass are tighter now too:
shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty 0x005042c0 is the dirty
clear owner over the dynamic row bands and the paired haul widgets, shell_station_detail_has_valid_selected_station
0x00504370 is the bare selected-station validity probe, shell_station_detail_selected_station_belongs_to_selected_company
0x00504390 is the selected-company ownership gate, and
shell_station_detail_present_selected_station_not_controlled_notice 0x005043f0 is the
localized not-controlled popup beneath the same action family,
shell_station_detail_present_scenario_station_connection_triplet_popup 0x00504590 is the
scenario-latched station-to-station triplet popup that walks the current station's
0x24-byte per-destination table, skips invalid or self ids, and formats three five-byte-stepped
per-destination scalar lanes as %5.2f after dividing by 100.0, or N/C when the lane is
absent, and
shell_station_detail_refresh_class_3_or_4_train_service_matrix 0x00504ec0 is the alternate
class-3/4 branch that rebuilds the Trains Serviced / Trains Maintained matrix before
reusing the shared haul-popup callback wiring,
shell_station_detail_refresh_class_partitioned_action_controls_0xb3bb_to_0xb3bf 0x005044b0
is tighter now too: it does not just gate one vague lower strip. It partitions the lower action
row into two class-sensitive families, leaving 0xb3bb/0xb3bd/0xb3be active only when the linked
candidate class is 0, while 0xb3bc/0xb3bf stay active only when that class is exactly 1.
The
adjacent lifecycle and navigation side is tighter now too:
shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton 0x00505bf0
is the real StationDetail.win destructor, and
shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class
0x00505cb0 plus wrappers 0x00505e30 and 0x00505e40 now bound the next-or-previous station
stepping path that keeps the selection inside the same owner and station-site class family before
optionally recentering the world view. The broader shell command layer above that station-detail
branch is tighter now too:
shell_command_step_active_window_subject_forward_or_publish_contextual_notice 0x00440e00 and
shell_command_step_active_window_subject_backward_or_publish_contextual_notice 0x00440f20
are the paired next-or-previous shell commands that first prefer StationDetail.win, then the
live building-detail family, then CompanyDetail.win, and finally the sibling singleton at
0x006d3b20 before falling back to the localized notice pairs 0x017a/0x017b and
0x017c/0x017d. The adjacent direct subject-openers are tighter now too:
shell_open_or_focus_train_detail_for_current_or_first_owned_train 0x00441040 reuses current
detail subject [detail+0x78] or falls back to the first owned train for the selected chairman
company before re-entering shell_detail_panel_transition_manager with mode 2, while
shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station 0x004410d0
reuses [detail+0x80] or falls back to the first owned linked station before the same transition
manager is re-entered with mode 5. Two later registered command siblings are now bounded only
structurally but still usefully: 0x00441160 requires active scenario plus live world root
0x0062c120 and dispatches either
world_enable_preview_mode_0x15_latch_and_enter_if_idle 0x00453370 or
world_disable_preview_mode_0x15_latch_and_clear_if_active 0x00453780 by the query at
world_query_preview_mode_0x15_latch_active 0x00450150,
while 0x004411a0 requires active scenario plus live route-store root 0x006cfca8 and
dispatches either 0x00491880 or 0x004932a0 by the boolean result of 0x004934a0(0).
The next registered shell-command strip is bounded the same way now:
shell_command_toggle_shared_world_preview_global_0x62be84 0x00441240 flips the shared
preview-oriented global 0x0062be84,
shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay 0x00441260
and ...variant_1... 0x004412a0 both route through
shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay 0x00433da0,
which restyles GameUppermost.win controls 0x7923..0x7925, mirrors the chosen variant across
detail controls 0x07db..0x0837, transitions the detail manager into mode 0x19, and forwards
the selected variant into
world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty 0x0043a0a0, and
shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds 0x004412e0
re-enters scenario_state_rebuild_derived_year_threshold_band 0x004351c0 and then rewrites the
paired shell-state dwords at [0x006cec74+0x1df/+0x1e3] through 0x00482850. Those three
commands are still structurally named rather than semantically named, but the current static owner
boundaries are now explicit. The same command band is tighter at both edges too: 0x004411e0
simply flips presenter dword [0x006d4024+0x114276] when the main shell presenter is live, and
0x00441200 is the adjacent active-scenario gate that injects shell message 0xcb for control
0x9858 through
shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars 0x00538e00. The later edge
of the same shell strip is bounded too:
0x00441ac0 and 0x00441af0 are the two small active-scenario plus shell-idle wrappers over
shell_map_file_entry_coordinator 0x00445ac0, forwarding flag triplets (0,0,0) and
(0,1,0) respectively, while 0x00441b20 is the neighboring live-world clamp that ensures
[world+0x168d] never falls below [world+0x1689]. The next broader neighbor is now grounded
too: shell_command_toggle_editor_map_mode_with_one_shot_warning_modals 0x00441b50 is the
real editor-map-mode toggle owner above 0x00482e50. It branches on current shell mode
[0x006cec74+0x68], uses one-shot latches 0x0062be88 and 0x0062be8c to gate localized
warnings 0x017e and 0x0b24, and on the non-editor side can instead raise warning 0x0b6e
when 0x004349a0 reports more than one active profile. After those gates it forwards target mode
([shell+0x68] == 0) into
shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects 0x00482e50.
The adjacent time-of-day strip is grounded now too:
shell_command_increment_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar
0x00441cb0 and
shell_command_decrement_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar
0x00441d20 are the paired registered commands beneath localized ids 0x0db5/0x0db6, whose
RT3.lng captions are Increment Time Of Day and Decrement Time Of Day. Both
require active scenario state plus the same single-profile gate from 0x004349a0, clear shell
dwords [0x006cec74+0x233] and [+0x124], then adjust startup scalar [0x006cec78+0xbfa] by
+0.5 or -0.5 before re-entering
world_set_selected_year_and_refresh_calendar_presentation_state 0x00409e80 with absolute
counter [0x006cec78+0x15] and refreshing the live world view through 0x00439a80. So the
registration-side identity is now closed: these are the paired half-step time-of-day
presentation commands, not generic shell scalars and not the earlier selected-year read.
The adjacent progress-status side is tighter now too:
shell_build_percent_status_payload_clamped_0_to_100 0x00441d90 is the shared save or load
progress payload builder, and
shell_progress_callback_publish_incremental_percent_status_until_target 0x00441e20 is the
throttled callback installed at 0x00442960 through global 0x00d93988. That callback advances
the progress latches 0x0062bec8/0x0062becc/0x0062c118, rebuilds the percent payload through
0x00441d90, republishes it through 0x00538c70, and services the shell frame through
0x00482160. The surrounding 0x00445de0 callers keep that pair on the save or load progress
side of the shell strip rather than as another input-command family. The adjacent companion-image
file seam is bounded now too:
shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags
0x00441f70 and
shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path
0x004420f0 are the paired _A.tga / _A.jpg import and export helpers around the same
tagged selector strip at 0x00441ec0. Both derive an extensionless stem through
support_copy_string_stem_before_first_dot 0x0051dde0, choose the _A.tga versus _A.jpg
suffix by selector byte [record+0x09], and then shuttle the file bytes through the shared
staging descriptor rooted at 0x0062bed4/0x0062bed8. That keeps the family grounded on the same
fallback descriptor later reused by
world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback 0x00535430,
instead of leaving it as an isolated save-side file copier. The neighboring exporter
shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100
0x00442ba0 is bounded now too: it copies the live setup payload from [this+0x66be],
patches world dimensions and three shell bytes into offsets +0x01..+0x0b, and then
normalizes the embedded 0x100 x 0x100 pixel block at +0x03c2 through 0x0047a120
before the save-side callers forward that same record into 0x00441ec0 or the tagged
slot-table serializer at 0x00446312. The broader sibling
shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46
0x00442740 is bounded now too: it copies the embedded preview pixels at [record+0x03c2]
into a temporary 0x40000-byte RGBA buffer, constructs one temporary 0xec-byte surface-like
owner through 0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 ), forwards the caller path
plus fixed selector 0x46 into 0x00542f50, stores the returned dword into payload field
[record+0x18], and then releases the temporary owner again through 0x00542c90 and
0x0053b080. That keeps the short save-side branch at 0x00445925 grounded as a one-shot
preview-surface query helper rather than leaving another anonymous image-copy leaf between the
tagged export path and the progress notice strip. The broader sibling
shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback
0x004427c0 is now bounded as the temporary-path owner above that same tag strip: it derives
%1.tmp from the source path, installs progress callback 0x00441e20 in 0x00d93988,
rewrites the middle payload band rooted at +0x03ce through 0x00553000, writes the result
back out through 0x005a276f, updates payload dword [record+0x18], and only then re-enters
0x00441ec0.
The sibling shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags
0x00442900 is bounded now too: it takes the live payload record in EAX, reads the full
companion file named by the caller path, installs the same progress callback, rewrites the
middle payload through 0x00553000 using stored offsets [record+0x18/+0x1c], and then writes
the output back in four spans: the leading 0x03ce bytes, the transformed middle payload, the
untouched interval [record+0x18 .. record+0x1c), and the remaining tail. It then stores the
caller path back into [record+0x18] and re-enters 0x00441ec0. That closes the offset-driven
save-side sibling reached from 0x004459dd after 0x00441f70, so the companion-payload strip
is no longer split between one named temp-path owner and one anonymous offset-band rewrite body.
The underlying temporary-surface seam beneath those save-side helpers is bounded now too.
surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type 0x00541b10
scans the eight-entry row band [this+0xa0..+0xbc], allocates one 0x32-byte row, seeds width,
height, and type, and returns the chosen slot index; 0x00541ba0 is the indexed release-side
companion. surface_owner_open_named_resource_and_dispatch_row_type_import 0x00542f50 is the
named-resource dispatcher used by 0x00442740: it opens the caller-seeded resource path,
forwards the result into 0x005428c0, and then dispatches by imported row type
[row+0x18] = 2/3/4. surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish
0x005438d0 is the commit-side publish helper over the active RGBA backing buffer
[row+0x26], while surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode
0x00543980 is the constructor or ensure owner that allocates one first-use slot through
0x00541b10(..., width, height, 3) and then commits the caller pixels through 0x005438d0.
That keeps the save-side preview seam tied back to the same reusable surface-owner family already
visible in the world-presentation and shell-overlay branches, instead of leaving the temporary
preview query path grounded only at the leaf helper level.
The lower surface-owner base is bounded now too. surface_owner_base_init_and_register_on_global_list
0x00540e30 seeds the fixed owner label, capability bytes, helper-object pair, row-slot bands,
and global intrusive registration under 0x00ccbb2c; surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers
0x00540fc0 is the shared maintenance owner that recomputes cached byte totals [this+0xcc/+0xd0]
across the eight row slots and also owns the full row-buffer release pass; and
surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate 0x00541210
is the row-side repack body that converts the active backing pixels into the live 16-bit buffer
[row+0x2a], either through a palette-like accumulated-channel path or a direct nibble-packed
conversion path depending on owner byte [this+0x96]. That closes the reusable surface family
one layer deeper instead of stopping at the first slot allocator and commit helpers.
The two remaining compact helpers in that same seam are bounded now too.
surface_owner_query_dimension_cap_from_mode_and_quality_band 0x00541160 derives the active
power-of-two size cap 0x100/0x200/0x400/0x800 from owner byte [this+0x05], shell gate
[0x006d4024+0x11422f], and selector dword [this+0xd8], while
surface_owner_probe_named_file_for_type2_header_signature 0x005411c0 is the adjacent file
probe that opens one named path, reads 0x12 header bytes, and accepts only the local type-2
signature. The broader survivor above them is bounded now too:
surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream 0x005428c0
allocates temporary alpha and RGB planes from the active row, splits the current backing pixels,
seeds the local codec object, and then writes the tagged record family 0xbaba/0xbabb/0xbabe
into the already-open stream, either directly or through the transformed payload path via
0x00553000. That closes the immediate import-export seam under 0x00542f50; the next open
work in this branch is no longer a still-missing leaf, but the broader type-specific row owners.
Those are bounded now too. surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer
0x00541c30 is the type-4 importer that validates the 0xbabe lead tag plus the later
0xbaba/0xbabb branches, reconstructs one RGBA row from the tagged payload bands, and then
re-enters 0x00541210. surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer
0x00542030 is the type-3 importer that validates the recovered width, height, and pixel-size
header, allocates a full RGBA destination plus temporary staging, and decodes the supported
0x18/0x20 source families into RGBA rows. surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer
0x00542d50 is the type-2 importer: it validates DDS , enforces the dimension cap from
0x00541160, copies the block-compressed payload from offset 0x80, stores format tag
DXT3, and optionally materializes the live companion buffer through 0x005423d0.
That closes the current type-dispatch branch under 0x00542f50 without leaving its three row
owners as anonymous stream bodies.
The direct export-side sibling is bounded now too.
surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file 0x00542b30
is the paired file-write alternative to 0x00542f50: it opens one caller path in wb mode,
builds the compact 0x12-byte header with row type 2, first-row width and height, fixed
pixel-size byte 0x20, and one optional 0x20 flag bit from the second caller argument, then
optionally forces RGBA materialization through 0x00541970 and writes the first-row RGBA payload
[row+0x26] plus that header to the open stream. The paired callers at 0x00520cda,
0x00520f61, and 0x00534dd6 all use it as the direct-file branch immediately before the same
temporary-surface release through 0x00542c90 + 0x0053b080, so the current export/import seam is
no longer split between one named importer and one anonymous file-write sibling.
The small dispatch sub-strip under that importer is bounded now too.
surface_owner_dispatch_row_import_by_embedded_type 0x00542fb0 is the direct selector over
embedded row type [row+0x18], routing type 2/3/4 to 0x00542d50/0x00542030/0x00541c30.
The wrapper immediately above it,
surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure 0x00543000,
clears selector field [this+0x07], allocates one fresh row slot through 0x00541b10,
re-enters 0x00542fb0, drops the slot again through 0x00541ba0 on the 1/2 failure paths,
and then refreshes cached byte totals through 0x00540fc0. That closes the type-dispatch seam
between the file-open owner and the per-row import bodies instead of leaving one more anonymous
slot wrapper in the middle.
The lower lifecycle in that same surface-owner family is tighter now too.
surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row 0x00541970 is the
shared query-or-materialize helper for non-type-2 rows: it optionally returns width and height,
returns [row+0x26] when RGBA backing pixels already exist, and otherwise expands the live
16-bit source buffer [row+0x2a] into nibble-doubled RGBA dwords before storing the new backing
pointer back into [row+0x26]. The broader sibling
surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers 0x00542550
is the next owner above that helper: when shell capability byte [0x006d4024+0x11422d] is live
and local latch [this+0x95] is still clear, it revisits the active row slots, skips type-2
and already-processed rows, forces RGBA materialization through 0x00541970, marks row byte
[row+0x21], seeds row state [row+0x1c] = 0x3c, discards the previous 16-bit output buffer,
and rebuilds [row+0x22/+0x2a] from a float-heavy neighbor-difference transform over the RGBA
source, halving [row+0x04] on the 0x20-pixel-size branch. The release-side owner is bounded
now too: surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots 0x00542c90
releases optional helper roots [this+0xdc/+0xe4], unlinks the owner from the global intrusive
list rooted at 0x00ccbb2c, conditionally refreshes the live shell presenter when [this+0x93]
is set, and then drops both the selector-side handle and all row slots through
0x00541780 and surface_owner_release_all_row_slots_0xa0 0x00542870. That closes the
reusable surface-owner seam one level deeper instead of stopping at construction, import, and
commit helpers.
The remaining tiny surface-owner leaves in that strip are bounded now too.
surface_owner_query_first_row_width_or_one 0x00541aa0 and
surface_owner_query_first_row_height_or_one 0x00541ad0 are the fallback-safe first-row
geometry getters used by later projection and world-presentation math paths, while
surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0 0x00541bf0
simply refreshes cached scalar [this+0xd4] from the live shell presenter and returns
[this+0xc0]. The last tiny release helper surface_owner_release_selector_handle_0x07_if_present
0x00541c10 does exactly what the current name says: when [this+0x07] is live it re-enters
0x00541780 and clears that handle back to zero.
The later owner shell_apply_scenario_name_specific_post_load_world_and_object_fixups
0x00442c30 is bounded now too: world_entry_transition_and_runtime_bringup re-enters it at
0x00444b50 with the loaded scenario title, and it dispatches on many fixed .rdata names
including Go West!, Germany, France, State of Germany, New Beginnings, Dutchlantis,
Britain, New Zealand, South East Australia, Tex-Mex, Germantown, The American,
Central Pacific, and Orient Express, with several branches further gated by setup payload
byte [this+0x66de]. The matched branches then perform targeted live-world edits rather than a
generic title-side publish: they patch object-state dwords and bytes inside collections rooted at
0x0062be18, 0x0062bae0, and 0x006ada80, adjust selected float and scalar fields, copy
paired ten-dword record blocks when specific name/class pairs match, flip secondary-raster bits
through table 0x005ee508..0x005ee5cc, retune a later collection at 0x0062b268, and inject
scenario-specific text lines into the shell-owned band [this+0x4f30] through repeated
0x0051e5d0. That finally makes the broad post-load scenario-fixup seam explicit instead of
leaving it as an unbounded string-switch body beneath world entry.
One neighboring status helper is bounded now too:
shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks 0x00442660 is the
shared byte-delta and elapsed-time notice builder used by both the bundle-service strip and the
save-side progress loop. It measures the current byte counter through 0x00530b70, formats the
rounded kilobyte delta and elapsed ticks through %5d and % 4d, packages them through
0x005193f0 -> 0x00518de0 -> 0x0051d680, and then updates the running previous-counter latch
0x0062c11c.
That setter writes [shell+0x68], then either rebuilds the editor-side shell surface through
0x004d4500 or refreshes the detail-panel and world side through 0x004d44a0, 0x004dfda0,
and 0x0044fb70, before both branches pulse graphics side effects through 0x00484d70(0x0d, 1).
The adjacent display-settings strip is bounded now too:
shell_command_cycle_display_resolution_forward 0x00483680 is the registered +1 command
wrapper into shell_cycle_display_resolution_and_publish_status 0x00483780, while
0x00483990 and 0x004839a0 are the plain +1 and -1 wrappers into that same shared owner.
The owner requires the live shell presenter 0x006d4024, walks the supported resolution tables
at 0x00620e64/0x00620e7c, applies the chosen size through 0x005206b0, publishes the updated
size string through 0x0051b700, 0x00518de0, and 0x005386e0, and then refreshes dependent
presentation state through 0x004625b0, 0x00484910(1), and 0x004821d0. After that point the
embedded world-view controller strip is tighter now too.
world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet
0x00439820 samples a five-point local clearance ring around the current eye X/Z pair through
0x00534490, keeps the highest sample, expands it through 0x0052d0c0 plus fixed margins, and
republishes the eye triplet through 0x0052d1e0 when the current eye height needs to be lifted.
The embedded controller base beneath that path is now first-class instead of only being referenced
indirectly: 0x0052d140 stores the four blend scalars at [+0x50..+0x5c], 0x0052d180 stores
the focus triplet and raises dirty byte [+0x64] when it changes, 0x0052d1e0 stores the eye
triplet and refreshes sampled vertical delta [+0x66], 0x0052d230 extracts focus-to-eye
distance plus heading/pitch-like angles, 0x0052d2b0 serializes the focus, eye, and orientation
lanes into one camera-view snapshot record, 0x0052d400 is the inverse helper that rebuilds the
focus triplet from eye, heading, pitch, and distance, 0x0052d450 rebuilds the eye triplet from
focus, heading, pitch, and distance, 0x0052d640 clamps distance against sampled eye height,
0x0052d750 is the stream-load companion that rehydrates one stored camera-view snapshot back
into the controller base, and 0x0052d570/0x0052d5a0/0x0052d6f0/0x0052d860 are the
base-reset, default-seed, seed, and reset-plus-seed constructor owners. One level higher,
the compact accessor and dirty-latch strip is bounded now too: 0x0052cd20/0x0052cd60 export the
current eye triplet as packed or split outparams, 0x0052cd40/0x0052cd80 do the same for the
focus triplet, 0x0052cda0/0x0052cdc0 are the matching load-store helpers for auxiliary triplet
[+0x2c..+0x34], 0x0052cde0/0x0052ce20 snapshot the current focus, heading, and distance bands
into the two cached companion strips when their paired dirty latches are cleared, and
0x0052ce70 refreshes shell presenter scalar [+0x6a] while consuming the primary dirty latch
back to zero; the next compact query strip is bounded now too: 0x0052cea0 exports heading and
pitch lanes [+0x10/+0x14], 0x0052cec0 samples owner height at current eye X/Z,
0x0052cf00 broadens that into a clamped XY-extent peak-height query, 0x0052d0c0 is the
current-eye wrapper into that peak-height query, and 0x0052d0f0 is the normalized scalar-band
containment predicate over [+0x50..+0x5c]. One level higher,
world_view_refresh_dependent_projection_visibility_and_presentation_scalars 0x0043bde0
now bounds the larger refresh pass that derives visibility and presentation-side scalars from the
current focus and eye triplets before later motion and input branches resume. The load-side owner
one layer above that strip is bounded now too:
world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars 0x0043ac30
releases any pending helper handle, clears presenter ownership, resets the local controller strip,
rehydrates one stored camera-view snapshot through 0x0052d750, conditionally loads one
extra-row band into [this+0x10e], reseeds the four controller blend scalars through
0x0052d140(0, 0, 1.0, 0.7), and then normalizes heading before control returns to the broader
world-view owner family. The adjacent low-side layout-state strip is bounded now too:
0x00544290/0x00544360 publish or reset the local descriptor blocks rooted at
[layout+0x352f] and [layout+0x34ef]; the next setter strip 0x00544cb0..0x005450a0
publishes or clears bound-node property pairs 0x0d/0x0e, packed property 0x3c, grouped
property 0x0b, the broader capability and mode-gated slot strips
0x1d/0x13/0x14/0x12 and 0x15/0x1a/0x11/0x10, plus the cached-byte-backed property 0x89;
and 0x005450c0/0x005450e0/0x00545130 export the cached local block [layout+0x24f0] and the
negated local scalar triplet [layout+0x2517/+0x251b/+0x251f], with the middle lane clamped up
to 0.5f. One level lower, 0x00545180 builds the generated default preset table rooted at
[layout+0x840] as 0x90 fixed 0x33-byte rows from an angular sweep, while
0x00545400/0x00545470/0x005454a0 are the adjacent indexed row setters and query helpers over
that same table and 0x00545420/0x00545440 are the paired scalar-array siblings for
[layout+0x25f7/+0x25ff]; the next local strip 0x005457c0/0x005458a0/0x005458d0 publishes
one property-0x8b stack descriptor on the bound node and borrows or releases the current
segment-record window handle [layout+0x265b] with global counter 0x00ccd824; the immediate
sibling wrappers 0x005459f0/0x00545a20/0x00545a40/0x00545a70/0x00545aa0/0x00545ac0/0x00545af0/0x00545b90/0x00545bb0/0x00545be0
repeat the same borrow-release pattern for the adjacent table handles [layout+0x2643/+0x2647/+0x264b/+0x264f/+0x2653/+0x263f].
The last clean local leaves after that are 0x00545ca0/0x00545d50/0x00545d60/0x00545db0/0x00545e00,
which cover the first-slot clear plus type-1 span commit, the accumulated span counter query,
the counter reset and optional bound-node reseed, the bound-node finalize-and-optional-clear
helper, and the small bound-node signature classifier. One level up, the next owner body is
bounded now too: 0x00545e30 queries one external/provider report and builds summary text in
buffer [layout+0x43c], falling back to localized id 0x73 when the provider lookup fails and
otherwise appending the localized fragment strip 0x74..0x7d plus the fixed format family
%1(16-bit HW) / %1(8-bit HW) / %1(8-bit) / %1(16-bit) from the returned report. The
adjacent reset-and-property strip is also tighter now: 0x005464d0 runs one repeated four-pass
bound-node reset sequence, 0x00546540/0x00546560 force property 0x17 to 7 or 4,
0x00546580/0x005465a0 clear or raise property 0xa8, 0x005467a0/0x005467e0 are the paired
one-bit gate writes for property 0x1c, and 0x00546810/0x00546850/0x00546890 are the
template-gated and clear-side mode writes for property 0x16 via local mode byte
[layout+0x254a]. One level higher again, 0x0054a0c0 is now bounded as the broader setup-side
owner above that strip: it binds one external source onto the bound presentation node, falls
back to the midband release helper when that bind fails, conditionally reapplies the cached
gamma-ramp scalar from [[layout+0x83c]+0x2f], seeds optional handle [layout+0x33ab] through
the small 0x00570fbd -> 0x00570f86 refcounted 0x14-byte object helper pair, which now opens
into a tighter row-container family: 0x0057091d reserves one 0x40-byte row block from the
fixed template 0x0056cd2c, with 0x005708ce/0x005708f2 as the aligned block alloc/free
helpers, 0x00570908/0x005709da as the destructor and release-side wrappers,
0x00570fa1 as the direct refcount-drop path, 0x0057098b answering only IUnknown plus one
custom IID, and 0x005709f6 as the first grow-and-duplicate-last-row owner. The next
current-entry strip is also bounded now:
0x00570aac seeds the current 0x40-byte entry to an identity 4x4 matrix, 0x00570b0d
stores one caller matrix directly into that current slot, and 0x00570b2c/0x00570b76 are the
two immediate left/right composition siblings over the same current matrix through
0x0056d3cd. One level wider, the same family now has three helper-generated matrix-pair
variants too: 0x00570bc0/0x00570c2f build a temporary matrix through 0x0056df7d,
0x00570c9e/0x00570d1a do the same through 0x0056e1a8, and 0x00570d96/0x00570e12 plus
0x00570e8e/0x00570f0a do the same through 0x0056dc9a and 0x0056dd2a, with each pair
preserving the same right- and left-side current-matrix composition split. The adjacent helper
region is now bounded as one sibling COM-style object pair too: 0x0057aef3/0x0057aedb/0x00571016
are the init, refcount-drop, and release-side wrappers for vtable 0x005def30, with
0x0057ad5a as the direct addref helper,
0x0057ad20 as its destructor and 0x0057ae97 as its IUnknown plus custom-IID query gate,
0x0057ad67 as its resource-field bind plus attached-object and payload-copy owner,
0x0057add4/0x0057adfb as the attached-object getter and fixed payload copy-out helpers, and
0x0057ae0f/0x0057ae1e/0x0057ae2d/0x0057ae53/0x0057ae79/0x0057ae88 as the direct pass-through
wrappers over resource field [+0x48] and payload block [+0x08],
while 0x0057af0e/0x00571032 are the destructor and release-side wrapper for sibling vtable
0x005def5c, with 0x0057af4e as the matching addref helper, 0x0057af5b as the target-attach
plus cached-flag derivation owner, 0x0057afd0 as the target getter, and 0x0057aff6 as the
one-shot target-handle release helper, 0x0057b021 as the paired two-handle clear path,
0x0057b065 as the matching IUnknown plus custom-IID query gate, 0x0057b0a9 as the
refcount-drop helper, 0x0057b0c1 as the first broader target-handle and property-strip
seeding owner, and 0x0057b4fd as the next target-side transform-block builder over optional
anchor pairs plus caller angle and scale. The resource-field branch under 0x0057ae0f..0x0057ae88
is now tighter too: 0x00580867 is the small constructor-style init for the 0xb0-byte
target-service object, clearing the embedded entry-band roots, ready byte, auxiliary handle
fields, and cache link; 0x005808b2 is the matching full destructor, releasing the two
target-bound service handles, both embedded eight-entry bands, attached object, target, the
auxiliary handle family rooted at [+0x6c/+0x98/+0x9c/+0xa8], and then unlinking the object
from the global cache chain rooted at 0x00db89e4; 0x005809ab is the release-side wrapper for
that destructor; 0x005809c7 seeds service handles [+0x64] and [+0x68], invokes attached
object [+0x0c] through slot +0x10, republishes those two handles through target slots +0xdc
and +0xd8, and latches ready byte [+0x60]; 0x00580a54 is the paired clear-side sibling
that releases handle [+0x64] through target slot +0xd8, notifies the attached object through
slot +0x1c, and clears [+0x60]; 0x00580a84 is the broader release body over those target
handles plus the two embedded eight-entry bands rooted at [+0x10] and [+0x30];
0x00580aff is the setup-side entry-band owner that chooses one of two fixed parameter triples
from local mode byte [+0x50], seeds scalars [+0x54/+0x58/+0x5c] through 0x00570669 and
0x00570691, and dispatches live per-entry objects through slot +0x3c; 0x00580bb9 is the
small auxiliary-handle release helper over the pointer band rooted at [+0xa8]; 0x00580bdc
is the direct refcount-drop path; 0x00580be8 is the constructor-side owner that stores target
[+0x04], derives mode byte [+0x50], seeds the fixed scalar triple [+0x54] = 0x15,
[+0x58] = 0x40, [+0x5c] = 0x10, builds the entry bands, and binds the auxiliary handle
family rooted at [+0x6c], [+0x98], and [+0x9c]; and 0x00580d29 is the primary
payload-dispatch and layout-style service owner below the 0x0057ae2d/0x0057ae53 wrappers,
taking the target-service object, caller payload block, five caller arguments, and fixed
mode-variant flag while using service handle [+0x6c] plus external callbacks
0x005c81e4/0x005c8248/0x005c824c,
and 0x0058123c is the cache-or-create factory above that strip, walking the same global cache
root 0x00db89e4 for a matching target, otherwise allocating one 0xb0-byte object, running
0x00580867, and finishing construction through 0x00580be8. Immediately below that service
factory the local container strip is now bounded too: 0x005812b1/0x005812c1/0x005812cf/ 0x0058133d/0x00581371 form the reset, release, push, pop, and status helpers for one growable
dword-pointer vector, while 0x00581379/0x0058138c/0x005813bd/0x00581470/0x005814a4 do the same
for the sibling growable string-pointer vector with accumulated byte count at [+0x10], and
0x005814ac is the first owner above that string-vector family, building one newline-joined
text object from the stored strings. The adjacent object strip is now bounded too:
0x00581673/0x005815cf/0x005815dc/0x00581610 are the init, addref, refcount-drop, and release
wrappers for vtable 0x005e0bd8, 0x00581594 is the destructor, 0x005815a9 allocates the
owned text buffer, 0x005815fc/0x00581606 are the direct getters for that buffer and its stored
length, and 0x0058162c is the matching IUnknown plus custom-IID query gate. The adjacent
SIMD math strip is now bounded too: 0x00581690 applies the first two basis rows plus
translation row [+0x30] to one XY pair and stores the full vec4 result, 0x005816d0 is the
projective sibling that scales by a reciprocal derived from lane 3 and returns projected XY, and
0x00581730 is the translation-free low-64-bit sibling over just the first two basis rows,
while 0x00581770/0x00581830/0x005818f0 are the corresponding 3D XYZ helpers for basis-only,
basis-plus-translation, and projected basis-plus-translation output, 0x005819f0 is the direct
4D vec4-by-4x4 basis application helper, 0x00581ab0 is the four-row batch sibling over a full
4x4 source block, and 0x00581c00/0x00581cd0 are the shared normalize-or-zero helpers for vec3
and vec4 input. One level wider, 0x00581db0 is now bounded as the shared 4x4 inversion helper
with optional determinant outparam, 0x00582070 is the packed-output batch sibling to the
earlier four-row 4D basis application helper, 0x005821d0 is a standalone 4D cross-product-like
helper over three vec4 inputs, 0x00582280 is the unchecked vec4 normalization sibling, and
0x00582320/0x005823e0/0x00582470/0x00582520 are the first cubic-basis interpolation helpers
in the same math strip for vec3, vec2, vec4, and the first alternate-basis vec3 case.
The same family now extends cleanly through 0x005825e0 and 0x00582680 as the alternate-basis
vec4 and vec2 siblings, then into 0x00582710/0x00582770/0x005827c0 as the two-scalar affine
blend helpers computing p0 + s*(p1-p0) + t*(p2-p0) for vec3, vec4, and vec2 inputs.
The next geometry leaves are bounded too: 0x00582820 is the plane-versus-segment intersection
helper over one plane vec4 and two vec3 endpoints, 0x005828e0 is the standalone 4x4
determinant helper beside the nearby inversion body, and 0x005829b0 builds one plane vec4
from three vec3 points by cross product, normalization, and signed-distance writeout. The next
quaternion strip is now bounded too: 0x00582c30 builds one 4x4 rotation matrix from a
quaternion-like vec4, 0x00582d10 is the quaternion product helper, and 0x00582da0 is the
unchecked quaternion-normalization sibling. The adjacent plane-and-quaternion leaves are tighter
now too: 0x00582aa0 is the shared plane-driven projective 4x4 matrix builder over one plane
vec4 and one second vec4 input, 0x00582e40 is the quaternion inverse helper that conjugates
the spatial XYZ lanes and divides by squared length, 0x00582eb0 rebuilds one quaternion from a
caller 3x3 rotation-matrix block, and 0x00582fd0 builds one quaternion from three caller Euler
angles by halving them, routing the packed tuple through trig helper 0x0058aa70, and then
combining the resulting sine and cosine lanes. The next packed-row sibling strip is now bounded
too: 0x005830a0 applies one compact 3x3 basis block to one vec3 input, 0x00583160 is the
translation-bearing vec4 sibling, 0x00583220 is the packed projective vec3 sibling that scales
by a reciprocal derived from lane 3, 0x00583320 is the packed 4x4 vec4 application helper,
0x005833e0 is its four-row batch sibling over a full caller 4x4 source block,
0x00583530/0x00583600 are the packed vec3 and vec4 normalize-or-zero siblings of
0x00581c00/0x00581cd0, 0x005836e0 is the packed 4x4 inversion sibling with optional
determinant outparam, 0x005839a0 is the packed-output batch sibling of 0x005833e0, and
0x00583b00 is the packed-row sibling of the earlier 4D cross-product helper. The same packed
analogue strip now extends further: 0x00583cc0 is the packed 4x4 determinant sibling,
0x00583d90 is the packed three-point plane builder, 0x00583e80 is the packed plane-driven
projective 4x4 matrix builder, 0x00584010 is the packed quaternion-to-matrix sibling,
0x005840f0 rebuilds one quaternion from a packed 3x3 rotation-matrix block, and
0x00584210 is the packed Euler-angle-to-quaternion sibling using packed trig helper
0x0058ad50. The lower trig seam is bounded now too: 0x00583bb0 and 0x00583c30 are the two
single-angle packed axial rotation-matrix variants above the same trig layer, 0x0058ac60 is
the interleaved packed sine/cosine helper they share, and 0x0058ad50 is the wider packed
sin/cos vector generator used by the packed Euler-angle-to-quaternion helper. The MMX or 3DNow
analogue seam is bounded now too: 0x005842e0 is the quaternion-product sibling,
0x00584379/0x005843d6 are the vec4 and vec3 normalize-or-zero siblings,
0x00584489 rebuilds one quaternion from a 3x3 rotation-matrix block,
0x005848ba is the MMX or 3DNow Euler-angle-to-quaternion sibling using scalar trig helper
0x0058b660, 0x0058497f is the explicit axis-angle-to-quaternion sibling,
0x005849eb is the core quaternion slerp helper, 0x00584b22 and 0x00584baf are the next
two nested-slerp multi-control helpers, 0x00584c41 is the quaternion inverse sibling,
0x00584ca5 extracts an axis-angle-style vec4 from one quaternion, and 0x00584d4c is the
scaled-axis-to-quaternion sibling. The next broader MMX owner is bounded now too: 0x00584df1
takes four caller key quaternions, aligns neighboring keys onto a common hemisphere, converts the
two relative deltas around each interior key through the already-grounded inverse and
axis-angle-style helpers, averages those tangent-like terms, exponentiates back into quaternions,
and multiplies by the interior keys to write two inner spline-control quaternions. The immediate
plane-and-matrix seam after that is tighter now too: 0x00585b4b is the row-major MMX
translation-matrix constructor, 0x00585b9b is the MMX sibling to the shared plane-driven
projective 4x4 matrix builder, 0x00585c86 is the paired plane-reflection matrix helper, and
0x0058a988 is the shared normalize-by-XYZ-length helper beneath those plane-driven bodies, while
0x0058a8ca is the MMX origin-plane-versus-segment intersection sibling and 0x0058a9ec is the
MMX 4D vec4-by-4x4 basis application sibling. The immediate matrix seam after that is bounded
too: 0x00585d62/0x00585dc5/0x00585e23 are the three single-angle MMX axial 4x4 rotation-matrix
variants, 0x00585e7c is the MMX diagonal scale-matrix constructor rather than a translation
helper, 0x00585ec3 is the small 4x4 transpose or repack helper, 0x00585f32 is the MMX
identity-matrix constructor, and 0x00585f6b/0x0058603d are the two MMX quaternion-to-4x4
rotation-matrix variants. The adjacent broader matrix owner beneath that constructor strip is
bounded too: 0x0058584a is the non-alias-staging MMX 4x4 multiply sibling that repacks one
split-qword matrix to temporary contiguous rows before multiplying it through the second caller
matrix, 0x00585a7c is the scalar determinant helper for the upper 3x3 basis of the same
split-layout 4x4 matrix family, 0x005860f2 is the broader affine-transform owner that builds
one matrix from optional base translation, base rotation, pivoted post-rotation, and trailing
translation-delta inputs, 0x0058728a is the adjacent three-angle rotation-matrix builder that
uses half-angle trig rather than the single-angle strip, 0x0058742f is the uniform-scale
sibling that adds one optional pivoted quaternion rotation and one trailing translation delta,
0x00587963 is the axis-angle rotation-matrix sibling over a normalized axis vec3 plus one
caller angle, and 0x00587a7c is the broader shared transform owner that supports one base
translation, up to two optional pivoted quaternion rotations, and one trailing translation delta.
One lower MMX sibling strip is bounded now too: 0x005895fa is the
3D basis-plus-translation-to-vec4 sibling of 0x00581830, 0x0058966b is the basis-only vec3
sibling of 0x00581770, 0x005896d2 is the vec3 normalize-or-zero sibling of 0x00581c00, and
0x00589731 is the two-scalar affine vec3 blend sibling of 0x00582710. The next MMX
interpolation strip is bounded too: 0x005897a2 is the cubic-basis vec3 sibling of
0x00582320, 0x00589876 is the alternate-basis vec3 sibling of 0x00582520, 0x00589960 is
the projective 3D basis-plus-translation sibling of 0x005818f0, 0x005899eb is the four-row
4D basis application sibling of 0x00581ab0, and 0x0058a1aa is the cubic-basis vec2 sibling
of 0x005823e0. The remaining low-dimensional MMX strip is bounded now too: 0x0058a0b8 is the
2D basis-plus-translation-to-vec4 sibling of 0x00581690, 0x0058a10d is the basis-only vec2
sibling of 0x00581730, 0x0058a146 is the projective 2D sibling of 0x005816d0,
0x0058a242 is the affine vec2 blend sibling of 0x005827c0, 0x0058a28b is the vec2
normalize-or-zero sibling, 0x0058a2ce is the alternate-basis vec2 sibling of 0x00582680,
0x0058a379 is the duplicate-layout 4D vec4-by-4x4 basis application sibling, 0x0058a3fb is
the four-lane normalize-or-zero sibling, 0x0058a45a is the MMX 4D cross-product sibling of
0x005821d0, 0x0058a58c is the affine vec4 blend sibling, 0x0058a5fd and 0x0058a6c5 are
the cubic and alternate-basis vec4 siblings of 0x00582470 and 0x005825e0, 0x0058a7a3
builds one plane vec4 from a normal vec3 plus point, and 0x0058a7e6 is the three-point plane
builder sibling of 0x005829b0. The broader MMX matrix seam just above those leaves is bounded
now too: 0x00588eb2 is the alias-safe packed 4x4 multiply owner over two caller matrices,
0x00588bd0 and 0x005892aa are the two broader MMX 4x4 inverse helpers with optional
determinant output, 0x005895de is the thin FEMMS wrapper over 0x005892aa, 0x00589bb2 is
the tiny thunk into the projective vec3 apply helper 0x00589960,
0x00589bb7 selects identity or the ordered composition of up to three optional 4x4 inputs
through 0x005899eb, applies the resulting chain through 0x00589960, and optionally remaps
the normalized result into one caller integer viewport-style range block, 0x00589d3f is the
inverse-side sibling that composes the same optional chain, inverts it through 0x005892aa,
optionally maps one caller integer viewport-style coordinate triple back into normalized
projective space, and then applies the inverse chain through 0x00589960, and 0x00589f67 is
the adjacent inverse-projective sibling that uses alternate inverse helper 0x00588bd0 before
the same viewport-normalize and projective-apply tail. The scalar trig roots beneath the
quaternion side are bounded now too: 0x0058af80 is the shared scalar atan2-style angle
worker, 0x0058b080 is the shared scalar arccos-style angle worker, 0x0058b180 is the
adjacent alternate arccos-style branch, 0x0058b280 and 0x0058b380 are the scalar natural-log
and base-10-log helpers, 0x0058b3a0 is the scalar natural-exponential helper, 0x0058b480,
0x0058b4a0, 0x0058b4c0, and 0x0058b500 are the scalar square-root, absolute-value,
ceil-style, and floor-style helpers, 0x0058b540 and 0x0058b580 are the adjacent
frexp-style split and ldexp-style scale helpers, 0x0058b5de and 0x0058b600 are the
compact modf-style split and fmod-style remainder helpers, 0x0058b660 returns one
cosine/sine-style lane pair from one caller angle,
0x0058b780 is the paired scalar sine-lane helper used when callers only need that one branch
duplicated, and 0x0058b9e0 is the broader scalar pow(x, y) owner that stitches the adjacent
log and exponential strips back together. After that point the strip stops looking like separate
command leaves and turns back into broader owner bodies. The next adjacent command leaves are
bounded the same way:
shell_command_dispatch_scenario_followon_0x437d70_if_active 0x00441340 is a guarded hop into
the real cheat-code owner shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats
0x00437d70. That owner increments the shared shell counter at [0x006d401c+0xc60], opens the
localized cheat prompt 2922 Do I detect a cheater in the house?\n\nEnter code (or <ESC> to cancel):, and then scans the fixed 26-entry table at 0x005ee2c8. The active selector strip is
now grounded: winner/loss strings 3618/3619/3620/3622 route through
world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text 0x004367c0, selector 1
jumps to the out-of-line reset branch at 0x004d676c that clears the selected-company stat bands
rooted at [company+0x0cfb], [company+0x0d7f], and [company+0x1c47], selectors 2 and 3
post deltas into the selected company and selected chairman profile through 0x0042a080 and
0x00476050, selector 4 resolves one locomotive by primary or alias stem through
0x00461c00 and applies it to every selected-company train through 0x004aefb0, selector 5
forces territory-access byte 1 across the live territory table through 0x00424030, selector
7 now reads more tightly as the train-crash branch because 0x004ad7a0(1) is also the direct
shell-command owner behind the 365 warning There is no train available to crash!, and
selectors 6/8/9/10 toggle bytes [state+0x4c8f/+0x4c8e/+0x4c8d/+0x4c8c]. The same table also
contains the later cheat labels
3634 Orca and the alias-only tail Katie..Seymour, but those rows currently sit above the
visible jump-table bound 0x0a, so the safest static read is that they are unreached or handled
elsewhere rather than active cases in this owner. By contrast
shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0 0x00441360
requires the same single-profile gate, resolves one subject through 0x0040b2d0(0, 1), and then
forwards that result into shell_world_focus_selected_subject_kind_and_id 0x00437a90.
The neighboring current-train command strip is bounded now too. Shared helper 0x00441790
resolves either the currently focused world-view train or one fallback train, but only keeps it
when the owner company matches the current scenario-selected company. On top of that resolver,
0x00441810 is the direct Current train crashes command: it opens localized warning 365
when no owned train survives, otherwise it forwards the train into the crash owner
0x004ad7a0(1). 0x004418a0 is the paired Current train breaks down command with the same
gate and warning 366, but it forwards into the named breakdown owner 0x004ada00(1).
0x00441870 is the simpler Current train whistles command, which resolves the same owned train,
finds the train-side visual owner through 0x004a77b0, and writes request dword 1 into
[owner+0x33a]. The immediately adjacent helper strip is bounded now too: 0x004a77d0 is a
tiny two-float query over the same linked route object, defaulting both caller outputs to 10.0f
when [train+0x41] is empty and otherwise tail-calling the lower linked-route metric helper
0x0041add0; and 0x004a7810 is the neighboring linked-route row-band refresh that walks
[route+0x316] / [route+0x31a], treats literal steam emitter definitions specially through
effect_name_matches_literal_steam 0x004749a0, and flips row byte [row+0x1d8] accordingly.
The shell command strip on the other side is tighter too: 0x00441900, 0x00441940,
0x00441980, 0x004419c0, and 0x00441a00 are the five repeated Overview.win page toggles
over detail-manager mode 9, each closing the current page through
shell_detail_panel_transition_manager 0x004ddbd0(-1, 0) when that exact page is already
active and otherwise requesting mode 9 with page ordinals 0..4. One nearby idle-shell gate
is tighter now too: 0x004414d0 only forwards into the queued-record prompt owner 0x00438840
when the live world object exists and the active shell presentation stack depth
[0x006d401c+0xc64] is not positive. The neighboring shell-command leaves are now explicit too:
shell_command_open_overview_for_previous_or_latest_fixed_preview_record 0x00441490 walks the
fixed preview-record sequence family at 0x005ce418, preferring the predecessor of the current
inactive minimum-sequence record and otherwise falling back to the max-sequence record before
opening Overview.win through 0x004f3a10; shell_command_prompt_for_class0_region_name_and_focus_matching_world_region
0x00441500 opens prompt 0x16a, scans the live class-0 region records in 0x0062bae0 by
name [region+0x356], and on a match centers the live world view through
shell_world_view_center_on_object_with_mode_specific_zoom_policy 0x00433900, while misses
fall back to prompt 0x16b; and
shell_command_prompt_for_text_and_submit_selector1_multiplayer_transport_request_when_auxiliary_preview_ready
0x00441690 requires the auxiliary-preview owner gate 0x00434050 plus one live queued-preview
record at [world+0x66ae], opens prompt 0x0b6d, and submits the entered text through
multiplayer_preview_dataset_submit_transport_request 0x00469d30 with selector 1.
shell_station_list_format_freight_and_express_availability_summary 0x00506e50 feeds the
station-list summary %1 has %2 freight loads and %3 express loads available for hauling..., and
the paired modifier helper shell_station_list_handle_center_or_rename_action 0x00506d50 owns
the visible Shift-center and Ctrl-rename row actions. The list owner itself is tighter now too:
shell_station_list_window_refresh_rows_selection_and_status 0x00506f30 is the real
StationList.win row and status refresh pass, clearing and repopulating controls 0x61a9 and
0x61aa, wiring the visible summary and modifier callbacks, mirroring the shared selected-station
latch at [0x006cec78+0x4cba] when it still belongs to the current company, and updating the two
status labels 0x61af and 0x61b0. The row-side callout lane is tighter too:
one adjacent active-window follow-on strip is explicit now too. The no-arg helper
shell_refresh_active_window_followons_without_subject_gate 0x00436070 refreshes the live
company-detail, stock-buy, and Overview.win branches for modes 7, 0x0b, and 9.
The helper
shell_refresh_active_window_followons_for_subject_and_optional_company_match 0x004360d0
refreshes the live company-detail branch in mode 7, the stock-buy branch in mode 0x0b, the
mode-8 timed overlay only when the current subject id matches the caller dword, and the
Overview.win side in mode 9. Its wrapper
shell_refresh_active_window_followons_and_adjacent_station_or_train_lists 0x00436170
forwards through that helper and then adds the station-list refresh through
shell_station_list_window_refresh_rows_selection_and_status 0x00506f30 when mode 4 is
active plus the TrainList.win refresh through
shell_train_list_window_refresh_controls 0x005158f0(-1) when mode 1 is active. The
shared world-side follow-on beneath those shell branches is explicit now too:
world_refresh_collection_side_effects_after_broad_state_change 0x004361d0 sweeps the live
region, placed-structure, and three adjacent world collections, re-entering their per-record
refresh owners after broader state changes. Current grounded callers include the larger
world/status owner at 0x44b160 and the TrackLay teardown path at 0x50dba7. The
nearby train-detail lower-action special case
shell_handle_train_detail_lower_action_0x3f9_follow_current_route_object 0x00435ac0 is now
bounded too: it validates the current train, resolves its linked route object, recenters the
world view on that route object, and then re-enters the shell detail manager with mode 2.
The row-side callout lane is tighter too:
shell_station_list_row_callback_publish_station_callout_card 0x00506ac0 is the actual
row callback beneath both list controls, resolving the selected station, deriving one category
header through 0x0053de00 and 0x00552560, and then publishing the station-name plus freight
and express callout card through repeated shell_publish_text_callout_presentation calls. The
side-selector branch is tighter too:
shell_station_list_window_handle_message no longer just re-enters the raw StationPick.win
constructor. It flips the active side bit at 0x006d1710 and then re-enters the modal helper
shell_station_pick_window_open_modal_and_return_selected_station_id 0x005078c0, which
allocates one helper window, runs shell_station_pick_window_construct 0x00507620, brackets the
modal show path, and returns the staged selected station id from 0x00622ae8. Inside that helper
family, shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event
0x005075c0 now bounds the small message-normalization strip beneath controls 0x80e8..0x80ea.
The Shift-center side is tighter now too:
the shared helper 0x00433900 takes one object pointer plus one small mode, derives one
mode-specific (distance,height) preset from the target's virtual classification, and then
re-enters 0x0043c9a0 to center the live world view on that object. The report side is clearer
as well:
0x004d3060 is the dedicated Stats - Trees constructor over map_editor_tree_stats_report,
0x004d3080 is the actual General Validation constructor over
map_editor_general_validation_report, and the same page table also now grounds Stats - Cargo,
Stats - City/Region, Stats - City Count, Event Variable Values, and the neighboring
event-validation page. The remaining open editor edge is therefore mostly the deeper gameplay
meaning of those site-side service scores and flag bits, not page ownership.