jan/rrt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
rrt/docs/control-loop-atlas/editor-breadth.md

80 KiB
Raw Blame History

Input, Save/Load, and Simulation: Editor Breadth

Editor Breadth

The broader map-editor page owner is now bounded through map_editor_panel_select_active_section 0x004ce070 and map_editor_panel_dispatch_active_section_message 0x004cf700, which switch among the grounded setup pages, Cities/Regions, Territories, the Players and Player Pool setup slices, the now-grounded Building Density page, the locomotives-available and industry-availability pages, the economic and special-condition pages, the Port/Warehouse Cargos page, and the later report pages. The mid-editor ownership is materially clearer now too: the chairman-slot editor is the Players page, the available-chairman editor is the Player Pool page, and the former unnamed dual tri-state page now lines up with localized page text 997 Building Density plus help text 1017 and the direct field captions 1642 Starting Building Density Level: and 1644 Building Density Growth:. Both controls are now bounded as stored ordinal bytes 0/1/2 rather than loose labels: the first three-choice control is the map-wide starting-density selector, with its default middle state 1 matching the documented 100% baseline from 1643; the second is the paired overall growth selector whose effects later appear in the city-growth side of the simulation. map_editor_city_region_panel_construct and map_editor_city_region_panel_handle_message own the city-or-region editing lane with rename and copy-industry-data flows. That copy side is tighter now too: the handler first enters 0x00420e00, which rebuilds the selected region's profile collection [region+0x37f], clones the source region's live label-weight entries when a source region is present, and otherwise reseeds a fixed default weight set through repeated 0x004206b0 calls. The no-source companion 0x00420ed0 now makes that split explicit: it rebuilds the same subcollection and then picks one of two fixed default label-weight sets based on region class dword [region+0x23e], using one all-0.2f family for nonzero-class regions and one class-0 family that starts with 0.3f before continuing with repeated 0.2f entries. The lower mutator 0x004206b0 then linearly scans the selected region subcollection by profile label, creates a new profile only when the copied weight is positive, removes an existing profile when the copied weight is non-positive, updates [entry+0x1e] otherwise, and refreshes the region's derived availability-summary bytes [region+0x2f6/+0x2fa/+0x2fe] through 0x00420410; map_editor_territory_panel_construct and the adjacent no-source companion 0x00420ed0 is tighter too: it rebuilds the same collection root [region+0x37f] but then seeds one of two fixed default profile-label sets directly through repeated 0x004206b0 calls, splitting by region class dword [region+0x23e]. Nonzero-class regions take one all-0.2f default set, while class-0 regions take a different set that starts with one 0.3f weight before continuing with repeated 0.2f entries. That makes 0x420ed0 the true class-split default-profile companion to the source-cloning helper at 0x420e00, rather than just more of the same editor copy path. Two neighboring collection queries are tight enough now too. 0x00421d20 counts how many live regions have at least one profile row in [region+0x37f] whose label matches the candidate-name string for one caller-supplied candidate id; 0x00421e30 resolves the Nth such matching region. Both helpers reuse the same 0x0041fac0 ordinal label-and-weight copy helper we just grounded, only increment once per region, and skip nonzero-class regions whose companion count [region+0x242] is nonpositive. Those two queries are what the editor summary side at 0x004cdd56/0x004cdeab uses before it formats per-region lists for one selected industry or profile name. The adjacent world-facing query strip is bounded too: 0x00422010 scans the live region collection for class-0 regions whose normalized coordinates fall inside one caller-supplied float rectangle, keeps the nearest region id [region+0x23a] by squared XY distance through 0x0051db80, and returns 0 when no qualifying region is found; 0x004220b0 is the small wrapper above it that returns the matched region name [region+0x356] or the fallback localized scratch string at 0x0062ba90. map_editor_territory_panel_construct and map_editor_territory_panel_handle_message own the territory rename and border-remap lane; map_editor_locomotive_availability_panel_construct plus map_editor_locomotive_availability_panel_handle_message now bound the locomotive policy page over 0x006ada84; map_editor_industry_availability_panel_construct plus map_editor_industry_availability_panel_handle_message do the same for the industry candidate pool at 0x0062b268; and map_editor_port_warehouse_cargo_panel_construct plus map_editor_port_warehouse_cargo_panel_handle_message now ground the recipe-book page that edits port or warehouse cargo policies through twelve per-book state blocks at [0x006cec78+0x0fe7+index*0x4e1]. Each book now has a shared maximum annual production float at book+0x3ed and five fixed cargo-line entries starting at book+0x3f1 with stride 0x30; each line is bounded as a mode dword, annual amount, a supplied-cargo token at +0x08, and a demanded-cargo token at +0x1c. The constructor and handler now make those fields materially tighter too: the row pair shown in Supply Only and Production Demand->Supply is the +0x08 supplied-cargo selector, the row pair shown in Demand Only and Production Demand->Supply is the +0x1c demanded-cargo selector, and the single amount field at +0x04 is labeled Annual Demand: only in mode 1 but Annual Supply: in modes 2/3. The stronger new runtime-side result is now a full chain rather than only the importer: scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables first imports those same five lines into one repeated array of identical 0xbc-byte runtime descriptors with no row-index special casing, and the candidate-side rebuild pass at structure_candidate_collection_rebuild_runtime_records_from_scenario_state 0x00412d70 then projects those descriptors into the live structure collection at 0x0062ba8c before structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables 0x00411ee0 rebuilds the per-cargo runtime summary tables. The current local file-side result is now tighter too: the grounded recipe-book root at 0x0fe7 is preserved byte-for-byte across the checked map/save scenario pairs, so the loader can safely treat the twelve 0x4e1-byte books as preserved scenario payload rather than a drifting save-only band. A conservative summary probe now only reports per-book head signatures, raw cap dwords at +0x3ed, and five raw line summaries rooted at +0x3f1 so the file-side structure stays aligned with this grounded ownership. The player-facing line modes remain Disabled, Demand Only, Supply Only, and Production Demand->Supply, and the fourth mode is tighter now too: current wording around 1674, 1675, and 504 plus the downstream scaling path says it is the production-line mode governed by the shared annual production cap, where the entered annual amount stays on the supply side while the demanded side becomes the normalized input branch. The candidate-side accumulator pass reinforces that split by applying the shared production cap only to the supply-half runtime branch and bypassing that scaling on the normalized demand half. The lower gameplay side is tighter now too: structure_candidate_query_cargo_runtime_summary_channels 0x00412650 is the first grounded consumer beneath that rebuild chain, because it lazily rebuilds four per-cargo summary banks and returns one direct-supply channel, one cap-normalized supply channel, one demand or input channel, and one scaled production-output subrow channel for a requested cargo id. The internal indexing is tighter now too: the direct-supply lane indexes from [desc+0x1c], the demand or input lane uses that same resolved cargo id in the no-subrow branch, and the scaled production-output lane indexes each subordinate row directly from [desc+0x44+row*0x1c], with no post-resolution failure guard between the importer writes and the summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if the imported low-16 marker rows fail the exact matcher at 0x0041e9f0, the resulting 0 ids will still hit the first summary-bank bucket inside 0x00412650, but the semantic meaning of cargo id 0 itself remains ungrounded. The sibling helper structure_candidate_supports_or_references_cargo_id 0x004129d0 then uses those same banks plus the cached cargo-membership arrays to answer whether a live candidate materially references a cargo at all. One compare step tighter, the raw line lanes now split cleanly by scenario family while still preserving map->save identity inside each checked pair. Alternate USA.gmp and Autosave.gms match at the raw line-content level: books 0..4 keep mixed line areas, their line02 slots carry the recurring nonzero mode words 0x00110000, 0x000b0000, 0x000b0000, 0x00130000, and 0x00180000, and the same line02 slots also carry one recurring supplied token 0x000040a0; the neighboring line00/line01 slots carry the same recurring demanded token lanes such as 0x00010000, 0x72470000, 0x6f430000, 0x694c0000, and 0x694d0000. Southern Pacific.gmp and p.gms also match at the raw line-content level, but the same rooted line slots stay zero in the checked pair. Spanish Mainline.gmp and g.gms again match at the raw line-content level yet carry a distinct nonzero pattern: books 0..4 keep mixed line areas, line-level supplied tokens include 0x00170000, 0x00150000, 0x00004040, and 0x00004000, demanded tokens include 0x00010000, 0x68430000, and 0x6c410000, and the later line02 mode words stabilize at 0x00070000 then 0x00010000. So the loader can now safely treat these raw line lanes as preserved scenario payload with family-specific signatures, even though the exact cargo-id and mode-enum semantics still need separate grounding. One inference is tighter now too: when those demanded-token words are zero in the low 16 bits and printable in the high 16 bits, the byte order reads as short two-letter stems such as Gr, Co, Li, Mi, Ch, and Al, which fit the current scenario cargo-name families Grain, Corn, Livestock, Milk, Cheese, and Alcohol from RT3.lng; the runtime probe now exposes those only as probable ASCII stems, not as fully grounded cargo-id decodes. The supplied-token side is now bounded as a separate layout family rather than forced into that same stem model: the Alternate USA family uses one stable low-16 marker 0x000040a0 only in book00..04.line02, the Southern Pacific family leaves the supplied lanes zero in the checked pair, and the Spanish Mainline family splits between two high-16 numeric tokens 0x00170000 and 0x00150000 in book00/01.line01 plus the later low-16 markers 0x00004040, 0x00004000, and 0x00004040 in book02..04.line02. The probe now exposes those conservatively as token-layout classes high16-ascii-stem, high16-numeric, and low16-marker, without claiming that the non-stem numeric or marker families are decoded yet. One more structural layer is stable enough to name conservatively: the checked nonzero recipe rows repeatedly fall into four line-signature classes. Alternate USA books 0..4 all expose one demand-numeric-entry at line00 (0x00010000), one demand-stem-entry at line01 (Gr/Co/Li/Mi stems), and one supply-marker-entry at line02 (nonzero mode plus 0x000040a0). Spanish Mainline books 2..4 expose that same three-line pattern with Ch/Al stems and the 0x00004040/0x00004000 marker family, while books 0/1 only expose the earlier supply-numeric-entry form at line01. So the loader can now distinguish recurring row roles such as demand-stem versus supply-marker without pretending the marker payloads themselves are decoded. The importer-side branch map is tighter now too because local objdump over 0x00435630 shows that only nonzero mode dwords materialize into 0xbc runtime descriptors: mode 0 lines are skipped entirely, mode 1 enters the demand-only branch, mode 3 enters the dual demand-plus-supply branch, and every other nonzero mode falls into the supply-side branch. In the checked corpus that means the recurring demand-numeric-entry and demand-stem-entry rows in Alternate USA and Spanish Mainline are preserved scenario-side line records but do not become live runtime descriptors, while the later supply-marker-entry rows are the ones that actually reach the runtime import path. The runtime probe now exposes that directly as imports_to_runtime_descriptor plus one conservative runtime_import_branch_kind. The raw token windows beneath those branch labels are tighter now too. The checked mode-zero demand rows preserve string-bearing windows at line+0x1c, and the current probe shows those conservatively as prefixed ASCII previews such as ..Grain, ..Corn, ..Livestock, and ..Milk; local objdump over 0x0041e9f0 then shows the importer feeding the corresponding token buffer into an exact cargo-name matcher built over the live cargo collection at 0x0062ba8c. By contrast, the imported supply-marker-entry rows feed nonprintable windows such as .@... from line+0x08 through that same matcher, and the resolver path currently shows no special-case decoding for those marker forms. So the strongest static read is now: the stem-like demand rows preserve cargo-name text but are skipped because their mode is zero, while the nonzero imported marker rows are the live descriptor inputs yet likely fail exact cargo-name resolution unless another upstream transform exists. The wrapper layer above that query no longer looks like a hiding place for special treatment either. Local objdump now shows 0x00412960 simply summing the two supply-side floats returned by 0x00412650, while 0x004129a0 returns the single scaled production-output lane directly; neither wrapper checks for cargo id 0 after the query returns. The broader world-side accumulator at 0x0041e7be is tighter in the same way: it calls 0x00412650, requires all four returned channels to be positive before continuing, and only then scales those four channel values by one linked-instance count from 0x00413940 into caller-owned accumulators. So the current strongest read remains structural rather than semantic: unresolved marker rows can still propagate through the first bank bucket, but the first place that meaning matters is a normal positivity-gated cargo-channel consumer, not a dedicated null-cargo branch. The caller side is narrower than before too. The steady-state site bitset owner placed_structure_rebuild_candidate_cargo_service_bitsets 0x0042c690 starts its inner cargo loop at id 1 and only walks upward through the current live cargo count, so it never intentionally queries cargo id 0. The broader placed-structure sweep around 0x00452e60 tightens the same boundary from above: when the requested cargo id is nonzero it resolves the backing candidate and enters structure_candidate_supports_or_references_cargo_id, but when the requested id is exactly 0 it skips that cargo-reference helper entirely and falls through to a different linked-site or station-or-transit gate. Current local objdump now shows that bypass first requiring one subtype latch through the placed-structure vtable +0x70, then resolving the linked site id at [site+0x2a8] through the placed-structure collection 0x006cec20, and then forwarding that linked peer into the narrower predicate at 0x0047fd50. That narrower helper is tighter than before too: it resolves the linked peer's backing candidate through the peer site id at [peer+0x04], reads candidate class byte [candidate+0x8c], and returns true only for the first three class values 0/1/2 while rejecting 3/4 and anything above 4. So current local callers treat cargo id 0 as a nonstandard request bound to one linked-site reachability or classification side path, not one ordinary cargo lane they routinely probe. The vtable-+0x70 latch itself is bounded a bit better now too. It still lacks a direct field decode, but every local callsite we checked around 0x0040d230, 0x0040dba0, 0x0040dbf0, and 0x0040f670 uses that slot only as the precondition for touching [site+0x2a8] and the neighboring linked-site helpers 0x0047dda0, 0x0047fd50, and 0x004138b0. That makes the safest current read a linked-site-bearing or linked-site-capable latch, strongly aligned with the subtype-1 construction lane that is the only grounded writer of [site+0x2a8], rather than a broad cargo or route-style predicate. The neighboring maintenance pair tightens that linked-site read further. Local objdump now shows 0x0040dba0 and 0x0040dbf0 as complementary tiny helpers that each require the same vtable-+0x70 latch, resolve optional linked peer id [site+0x2a8] through 0x006cec20, forward that linked peer (or null) into 0x0047dda0, and then mirror opposite values into local byte [site+0x42] (0 for 0x0040dba0, 1 for 0x0040dbf0). The route-entry side beneath them is tighter too: 0x0047dda0 reads route-entry anchor id [peer+0x08], resolves that anchor through 0x006cfca8, and only dispatches one of two route-entry vtable calls when 0x0048a090(1) reports that all three anchor-slot dwords [entry+0x206], [entry+0x20a], and [entry+0x20e] are still -1. So the strongest current read is no longer just "linked-site capable" in the abstract: this latch consistently fronts the local linked-peer class gate 0x0047fd50, the paired [site+0x42] route-entry state toggles, and the later linked-peer collection sweep 0x004138b0, which keeps the cargo id 0 bypass path firmly on the linked-site route-anchor or classification side rather than on an ordinary cargo lane. One smaller ownership boundary is tighter too: byte [site+0x42] is not private scratch owned only by that pair. Local objdump shows tiny direct setters at 0x0040cbc0 and 0x0040cbd0 plus a raw getter at 0x0040cbf0, so the 0x0040dba0/0x0040dbf0 pair is writing one shared placed-structure state byte rather than inventing a route-entry-only scratch lane. One caution is tighter now too: there are later mode-gated reads at other addresses that also touch a +0x42 byte on their own object layouts, but current local evidence does not yet prove those are the same placed-structure owner family, so the safest current note keeps only the immediate 0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0 cluster grounded together. The vtable side sharpens that split too. A local .rdata scan shows 0x0040dba0 and 0x0040dbf0 each appearing exactly once, together with 0x0040cbf0, in one method table rooted at 0x005c8c50; the constructor chain is tighter now too, because 0x0040c950 installs that same table as one concrete placed-structure specialization above the common base table 0x005cb4c0, while 0x0040c970 tears the same specialization back down to the base before the temporary object is freed. By contrast the raw set or get trio 0x0040cbc0/0x0040cbd0/0x0040cbf0 also appears in several sibling tables such as 0x005c9750 and 0x005dd1f0. So the strongest current structural read is that byte [site+0x42] belongs to one broader placed-structure virtual interface, while the linked-peer route-entry toggles are one specialization-specific override pair inside that family rather than generic setters used by every sibling. One negative boundary is tighter now too: the raw token words in this recipe block do not look like the already grounded shell-side AnyCargo/AnyFreight/AnyExpress selector-table ids from 0x00621e04/0x00621e10, so the current best read is that these on-disk line tokens are not just copied UI selector ordinals or the same small express-side id family in another wrapper. One broader collection pass also now ties the editor rule side back into runtime filtering: structure_candidate_collection_refresh_cargo_economy_filter_flags 0x0041eac0 rebuilds per-candidate flag [candidate+0x56] across the live structure collection, and current grounded callers show it rerunning directly off the runtime cargo-economy latch at [0x006cec74+0x25f], which aligns this lane with the editor's Disable Cargo Economy special condition rather than leaving it as a purely editor-owned recipe page. The first common live gate beneath that filter is now bounded too: structure_candidate_is_enabled_for_current_year 0x0041e220 is the shared year-and-filter check used by the collection refresh and later candidate-selection branches, while structure_candidate_rebuild_local_service_metrics 0x0041e2b0 is a setup-side local service scorer that already consumes the same enabled candidate records through world-grid sampling. One steady-state world-side consumer is now grounded as well: placed_structure_rebuild_candidate_cargo_service_bitsets 0x0042c690 walks linked placed structures, filters live category-2 candidates through structure_candidate_is_enabled_for_current_year, and compacts the direct and scaled supply-side channels from 0x00412960 and 0x004129a0 into per-cargo bitsets on the placed-structure record. The next site-side owner layer is tighter now too: placed_structure_refresh_linked_candidate_flag4 0x0042c8f0 refreshes the sibling state bit at [site+0x0e6], placed_structure_refresh_candidate_service_state 0x0042cdf0 ties that flag refresh to the cargo-service bitset rebuild, placed_structure_rebuild_candidate_local_service_tables 0x0042ce00 then performs the heavier per-site candidate score rebuild over the aligned float and word tables at [site+0x107], [site+0x02], and [site+0x6c], and placed_structure_refresh_local_service_score_bundle 0x0042d580 is now the local wrapper that chains that rebuild into the neighboring post-passes before the world-grid owner continues. Those post-passes are tighter too: placed_structure_apply_route_linked_service_caps 0x0042cc50 is the first route-backed cap pass over the rebuilt local tables, placed_structure_redistribute_local_service_pressure_from_neighbors 0x0042c1b0 is the neighboring-site redistribution pass, and placed_structure_clamp_candidate_service_age_table 0x0042cb30 is the final recent-service clamp over the primary per-candidate word table. Above that refresh lane, placed_structure_query_candidate_local_service_metrics 0x0047e240 is the first higher-level query, placed_structure_count_candidates_with_local_service_metrics 0x0047e330 counts how many candidates currently produce that query, placed_structure_get_nth_candidate_id_with_local_service_metrics 0x0047e620 is the ordinal selector over that same visible candidate family, placed_structure_query_cached_express_service_class_score 0x0047e390 caches one parallel class score for the express family now strongly aligned with Passengers, Mail, and Troops, placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site 0x0047eb90 rebuilds one peer-site comparison cache over the same local-service inputs, and placed_structure_select_best_candidate_id_by_local_service_score 0x0047f910 is the best-hit selector above the direct and directional local-service query pair. Those site-side scores now have grounded shell read-side consumers too: shell_station_detail_format_freight_and_express_summary 0x00506be0 formats the visible Freight: %1 and Express: %1 lines in StationDetail.win, and the same station-detail family now has a deeper candidate-service lane: shell_station_detail_set_active_candidate_service_preview 0x00504ae0 stores the active (station id, candidate id) pair for the world-side preview scan and now grounds the whole world-side arming strip through world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active 0x00452f60, world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero 0x00452d80, world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active 0x00452db0, and world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid 0x00452ca0, shell_station_detail_clear_active_candidate_service_preview 0x00504a90 tears that pair back down, shell_station_detail_update_candidate_service_entry 0x00504ba0 is the shell-side entry updater above that preview pair, shell_station_detail_format_candidate_local_service_summary 0x00504bea uses placed_structure_query_candidate_local_service_metrics together with localized ids 681, 682, and 2813 to build the visible candidate service text, shell_station_detail_build_to_from_haul_summary_widget 0x00505150 now grounds the paired To and From hauled-traffic strip widgets, shell_station_detail_present_to_from_haul_stats_popup 0x00504770 owns their click-through annual and lifetime hauled TO/FROM this station popup, shell_station_detail_refresh_nearby_structure_jump_rows 0x00505470 owns the five-row nearby-structure jump lane, and shell_station_detail_refresh_candidate_service_rows 0x00505760 is now the larger row-list owner that enumerates active candidate-service entries and wires shell_station_detail_update_candidate_service_entry into the per-row click path. The broader owner above those lanes is tighter now too: shell_station_detail_window_refresh_controls 0x00506610 is the real StationDetail.win refresh pass, validating the current station from the detail manager, publishing the upper summary lane, splitting the 0xb3b7/0xb3b8 action strip by scenario latch [0x006cec74+0x1db], routing that scenario branch through shell_station_detail_present_scenario_station_connection_triplet_popup 0x00504590, routing class 3/4 sites into the alternate branch shell_station_detail_refresh_class_3_or_4_train_service_matrix 0x00504ec0, and otherwise rebuilding the nearby-structure lane, the paired To/From widgets, and the candidate-service rows together. The broader message side is bounded now too: shell_station_detail_window_handle_message 0x00505e50 owns the wide StationDetail.win switch over message ids 0, 0xca, 0xcb, and 0x3ea, routes candidate-service rows 0xb4dc..0xb5a3 into preview arm or clear or a Ctrl-modified Overview.win handoff, routes nearby-structure rows 0xb40a..0xb413 into the detail transition and optional world-centering path, refreshes control 0xb3f8 on the 0x3ea branch, and dispatches the lower 0xb3b5..0xb3bf action band through the selected-station ownership and class-gated helper strip. The compact siblings under that pass are tighter now too: shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty 0x005042c0 is the dirty clear owner over the dynamic row bands and the paired haul widgets, shell_station_detail_has_valid_selected_station 0x00504370 is the bare selected-station validity probe, shell_station_detail_selected_station_belongs_to_selected_company 0x00504390 is the selected-company ownership gate, and shell_station_detail_present_selected_station_not_controlled_notice 0x005043f0 is the localized not-controlled popup beneath the same action family, shell_station_detail_present_scenario_station_connection_triplet_popup 0x00504590 is the scenario-latched station-to-station triplet popup that formats three per-destination scalar lanes with %5.2f or N/C, and shell_station_detail_refresh_class_3_or_4_train_service_matrix 0x00504ec0 is the alternate class-3/4 branch that rebuilds the Trains Serviced / Trains Maintained matrix before reusing the shared haul-popup callback wiring, shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf 0x005044b0 refreshes the lower class-gated action strip rather than the older guessed 0xb3f8 lane. The adjacent lifecycle and navigation side is tighter now too: shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton 0x00505bf0 is the real StationDetail.win destructor, and shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class 0x00505cb0 plus wrappers 0x00505e30 and 0x00505e40 now bound the next-or-previous station stepping path that keeps the selection inside the same owner and station-site class family before optionally recentering the world view. The broader shell command layer above that station-detail branch is tighter now too: shell_command_step_active_window_subject_forward_or_publish_contextual_notice 0x00440e00 and shell_command_step_active_window_subject_backward_or_publish_contextual_notice 0x00440f20 are the paired next-or-previous shell commands that first prefer StationDetail.win, then the live building-detail family, then CompanyDetail.win, and finally the sibling singleton at 0x006d3b20 before falling back to the localized notice pairs 0x017a/0x017b and 0x017c/0x017d. The adjacent direct subject-openers are tighter now too: shell_open_or_focus_train_detail_for_current_or_first_owned_train 0x00441040 reuses current detail subject [detail+0x78] or falls back to the first owned train for the selected chairman company before re-entering shell_detail_panel_transition_manager with mode 2, while shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station 0x004410d0 reuses [detail+0x80] or falls back to the first owned linked station before the same transition manager is re-entered with mode 5. Two later registered command siblings are now bounded only structurally but still usefully: 0x00441160 requires active scenario plus live world root 0x0062c120 and dispatches either world_enable_preview_mode_0x15_latch_and_enter_if_idle 0x00453370 or world_disable_preview_mode_0x15_latch_and_clear_if_active 0x00453780 by the query at world_query_preview_mode_0x15_latch_active 0x00450150, while 0x004411a0 requires active scenario plus live route-store root 0x006cfca8 and dispatches either 0x00491880 or 0x004932a0 by the boolean result of 0x004934a0(0). The next registered shell-command strip is bounded the same way now: shell_command_toggle_shared_world_preview_global_0x62be84 0x00441240 flips the shared preview-oriented global 0x0062be84, shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay 0x00441260 and ...variant_1... 0x004412a0 both route through shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay 0x00433da0, which restyles GameUppermost.win controls 0x7923..0x7925, mirrors the chosen variant across detail controls 0x07db..0x0837, transitions the detail manager into mode 0x19, and forwards the selected variant into world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty 0x0043a0a0, and shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds 0x004412e0 re-enters scenario_state_rebuild_derived_year_threshold_band 0x004351c0 and then rewrites the paired shell-state dwords at [0x006cec74+0x1df/+0x1e3] through 0x00482850. Those three commands are still structurally named rather than semantically named, but the current static owner boundaries are now explicit. The same command band is tighter at both edges too: 0x004411e0 simply flips presenter dword [0x006d4024+0x114276] when the main shell presenter is live, and 0x00441200 is the adjacent active-scenario gate that injects shell message 0xcb for control 0x9858 through shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars 0x00538e00. The later edge of the same shell strip is bounded too: 0x00441ac0 and 0x00441af0 are the two small active-scenario plus shell-idle wrappers over shell_map_file_entry_coordinator 0x00445ac0, forwarding flag triplets (0,0,0) and (0,1,0) respectively, while 0x00441b20 is the neighboring live-world clamp that ensures [world+0x168d] never falls below [world+0x1689]. The next broader neighbor is now grounded too: shell_command_toggle_editor_map_mode_with_one_shot_warning_modals 0x00441b50 is the real editor-map-mode toggle owner above 0x00482e50. It branches on current shell mode [0x006cec74+0x68], uses one-shot latches 0x0062be88 and 0x0062be8c to gate localized warnings 0x017e and 0x0b24, and on the non-editor side can instead raise warning 0x0b6e when 0x004349a0 reports more than one active profile. After those gates it forwards target mode ([shell+0x68] == 0) into shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects 0x00482e50. The adjacent startup-year strip is grounded now too: shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar 0x00441cb0 and shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar 0x00441d20 are the paired registered commands beneath localized ids 0x0db5/0x0db6. Both require active scenario state plus the same single-profile gate from 0x004349a0, clear shell dwords [0x006cec74+0x233] and [+0x124], then adjust startup scalar [0x006cec78+0xbfa] by +0.5 or -0.5 before re-entering world_set_selected_year_and_refresh_calendar_presentation_state 0x00409e80 with absolute counter [0x006cec78+0x15] and refreshing the live world view through 0x00439a80. The exact player-facing command labels are still open, but the static owner boundary is now clear: these are not generic shell scalars, they are the paired half-step selected-year presentation commands. The adjacent progress-status side is tighter now too: shell_build_percent_status_payload_clamped_0_to_100 0x00441d90 is the shared save or load progress payload builder, and shell_progress_callback_publish_incremental_percent_status_until_target 0x00441e20 is the throttled callback installed at 0x00442960 through global 0x00d93988. That callback advances the progress latches 0x0062bec8/0x0062becc/0x0062c118, rebuilds the percent payload through 0x00441d90, republishes it through 0x00538c70, and services the shell frame through 0x00482160. The surrounding 0x00445de0 callers keep that pair on the save or load progress side of the shell strip rather than as another input-command family. The adjacent companion-image file seam is bounded now too: shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags 0x00441f70 and shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path 0x004420f0 are the paired _A.tga / _A.jpg import and export helpers around the same tagged selector strip at 0x00441ec0. Both derive an extensionless stem through support_copy_string_stem_before_first_dot 0x0051dde0, choose the _A.tga versus _A.jpg suffix by selector byte [record+0x09], and then shuttle the file bytes through the shared staging descriptor rooted at 0x0062bed4/0x0062bed8. That keeps the family grounded on the same fallback descriptor later reused by world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback 0x00535430, instead of leaving it as an isolated save-side file copier. The neighboring exporter shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100 0x00442ba0 is bounded now too: it copies the live setup payload from [this+0x66be], patches world dimensions and three shell bytes into offsets +0x01..+0x0b, and then normalizes the embedded 0x100 x 0x100 pixel block at +0x03c2 through 0x0047a120 before the save-side callers forward that same record into 0x00441ec0 or the tagged slot-table serializer at 0x00446312. The broader sibling shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46 0x00442740 is bounded now too: it copies the embedded preview pixels at [record+0x03c2] into a temporary 0x40000-byte RGBA buffer, constructs one temporary 0xec-byte surface-like owner through 0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 ), forwards the caller path plus fixed selector 0x46 into 0x00542f50, stores the returned dword into payload field [record+0x18], and then releases the temporary owner again through 0x00542c90 and 0x0053b080. That keeps the short save-side branch at 0x00445925 grounded as a one-shot preview-surface query helper rather than leaving another anonymous image-copy leaf between the tagged export path and the progress notice strip. The broader sibling shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback 0x004427c0 is now bounded as the temporary-path owner above that same tag strip: it derives %1.tmp from the source path, installs progress callback 0x00441e20 in 0x00d93988, rewrites the middle payload band rooted at +0x03ce through 0x00553000, writes the result back out through 0x005a276f, updates payload dword [record+0x18], and only then re-enters 0x00441ec0. The sibling shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags 0x00442900 is bounded now too: it takes the live payload record in EAX, reads the full companion file named by the caller path, installs the same progress callback, rewrites the middle payload through 0x00553000 using stored offsets [record+0x18/+0x1c], and then writes the output back in four spans: the leading 0x03ce bytes, the transformed middle payload, the untouched interval [record+0x18 .. record+0x1c), and the remaining tail. It then stores the caller path back into [record+0x18] and re-enters 0x00441ec0. That closes the offset-driven save-side sibling reached from 0x004459dd after 0x00441f70, so the companion-payload strip is no longer split between one named temp-path owner and one anonymous offset-band rewrite body. The underlying temporary-surface seam beneath those save-side helpers is bounded now too. surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type 0x00541b10 scans the eight-entry row band [this+0xa0..+0xbc], allocates one 0x32-byte row, seeds width, height, and type, and returns the chosen slot index; 0x00541ba0 is the indexed release-side companion. surface_owner_open_named_resource_and_dispatch_row_type_import 0x00542f50 is the named-resource dispatcher used by 0x00442740: it opens the caller-seeded resource path, forwards the result into 0x005428c0, and then dispatches by imported row type [row+0x18] = 2/3/4. surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish 0x005438d0 is the commit-side publish helper over the active RGBA backing buffer [row+0x26], while surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode 0x00543980 is the constructor or ensure owner that allocates one first-use slot through 0x00541b10(..., width, height, 3) and then commits the caller pixels through 0x005438d0. That keeps the save-side preview seam tied back to the same reusable surface-owner family already visible in the world-presentation and shell-overlay branches, instead of leaving the temporary preview query path grounded only at the leaf helper level. The lower surface-owner base is bounded now too. surface_owner_base_init_and_register_on_global_list 0x00540e30 seeds the fixed owner label, capability bytes, helper-object pair, row-slot bands, and global intrusive registration under 0x00ccbb2c; surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers 0x00540fc0 is the shared maintenance owner that recomputes cached byte totals [this+0xcc/+0xd0] across the eight row slots and also owns the full row-buffer release pass; and surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate 0x00541210 is the row-side repack body that converts the active backing pixels into the live 16-bit buffer [row+0x2a], either through a palette-like accumulated-channel path or a direct nibble-packed conversion path depending on owner byte [this+0x96]. That closes the reusable surface family one layer deeper instead of stopping at the first slot allocator and commit helpers. The two remaining compact helpers in that same seam are bounded now too. surface_owner_query_dimension_cap_from_mode_and_quality_band 0x00541160 derives the active power-of-two size cap 0x100/0x200/0x400/0x800 from owner byte [this+0x05], shell gate [0x006d4024+0x11422f], and selector dword [this+0xd8], while surface_owner_probe_named_file_for_type2_header_signature 0x005411c0 is the adjacent file probe that opens one named path, reads 0x12 header bytes, and accepts only the local type-2 signature. The broader survivor above them is bounded now too: surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream 0x005428c0 allocates temporary alpha and RGB planes from the active row, splits the current backing pixels, seeds the local codec object, and then writes the tagged record family 0xbaba/0xbabb/0xbabe into the already-open stream, either directly or through the transformed payload path via 0x00553000. That closes the immediate import-export seam under 0x00542f50; the next open work in this branch is no longer a still-missing leaf, but the broader type-specific row owners. Those are bounded now too. surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer 0x00541c30 is the type-4 importer that validates the 0xbabe lead tag plus the later 0xbaba/0xbabb branches, reconstructs one RGBA row from the tagged payload bands, and then re-enters 0x00541210. surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer 0x00542030 is the type-3 importer that validates the recovered width, height, and pixel-size header, allocates a full RGBA destination plus temporary staging, and decodes the supported 0x18/0x20 source families into RGBA rows. surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer 0x00542d50 is the type-2 importer: it validates DDS , enforces the dimension cap from 0x00541160, copies the block-compressed payload from offset 0x80, stores format tag DXT3, and optionally materializes the live companion buffer through 0x005423d0. That closes the current type-dispatch branch under 0x00542f50 without leaving its three row owners as anonymous stream bodies. The direct export-side sibling is bounded now too. surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file 0x00542b30 is the paired file-write alternative to 0x00542f50: it opens one caller path in wb mode, builds the compact 0x12-byte header with row type 2, first-row width and height, fixed pixel-size byte 0x20, and one optional 0x20 flag bit from the second caller argument, then optionally forces RGBA materialization through 0x00541970 and writes the first-row RGBA payload [row+0x26] plus that header to the open stream. The paired callers at 0x00520cda, 0x00520f61, and 0x00534dd6 all use it as the direct-file branch immediately before the same temporary-surface release through 0x00542c90 + 0x0053b080, so the current export/import seam is no longer split between one named importer and one anonymous file-write sibling. The small dispatch sub-strip under that importer is bounded now too. surface_owner_dispatch_row_import_by_embedded_type 0x00542fb0 is the direct selector over embedded row type [row+0x18], routing type 2/3/4 to 0x00542d50/0x00542030/0x00541c30. The wrapper immediately above it, surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure 0x00543000, clears selector field [this+0x07], allocates one fresh row slot through 0x00541b10, re-enters 0x00542fb0, drops the slot again through 0x00541ba0 on the 1/2 failure paths, and then refreshes cached byte totals through 0x00540fc0. That closes the type-dispatch seam between the file-open owner and the per-row import bodies instead of leaving one more anonymous slot wrapper in the middle. The lower lifecycle in that same surface-owner family is tighter now too. surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row 0x00541970 is the shared query-or-materialize helper for non-type-2 rows: it optionally returns width and height, returns [row+0x26] when RGBA backing pixels already exist, and otherwise expands the live 16-bit source buffer [row+0x2a] into nibble-doubled RGBA dwords before storing the new backing pointer back into [row+0x26]. The broader sibling surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers 0x00542550 is the next owner above that helper: when shell capability byte [0x006d4024+0x11422d] is live and local latch [this+0x95] is still clear, it revisits the active row slots, skips type-2 and already-processed rows, forces RGBA materialization through 0x00541970, marks row byte [row+0x21], seeds row state [row+0x1c] = 0x3c, discards the previous 16-bit output buffer, and rebuilds [row+0x22/+0x2a] from a float-heavy neighbor-difference transform over the RGBA source, halving [row+0x04] on the 0x20-pixel-size branch. The release-side owner is bounded now too: surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots 0x00542c90 releases optional helper roots [this+0xdc/+0xe4], unlinks the owner from the global intrusive list rooted at 0x00ccbb2c, conditionally refreshes the live shell presenter when [this+0x93] is set, and then drops both the selector-side handle and all row slots through 0x00541780 and surface_owner_release_all_row_slots_0xa0 0x00542870. That closes the reusable surface-owner seam one level deeper instead of stopping at construction, import, and commit helpers. The remaining tiny surface-owner leaves in that strip are bounded now too. surface_owner_query_first_row_width_or_one 0x00541aa0 and surface_owner_query_first_row_height_or_one 0x00541ad0 are the fallback-safe first-row geometry getters used by later projection and world-presentation math paths, while surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0 0x00541bf0 simply refreshes cached scalar [this+0xd4] from the live shell presenter and returns [this+0xc0]. The last tiny release helper surface_owner_release_selector_handle_0x07_if_present 0x00541c10 does exactly what the current name says: when [this+0x07] is live it re-enters 0x00541780 and clears that handle back to zero. The later owner shell_apply_scenario_name_specific_post_load_world_and_object_fixups 0x00442c30 is bounded now too: world_entry_transition_and_runtime_bringup re-enters it at 0x00444b50 with the loaded scenario title, and it dispatches on many fixed .rdata names including Go West!, Germany, France, State of Germany, New Beginnings, Dutchlantis, Britain, New Zealand, South East Australia, Tex-Mex, Germantown, The American, Central Pacific, and Orient Express, with several branches further gated by setup payload byte [this+0x66de]. The matched branches then perform targeted live-world edits rather than a generic title-side publish: they patch object-state dwords and bytes inside collections rooted at 0x0062be18, 0x0062bae0, and 0x006ada80, adjust selected float and scalar fields, copy paired ten-dword record blocks when specific name/class pairs match, flip secondary-raster bits through table 0x005ee508..0x005ee5cc, retune a later collection at 0x0062b268, and inject scenario-specific text lines into the shell-owned band [this+0x4f30] through repeated 0x0051e5d0. That finally makes the broad post-load scenario-fixup seam explicit instead of leaving it as an unbounded string-switch body beneath world entry. One neighboring status helper is bounded now too: shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks 0x00442660 is the shared byte-delta and elapsed-time notice builder used by both the bundle-service strip and the save-side progress loop. It measures the current byte counter through 0x00530b70, formats the rounded kilobyte delta and elapsed ticks through %5d and % 4d, packages them through 0x005193f0 -> 0x00518de0 -> 0x0051d680, and then updates the running previous-counter latch 0x0062c11c. That setter writes [shell+0x68], then either rebuilds the editor-side shell surface through 0x004d4500 or refreshes the detail-panel and world side through 0x004d44a0, 0x004dfda0, and 0x0044fb70, before both branches pulse graphics side effects through 0x00484d70(0x0d, 1). The adjacent display-settings strip is bounded now too: shell_command_cycle_display_resolution_forward 0x00483680 is the registered +1 command wrapper into shell_cycle_display_resolution_and_publish_status 0x00483780, while 0x00483990 and 0x004839a0 are the plain +1 and -1 wrappers into that same shared owner. The owner requires the live shell presenter 0x006d4024, walks the supported resolution tables at 0x00620e64/0x00620e7c, applies the chosen size through 0x005206b0, publishes the updated size string through 0x0051b700, 0x00518de0, and 0x005386e0, and then refreshes dependent presentation state through 0x004625b0, 0x00484910(1), and 0x004821d0. After that point the embedded world-view controller strip is tighter now too. world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet 0x00439820 samples a five-point local clearance ring around the current eye X/Z pair through 0x00534490, keeps the highest sample, expands it through 0x0052d0c0 plus fixed margins, and republishes the eye triplet through 0x0052d1e0 when the current eye height needs to be lifted. The embedded controller base beneath that path is now first-class instead of only being referenced indirectly: 0x0052d140 stores the four blend scalars at [+0x50..+0x5c], 0x0052d180 stores the focus triplet and raises dirty byte [+0x64] when it changes, 0x0052d1e0 stores the eye triplet and refreshes sampled vertical delta [+0x66], 0x0052d230 extracts focus-to-eye distance plus heading/pitch-like angles, 0x0052d2b0 serializes the focus, eye, and orientation lanes into one camera-view snapshot record, 0x0052d400 is the inverse helper that rebuilds the focus triplet from eye, heading, pitch, and distance, 0x0052d450 rebuilds the eye triplet from focus, heading, pitch, and distance, 0x0052d640 clamps distance against sampled eye height, 0x0052d750 is the stream-load companion that rehydrates one stored camera-view snapshot back into the controller base, and 0x0052d570/0x0052d5a0/0x0052d6f0/0x0052d860 are the base-reset, default-seed, seed, and reset-plus-seed constructor owners. One level higher, the compact accessor and dirty-latch strip is bounded now too: 0x0052cd20/0x0052cd60 export the current eye triplet as packed or split outparams, 0x0052cd40/0x0052cd80 do the same for the focus triplet, 0x0052cda0/0x0052cdc0 are the matching load-store helpers for auxiliary triplet [+0x2c..+0x34], 0x0052cde0/0x0052ce20 snapshot the current focus, heading, and distance bands into the two cached companion strips when their paired dirty latches are cleared, and 0x0052ce70 refreshes shell presenter scalar [+0x6a] while consuming the primary dirty latch back to zero; the next compact query strip is bounded now too: 0x0052cea0 exports heading and pitch lanes [+0x10/+0x14], 0x0052cec0 samples owner height at current eye X/Z, 0x0052cf00 broadens that into a clamped XY-extent peak-height query, 0x0052d0c0 is the current-eye wrapper into that peak-height query, and 0x0052d0f0 is the normalized scalar-band containment predicate over [+0x50..+0x5c]. One level higher, world_view_refresh_dependent_projection_visibility_and_presentation_scalars 0x0043bde0 now bounds the larger refresh pass that derives visibility and presentation-side scalars from the current focus and eye triplets before later motion and input branches resume. The load-side owner one layer above that strip is bounded now too: world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars 0x0043ac30 releases any pending helper handle, clears presenter ownership, resets the local controller strip, rehydrates one stored camera-view snapshot through 0x0052d750, conditionally loads one extra-row band into [this+0x10e], reseeds the four controller blend scalars through 0x0052d140(0, 0, 1.0, 0.7), and then normalizes heading before control returns to the broader world-view owner family. The adjacent low-side layout-state strip is bounded now too: 0x00544290/0x00544360 publish or reset the local descriptor blocks rooted at [layout+0x352f] and [layout+0x34ef]; the next setter strip 0x00544cb0..0x005450a0 publishes or clears bound-node property pairs 0x0d/0x0e, packed property 0x3c, grouped property 0x0b, the broader capability and mode-gated slot strips 0x1d/0x13/0x14/0x12 and 0x15/0x1a/0x11/0x10, plus the cached-byte-backed property 0x89; and 0x005450c0/0x005450e0/0x00545130 export the cached local block [layout+0x24f0] and the negated local scalar triplet [layout+0x2517/+0x251b/+0x251f], with the middle lane clamped up to 0.5f. One level lower, 0x00545180 builds the generated default preset table rooted at [layout+0x840] as 0x90 fixed 0x33-byte rows from an angular sweep, while 0x00545400/0x00545470/0x005454a0 are the adjacent indexed row setters and query helpers over that same table and 0x00545420/0x00545440 are the paired scalar-array siblings for [layout+0x25f7/+0x25ff]; the next local strip 0x005457c0/0x005458a0/0x005458d0 publishes one property-0x8b stack descriptor on the bound node and borrows or releases the current segment-record window handle [layout+0x265b] with global counter 0x00ccd824; the immediate sibling wrappers 0x005459f0/0x00545a20/0x00545a40/0x00545a70/0x00545aa0/0x00545ac0/0x00545af0/0x00545b90/0x00545bb0/0x00545be0 repeat the same borrow-release pattern for the adjacent table handles [layout+0x2643/+0x2647/+0x264b/+0x264f/+0x2653/+0x263f]. The last clean local leaves after that are 0x00545ca0/0x00545d50/0x00545d60/0x00545db0/0x00545e00, which cover the first-slot clear plus type-1 span commit, the accumulated span counter query, the counter reset and optional bound-node reseed, the bound-node finalize-and-optional-clear helper, and the small bound-node signature classifier. One level up, the next owner body is bounded now too: 0x00545e30 queries one external/provider report and builds summary text in buffer [layout+0x43c], falling back to localized id 0x73 when the provider lookup fails and otherwise appending the localized fragment strip 0x74..0x7d plus the fixed format family %1(16-bit HW) / %1(8-bit HW) / %1(8-bit) / %1(16-bit) from the returned report. The adjacent reset-and-property strip is also tighter now: 0x005464d0 runs one repeated four-pass bound-node reset sequence, 0x00546540/0x00546560 force property 0x17 to 7 or 4, 0x00546580/0x005465a0 clear or raise property 0xa8, 0x005467a0/0x005467e0 are the paired one-bit gate writes for property 0x1c, and 0x00546810/0x00546850/0x00546890 are the template-gated and clear-side mode writes for property 0x16 via local mode byte [layout+0x254a]. One level higher again, 0x0054a0c0 is now bounded as the broader setup-side owner above that strip: it binds one external source onto the bound presentation node, falls back to the midband release helper when that bind fails, conditionally reapplies the cached gamma-ramp scalar from [[layout+0x83c]+0x2f], seeds optional handle [layout+0x33ab] through the small 0x00570fbd -> 0x00570f86 refcounted 0x14-byte object helper pair, which now opens into a tighter row-container family: 0x0057091d reserves one 0x40-byte row block from the fixed template 0x0056cd2c, with 0x005708ce/0x005708f2 as the aligned block alloc/free helpers, 0x00570908/0x005709da as the destructor and release-side wrappers, 0x00570fa1 as the direct refcount-drop path, 0x0057098b answering only IUnknown plus one custom IID, and 0x005709f6 as the first grow-and-duplicate-last-row owner. The next current-entry strip is also bounded now: 0x00570aac seeds the current 0x40-byte entry to an identity 4x4 matrix, 0x00570b0d stores one caller matrix directly into that current slot, and 0x00570b2c/0x00570b76 are the two immediate left/right composition siblings over the same current matrix through 0x0056d3cd. One level wider, the same family now has three helper-generated matrix-pair variants too: 0x00570bc0/0x00570c2f build a temporary matrix through 0x0056df7d, 0x00570c9e/0x00570d1a do the same through 0x0056e1a8, and 0x00570d96/0x00570e12 plus 0x00570e8e/0x00570f0a do the same through 0x0056dc9a and 0x0056dd2a, with each pair preserving the same right- and left-side current-matrix composition split. The adjacent helper region is now bounded as one sibling COM-style object pair too: 0x0057aef3/0x0057aedb/0x00571016 are the init, refcount-drop, and release-side wrappers for vtable 0x005def30, with 0x0057ad5a as the direct addref helper, 0x0057ad20 as its destructor and 0x0057ae97 as its IUnknown plus custom-IID query gate, 0x0057ad67 as its resource-field bind plus attached-object and payload-copy owner, 0x0057add4/0x0057adfb as the attached-object getter and fixed payload copy-out helpers, and 0x0057ae0f/0x0057ae1e/0x0057ae2d/0x0057ae53/0x0057ae79/0x0057ae88 as the direct pass-through wrappers over resource field [+0x48] and payload block [+0x08], while 0x0057af0e/0x00571032 are the destructor and release-side wrapper for sibling vtable 0x005def5c, with 0x0057af4e as the matching addref helper, 0x0057af5b as the target-attach plus cached-flag derivation owner, 0x0057afd0 as the target getter, and 0x0057aff6 as the one-shot target-handle release helper, 0x0057b021 as the paired two-handle clear path, 0x0057b065 as the matching IUnknown plus custom-IID query gate, 0x0057b0a9 as the refcount-drop helper, 0x0057b0c1 as the first broader target-handle and property-strip seeding owner, and 0x0057b4fd as the next target-side transform-block builder over optional anchor pairs plus caller angle and scale. The resource-field branch under 0x0057ae0f..0x0057ae88 is now tighter too: 0x00580867 is the small constructor-style init for the 0xb0-byte target-service object, clearing the embedded entry-band roots, ready byte, auxiliary handle fields, and cache link; 0x005808b2 is the matching full destructor, releasing the two target-bound service handles, both embedded eight-entry bands, attached object, target, the auxiliary handle family rooted at [+0x6c/+0x98/+0x9c/+0xa8], and then unlinking the object from the global cache chain rooted at 0x00db89e4; 0x005809ab is the release-side wrapper for that destructor; 0x005809c7 seeds service handles [+0x64] and [+0x68], invokes attached object [+0x0c] through slot +0x10, republishes those two handles through target slots +0xdc and +0xd8, and latches ready byte [+0x60]; 0x00580a54 is the paired clear-side sibling that releases handle [+0x64] through target slot +0xd8, notifies the attached object through slot +0x1c, and clears [+0x60]; 0x00580a84 is the broader release body over those target handles plus the two embedded eight-entry bands rooted at [+0x10] and [+0x30]; 0x00580aff is the setup-side entry-band owner that chooses one of two fixed parameter triples from local mode byte [+0x50], seeds scalars [+0x54/+0x58/+0x5c] through 0x00570669 and 0x00570691, and dispatches live per-entry objects through slot +0x3c; 0x00580bb9 is the small auxiliary-handle release helper over the pointer band rooted at [+0xa8]; 0x00580bdc is the direct refcount-drop path; 0x00580be8 is the constructor-side owner that stores target [+0x04], derives mode byte [+0x50], seeds the fixed scalar triple [+0x54] = 0x15, [+0x58] = 0x40, [+0x5c] = 0x10, builds the entry bands, and binds the auxiliary handle family rooted at [+0x6c], [+0x98], and [+0x9c]; and 0x00580d29 is the primary payload-dispatch and layout-style service owner below the 0x0057ae2d/0x0057ae53 wrappers, taking the target-service object, caller payload block, five caller arguments, and fixed mode-variant flag while using service handle [+0x6c] plus external callbacks 0x005c81e4/0x005c8248/0x005c824c, and 0x0058123c is the cache-or-create factory above that strip, walking the same global cache root 0x00db89e4 for a matching target, otherwise allocating one 0xb0-byte object, running 0x00580867, and finishing construction through 0x00580be8. Immediately below that service factory the local container strip is now bounded too: 0x005812b1/0x005812c1/0x005812cf/ 0x0058133d/0x00581371 form the reset, release, push, pop, and status helpers for one growable dword-pointer vector, while 0x00581379/0x0058138c/0x005813bd/0x00581470/0x005814a4 do the same for the sibling growable string-pointer vector with accumulated byte count at [+0x10], and 0x005814ac is the first owner above that string-vector family, building one newline-joined text object from the stored strings. The adjacent object strip is now bounded too: 0x00581673/0x005815cf/0x005815dc/0x00581610 are the init, addref, refcount-drop, and release wrappers for vtable 0x005e0bd8, 0x00581594 is the destructor, 0x005815a9 allocates the owned text buffer, 0x005815fc/0x00581606 are the direct getters for that buffer and its stored length, and 0x0058162c is the matching IUnknown plus custom-IID query gate. The adjacent SIMD math strip is now bounded too: 0x00581690 applies the first two basis rows plus translation row [+0x30] to one XY pair and stores the full vec4 result, 0x005816d0 is the projective sibling that scales by a reciprocal derived from lane 3 and returns projected XY, and 0x00581730 is the translation-free low-64-bit sibling over just the first two basis rows, while 0x00581770/0x00581830/0x005818f0 are the corresponding 3D XYZ helpers for basis-only, basis-plus-translation, and projected basis-plus-translation output, 0x005819f0 is the direct 4D vec4-by-4x4 basis application helper, 0x00581ab0 is the four-row batch sibling over a full 4x4 source block, and 0x00581c00/0x00581cd0 are the shared normalize-or-zero helpers for vec3 and vec4 input. One level wider, 0x00581db0 is now bounded as the shared 4x4 inversion helper with optional determinant outparam, 0x00582070 is the packed-output batch sibling to the earlier four-row 4D basis application helper, 0x005821d0 is a standalone 4D cross-product-like helper over three vec4 inputs, 0x00582280 is the unchecked vec4 normalization sibling, and 0x00582320/0x005823e0/0x00582470/0x00582520 are the first cubic-basis interpolation helpers in the same math strip for vec3, vec2, vec4, and the first alternate-basis vec3 case. The same family now extends cleanly through 0x005825e0 and 0x00582680 as the alternate-basis vec4 and vec2 siblings, then into 0x00582710/0x00582770/0x005827c0 as the two-scalar affine blend helpers computing p0 + s*(p1-p0) + t*(p2-p0) for vec3, vec4, and vec2 inputs. The next geometry leaves are bounded too: 0x00582820 is the plane-versus-segment intersection helper over one plane vec4 and two vec3 endpoints, 0x005828e0 is the standalone 4x4 determinant helper beside the nearby inversion body, and 0x005829b0 builds one plane vec4 from three vec3 points by cross product, normalization, and signed-distance writeout. The next quaternion strip is now bounded too: 0x00582c30 builds one 4x4 rotation matrix from a quaternion-like vec4, 0x00582d10 is the quaternion product helper, and 0x00582da0 is the unchecked quaternion-normalization sibling. The adjacent plane-and-quaternion leaves are tighter now too: 0x00582aa0 is the shared plane-driven projective 4x4 matrix builder over one plane vec4 and one second vec4 input, 0x00582e40 is the quaternion inverse helper that conjugates the spatial XYZ lanes and divides by squared length, 0x00582eb0 rebuilds one quaternion from a caller 3x3 rotation-matrix block, and 0x00582fd0 builds one quaternion from three caller Euler angles by halving them, routing the packed tuple through trig helper 0x0058aa70, and then combining the resulting sine and cosine lanes. The next packed-row sibling strip is now bounded too: 0x005830a0 applies one compact 3x3 basis block to one vec3 input, 0x00583160 is the translation-bearing vec4 sibling, 0x00583220 is the packed projective vec3 sibling that scales by a reciprocal derived from lane 3, 0x00583320 is the packed 4x4 vec4 application helper, 0x005833e0 is its four-row batch sibling over a full caller 4x4 source block, 0x00583530/0x00583600 are the packed vec3 and vec4 normalize-or-zero siblings of 0x00581c00/0x00581cd0, 0x005836e0 is the packed 4x4 inversion sibling with optional determinant outparam, 0x005839a0 is the packed-output batch sibling of 0x005833e0, and 0x00583b00 is the packed-row sibling of the earlier 4D cross-product helper. The same packed analogue strip now extends further: 0x00583cc0 is the packed 4x4 determinant sibling, 0x00583d90 is the packed three-point plane builder, 0x00583e80 is the packed plane-driven projective 4x4 matrix builder, 0x00584010 is the packed quaternion-to-matrix sibling, 0x005840f0 rebuilds one quaternion from a packed 3x3 rotation-matrix block, and 0x00584210 is the packed Euler-angle-to-quaternion sibling using packed trig helper 0x0058ad50. The lower trig seam is bounded now too: 0x00583bb0 and 0x00583c30 are the two single-angle packed axial rotation-matrix variants above the same trig layer, 0x0058ac60 is the interleaved packed sine/cosine helper they share, and 0x0058ad50 is the wider packed sin/cos vector generator used by the packed Euler-angle-to-quaternion helper. The MMX or 3DNow analogue seam is bounded now too: 0x005842e0 is the quaternion-product sibling, 0x00584379/0x005843d6 are the vec4 and vec3 normalize-or-zero siblings, 0x00584489 rebuilds one quaternion from a 3x3 rotation-matrix block, 0x005848ba is the MMX or 3DNow Euler-angle-to-quaternion sibling using scalar trig helper 0x0058b660, 0x0058497f is the explicit axis-angle-to-quaternion sibling, 0x005849eb is the core quaternion slerp helper, 0x00584b22 and 0x00584baf are the next two nested-slerp multi-control helpers, 0x00584c41 is the quaternion inverse sibling, 0x00584ca5 extracts an axis-angle-style vec4 from one quaternion, and 0x00584d4c is the scaled-axis-to-quaternion sibling. The next broader MMX owner is bounded now too: 0x00584df1 takes four caller key quaternions, aligns neighboring keys onto a common hemisphere, converts the two relative deltas around each interior key through the already-grounded inverse and axis-angle-style helpers, averages those tangent-like terms, exponentiates back into quaternions, and multiplies by the interior keys to write two inner spline-control quaternions. The immediate plane-and-matrix seam after that is tighter now too: 0x00585b4b is the row-major MMX translation-matrix constructor, 0x00585b9b is the MMX sibling to the shared plane-driven projective 4x4 matrix builder, 0x00585c86 is the paired plane-reflection matrix helper, and 0x0058a988 is the shared normalize-by-XYZ-length helper beneath those plane-driven bodies, while 0x0058a8ca is the MMX origin-plane-versus-segment intersection sibling and 0x0058a9ec is the MMX 4D vec4-by-4x4 basis application sibling. The immediate matrix seam after that is bounded too: 0x00585d62/0x00585dc5/0x00585e23 are the three single-angle MMX axial 4x4 rotation-matrix variants, 0x00585e7c is the MMX diagonal scale-matrix constructor rather than a translation helper, 0x00585ec3 is the small 4x4 transpose or repack helper, 0x00585f32 is the MMX identity-matrix constructor, and 0x00585f6b/0x0058603d are the two MMX quaternion-to-4x4 rotation-matrix variants. The adjacent broader matrix owner beneath that constructor strip is bounded too: 0x0058584a is the non-alias-staging MMX 4x4 multiply sibling that repacks one split-qword matrix to temporary contiguous rows before multiplying it through the second caller matrix, 0x00585a7c is the scalar determinant helper for the upper 3x3 basis of the same split-layout 4x4 matrix family, 0x005860f2 is the broader affine-transform owner that builds one matrix from optional base translation, base rotation, pivoted post-rotation, and trailing translation-delta inputs, 0x0058728a is the adjacent three-angle rotation-matrix builder that uses half-angle trig rather than the single-angle strip, 0x0058742f is the uniform-scale sibling that adds one optional pivoted quaternion rotation and one trailing translation delta, 0x00587963 is the axis-angle rotation-matrix sibling over a normalized axis vec3 plus one caller angle, and 0x00587a7c is the broader shared transform owner that supports one base translation, up to two optional pivoted quaternion rotations, and one trailing translation delta. One lower MMX sibling strip is bounded now too: 0x005895fa is the 3D basis-plus-translation-to-vec4 sibling of 0x00581830, 0x0058966b is the basis-only vec3 sibling of 0x00581770, 0x005896d2 is the vec3 normalize-or-zero sibling of 0x00581c00, and 0x00589731 is the two-scalar affine vec3 blend sibling of 0x00582710. The next MMX interpolation strip is bounded too: 0x005897a2 is the cubic-basis vec3 sibling of 0x00582320, 0x00589876 is the alternate-basis vec3 sibling of 0x00582520, 0x00589960 is the projective 3D basis-plus-translation sibling of 0x005818f0, 0x005899eb is the four-row 4D basis application sibling of 0x00581ab0, and 0x0058a1aa is the cubic-basis vec2 sibling of 0x005823e0. The remaining low-dimensional MMX strip is bounded now too: 0x0058a0b8 is the 2D basis-plus-translation-to-vec4 sibling of 0x00581690, 0x0058a10d is the basis-only vec2 sibling of 0x00581730, 0x0058a146 is the projective 2D sibling of 0x005816d0, 0x0058a242 is the affine vec2 blend sibling of 0x005827c0, 0x0058a28b is the vec2 normalize-or-zero sibling, 0x0058a2ce is the alternate-basis vec2 sibling of 0x00582680, 0x0058a379 is the duplicate-layout 4D vec4-by-4x4 basis application sibling, 0x0058a3fb is the four-lane normalize-or-zero sibling, 0x0058a45a is the MMX 4D cross-product sibling of 0x005821d0, 0x0058a58c is the affine vec4 blend sibling, 0x0058a5fd and 0x0058a6c5 are the cubic and alternate-basis vec4 siblings of 0x00582470 and 0x005825e0, 0x0058a7a3 builds one plane vec4 from a normal vec3 plus point, and 0x0058a7e6 is the three-point plane builder sibling of 0x005829b0. The broader MMX matrix seam just above those leaves is bounded now too: 0x00588eb2 is the alias-safe packed 4x4 multiply owner over two caller matrices, 0x00588bd0 and 0x005892aa are the two broader MMX 4x4 inverse helpers with optional determinant output, 0x005895de is the thin FEMMS wrapper over 0x005892aa, 0x00589bb2 is the tiny thunk into the projective vec3 apply helper 0x00589960, 0x00589bb7 selects identity or the ordered composition of up to three optional 4x4 inputs through 0x005899eb, applies the resulting chain through 0x00589960, and optionally remaps the normalized result into one caller integer viewport-style range block, 0x00589d3f is the inverse-side sibling that composes the same optional chain, inverts it through 0x005892aa, optionally maps one caller integer viewport-style coordinate triple back into normalized projective space, and then applies the inverse chain through 0x00589960, and 0x00589f67 is the adjacent inverse-projective sibling that uses alternate inverse helper 0x00588bd0 before the same viewport-normalize and projective-apply tail. The scalar trig roots beneath the quaternion side are bounded now too: 0x0058af80 is the shared scalar atan2-style angle worker, 0x0058b080 is the shared scalar arccos-style angle worker, 0x0058b180 is the adjacent alternate arccos-style branch, 0x0058b280 and 0x0058b380 are the scalar natural-log and base-10-log helpers, 0x0058b3a0 is the scalar natural-exponential helper, 0x0058b480, 0x0058b4a0, 0x0058b4c0, and 0x0058b500 are the scalar square-root, absolute-value, ceil-style, and floor-style helpers, 0x0058b540 and 0x0058b580 are the adjacent frexp-style split and ldexp-style scale helpers, 0x0058b5de and 0x0058b600 are the compact modf-style split and fmod-style remainder helpers, 0x0058b660 returns one cosine/sine-style lane pair from one caller angle, 0x0058b780 is the paired scalar sine-lane helper used when callers only need that one branch duplicated, and 0x0058b9e0 is the broader scalar pow(x, y) owner that stitches the adjacent log and exponential strips back together. After that point the strip stops looking like separate command leaves and turns back into broader owner bodies. The next adjacent command leaves are bounded the same way: shell_command_dispatch_scenario_followon_0x437d70_if_active 0x00441340 is a guarded hop into the real cheat-code owner shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats 0x00437d70. That owner increments the shared shell counter at [0x006d401c+0xc60], opens the localized cheat prompt 2922 Do I detect a cheater in the house?\n\nEnter code (or <ESC> to cancel):, and then scans the fixed 26-entry table at 0x005ee2c8. The active selector strip is now grounded: winner/loss strings 3618/3619/3620/3622 route through 0x004367c0, selector 1 jumps to the out-of-line reset branch at 0x004d676c that clears the selected-company stat bands rooted at [company+0x0cfb], [company+0x0d7f], and [company+0x1c47], selectors 2 and 3 post deltas into the selected company and selected chairman profile through 0x0042a080 and 0x00476050, selector 4 resolves one locomotive by primary or alias stem through 0x00461c00 and applies it to every selected-company train through 0x004aefb0, selector 5 forces territory-access byte 1 across the live territory table through 0x00424030, selector 7 now reads more tightly as the train-crash branch because 0x004ad7a0(1) is also the direct shell-command owner behind the 365 warning There is no train available to crash!, and selectors 6/8/9/10 toggle bytes [state+0x4c8f/+0x4c8e/+0x4c8d/+0x4c8c]. The same table also contains the later cheat labels 3634 Orca and the alias-only tail Katie..Seymour, but those rows currently sit above the visible jump-table bound 0x0a, so the safest static read is that they are unreached or handled elsewhere rather than active cases in this owner. By contrast shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0 0x00441360 requires the same single-profile gate, resolves one subject through 0x0040b2d0(0, 1), and then forwards that result into shell_world_focus_selected_subject_kind_and_id 0x00437a90. The neighboring current-train command strip is bounded now too. Shared helper 0x00441790 resolves either the currently focused world-view train or one fallback train, but only keeps it when the owner company matches the current scenario-selected company. On top of that resolver, 0x00441810 is the direct Current train crashes command: it opens localized warning 365 when no owned train survives, otherwise it forwards the train into the crash owner 0x004ad7a0(1). 0x004418a0 is the paired Current train breaks down command with the same gate and warning 366, but it forwards into the named breakdown owner 0x004ada00(1). 0x00441870 is the simpler Current train whistles command, which resolves the same owned train, finds the train-side visual owner through 0x004a77b0, and writes request dword 1 into [owner+0x33a]. The immediately adjacent helper strip is bounded now too: 0x004a77d0 is a tiny two-float query over the same linked route object, defaulting both caller outputs to 10.0f when [train+0x41] is empty and otherwise tail-calling the lower linked-route metric helper 0x0041add0; and 0x004a7810 is the neighboring linked-route row-band refresh that walks [route+0x316] / [route+0x31a], treats literal steam emitter definitions specially through effect_name_matches_literal_steam 0x004749a0, and flips row byte [row+0x1d8] accordingly. The shell command strip on the other side is tighter too: 0x00441900, 0x00441940, 0x00441980, 0x004419c0, and 0x00441a00 are the five repeated Overview.win page toggles over detail-manager mode 9, each closing the current page through shell_detail_panel_transition_manager 0x004ddbd0(-1, 0) when that exact page is already active and otherwise requesting mode 9 with page ordinals 0..4. shell_station_list_format_freight_and_express_availability_summary 0x00506e50 feeds the station-list summary %1 has %2 freight loads and %3 express loads available for hauling..., and the paired modifier helper shell_station_list_handle_center_or_rename_action 0x00506d50 owns the visible Shift-center and Ctrl-rename row actions. The list owner itself is tighter now too: shell_station_list_window_refresh_rows_selection_and_status 0x00506f30 is the real StationList.win row and status refresh pass, clearing and repopulating controls 0x61a9 and 0x61aa, wiring the visible summary and modifier callbacks, mirroring the shared selected-station latch at [0x006cec78+0x4cba] when it still belongs to the current company, and updating the two status labels 0x61af and 0x61b0. The row-side callout lane is tighter too: shell_station_list_row_callback_publish_station_callout_card 0x00506ac0 is the actual row callback beneath both list controls, resolving the selected station, deriving one category header through 0x0053de00 and 0x00552560, and then publishing the station-name plus freight and express callout card through repeated shell_publish_text_callout_presentation calls. The side-selector branch is tighter too: shell_station_list_window_handle_message no longer just re-enters the raw StationPick.win constructor. It flips the active side bit at 0x006d1710 and then re-enters the modal helper shell_station_pick_window_open_modal_and_return_selected_station_id 0x005078c0, which allocates one helper window, runs shell_station_pick_window_construct 0x00507620, brackets the modal show path, and returns the staged selected station id from 0x00622ae8. Inside that helper family, shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event 0x005075c0 now bounds the small message-normalization strip beneath controls 0x80e8..0x80ea. The Shift-center side is tighter now too: the shared helper 0x00433900 takes one object pointer plus one small mode, derives one mode-specific (distance,height) preset from the target's virtual classification, and then re-enters 0x0043c9a0 to center the live world view on that object. The report side is clearer as well: 0x004d3060 is the dedicated Stats - Trees constructor over map_editor_tree_stats_report, 0x004d3080 is the actual General Validation constructor over map_editor_general_validation_report, and the same page table also now grounds Stats - Cargo, Stats - City/Region, Stats - City Count, Event Variable Values, and the neighboring event-validation page. The remaining open editor edge is therefore mostly the deeper gameplay meaning of those site-side service scores and flag bits, not page ownership.