| 1 | address | size | name | subsystem | calling_convention | prototype_status | source_tool | confidence | notes | verified_against |
|---|
| 2 | 0x004010f0 | 521 | city_compute_connection_bonus_candidate_weight | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Computes one city-side weight for the connection-bonus news and placement lanes. The helper rejects early when the city subtype field `[this+0x23e]` is nonzero, then builds a base float from the city-side scalar fields `[this+0x306]`, `[this+0x30a]`, and `[this+0x30e]`. When the optional stack company id is nonzero it also resolves the city's derived coordinates through `0x00455800` and `0x00455810`, probes the live world root at `0x0062c120` through `0x0044e270`, and rejects the city unless the selected company passes the follow-on world-side ownership or access check through `0x00424010`. The helper then scans the live placed-structure collection at `0x006cec20`, filters peers through `0x0041f6e0` plus the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, counts qualifying linked sites in the city, and detects whether one rival company already has an eligible linked site there. The final weight is scaled down by the inverse of `(qualifying_site_count + 1)` and then further damped when rival ownership is present, so the current grounded meaning is a city connection-bonus opportunity weight rather than a simple population or size score. Current grounded callers are the company-side news sweep at `0x00406050` and one neighboring setup-side branch at `0x00404d90`. | objdump + caller xrefs + callsite inspection + city-bonus correlation |
| 3 | 0x004013f0 | 177 | world_run_company_start_or_city_connection_chooser_with_region_field_0x2d_temporarily_cleared_if_rule_0x4b07 | map | cdecl | inferred | llvm-objdump + local disassembly + caller correlation | 3 | Small world-side wrapper above the broader chooser `0x00404ce0`. When scenario slot `[0x006cec78+0x4b07]` is nonzero, the helper walks all `0x18` live region records in `0x006cfc9c`, snapshots dword `[region+0x2d]` into one stack buffer, and temporarily zeros that field across every live entry. It then runs `0x00404ce0(1, 0, 0)` and restores the original `[region+0x2d]` values before returning the chooser result. Current grounded caller is the startup-side branch at `0x00407592`, and current atlas correlation ties slot `0x4b07` to the editor rule `AI Ignore Territories At Startup`, so this is the safest current read for the temporary territory-field suppression wrapper rather than a generic region iterator. | llvm-objdump + local disassembly + caller correlation + region-collection correlation + scenario-rule correlation |
| 4 | 0x004014b0 | 1194 | company_try_buy_unowned_industry_near_city_and_publish_news | simulation | thiscall | inferred | objdump + callsite inspection + RT3.lng strings | 2 | Company-side acquisition and headline helper beneath the broader periodic company service pass at `0x004019e0`. The function requires at least two linked transit sites through `company_count_linked_transit_sites` `0x00426590`, rejects when scenario finance toggle `[0x006cec78+0x4abf]` is set, and then scans the live building or structure collection at `0x0062b26c` for the best current acquisition target. Current grounded candidate filters are: the record must not already have an owner in `[site+0x276]`, its linked candidate subtype gate through `0x0040d360` must identify subtype `4`, the company-specific price or affordability metric from `0x0040d540` must stay below the current company metric window, and the record must be at least three years old from `[site+0x3d5]`. Surviving candidates are scored through local profitability or demand helpers around `0x0040cac0`, `0x0042c820`, `0x00455f60`, and the current company support scalar, and the best surviving site id is then committed through `0x004269b0`. On success the helper localizes the acquired structure type through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`, resolves the nearby city or region entry through `0x004220b0`, and emits RT3.lng `2880` `%1 has bought a %2 near %3` through the shell news helper at `0x004554e0`. This is now the strongest current match for the acquisition-side sibling beneath the broader company periodic pass, though some lower structure-side helper semantics remain open. | objdump + callsite inspection + RT3.lng strings + acquisition-news correlation + structure-scan correlation |
| 5 | 0x00401860 | 221 | company_query_cached_linked_transit_route_anchor_entry_id | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Returns one cached route-entry anchor id used by the linked-transit company cache family. The helper first validates the cached id at `[this+0x0d35]` against the live route-entry collection `0x006cfca8`, requiring the resolved record to carry this company id in word `[entry+0x22e]` and byte value `2` in `[entry+0x216]`; otherwise it clears the cache to `-1`. When the cache is empty but the three company-side count lanes `[this+0x7664]`, `[this+0x7668]`, and `[this+0x766c]` still sum positive, it scans the route-entry collection for the first record that satisfies those same owner and class predicates and then caches the record's linked anchor id from `[entry+0x202]`. Current grounded caller is `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`, where the returned route-entry id is used as the company-side anchor for the narrower linked-transit reachability gate. | objdump + caller xrefs + callsite inspection + route-entry-anchor correlation |
| 6 | 0x00401940 | 152 | company_reset_linked_transit_caches_and_reseed_empty_train_routes | simulation | thiscall | inferred | objdump + callsite inspection + linked-transit correlation | 2 | Small linked-transit reset helper beneath the broader company service family. The function clears the two company-side linked-transit cache timestamps at `[this+0x0d3e]` and `[this+0x0d3a]`, immediately re-enters `company_service_linked_transit_site_caches` `0x00409720`, and then walks the live train collection `0x006cfcbc` for company-owned trains. For owned trains in operating modes `0x0a` or `0x13` it removes every existing route-list entry through `train_route_list_remove_entry_and_compact` `0x004b3000`; when the route list is empty it then re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770`. Current grounded meaning is a local linked-transit cache reset plus empty-route reseed pass rather than a broader train-service sweep. | objdump + callsite inspection + linked-transit correlation + train-route-reset correlation |
| 7 | 0x004019e0 | 611 | company_service_periodic_city_connection_finance_and_linked_transit_lanes | simulation | thiscall | inferred | objdump + callsite inspection + caller correlation + RT3.lng strings | 2 | Broader periodic company-side service pass above the currently grounded city-connection, finance, and linked-transit lanes. The helper first rejects inactive or special-case companies through `[this+0x3f]` and `0x00425b90`, clears the transient company-side latches at `[this+0x0d17]`, `[this+0x0d18]`, and `[this+0x0d56]`, and temporarily mirrors one locomotive-derived byte from `[this+0x0d17]` into scenario field `[0x006cec78+0x4c74]` while the earlier route-building side of the body runs, restoring the original scenario value on exit. Current evidence now bounds those byte latches more narrowly: `[this+0x0d17]` is this transient route-search preference override, currently seeded only when `company_select_preferred_available_locomotive_id` `0x004078a0` resolves one locomotive whose engine-type dword `[record+0x10]` equals `2`; wider engine-type evidence now makes that best-read as the electric lane, since the linked approval helper around `0x0041d550` dispatches the same `0/1/2` field across three scenario opinion slots while the local language family `706..709` and help text `3848` bound the player-facing triplet as `Steam`, `Diesel`, and `Electric`. The route-search side is tighter now too: this mirrored byte is not just reusing a display preference slot abstractly, it feeds the same initial path-sweep branch in `route_entry_collection_run_initial_candidate_path_sweep` `0x0049bd40` that explicit route-policy byte `4` uses, selecting the larger `1.8` quality multiplier instead of `1.4` before the later acceptance checks. `[this+0x0d18]` is the city-connection announcement-side latch reused by `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; and `[this+0x0d56]` is the linked-transit train-service latch later set by the train-add, train-upgrade, and route-builder-side cache-refresh family around `0x00409830`, `0x00409300`, and `0x0040457e -> 0x004093d0`. The ordering matters too: this owner clears those latches up front, runs the city-connection and linked-transit branches first, and only later enters `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, so the finance helper is reading same-cycle side-channel state rather than stale long-lived flags. It then gates and schedules several narrower service families: the city-connection announcement side through `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` and `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; the acquisition-side sibling through `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`; the linked-transit train side through `company_balance_linked_transit_train_roster` `0x00409950`; the broader annual finance and governance helper through `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`; and the linked-transit cache refresh tail through either `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` or `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` depending on current scenario mode byte `[0x006cec78+0x0f]`. This name stays intentionally conservative: it is the broader periodic owner above those lanes, not a fully split policy map yet. | objdump + callsite inspection + caller correlation + RT3.lng strings + linked-transit correlation + city-connection correlation + acquisition correlation + latch correlation + sequencing correlation + temporary-route-preference correlation + locomotive-choice correlation + engine-type correlation + route-search-threshold correlation |
| 8 | 0x004078a0 | 815 | company_select_preferred_available_locomotive_id | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Selects one preferred locomotive id for the current company from the live locomotive collection at `0x006ada84`. The helper iterates the live locomotive records, applies company-and-chairman availability gating through the linked approval family around `0x0041d550`, accumulates one weighted preference score from locomotive fields `[record+0x20]`, `[+0x28]`, `[+0x18]`, `[+0x1c]`, `[+0x0c]`, and the linked class or era record at `[record+0x72]`, and keeps the strongest surviving locomotive id, falling back to `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0` when no scored candidate survives. Current grounded callers are the periodic company service pass `0x004019e0`, the temporary route-side mode chooser around `0x00402d5f`, the linked-transit train-upgrade news helper `0x00409300`, and the linked-transit train-add helper `0x00409830`. Current evidence now also bounds one route-policy side effect above it: `0x004019e0` only arms its temporary `[company+0x0d17] -> [0x006cec78+0x4c74]` override when the chosen locomotive record carries engine-type value `2` in `[record+0x10]`, which now best aligns with the electric lane rather than an unnamed class slot. | objdump + caller xrefs + callsite inspection + locomotive-collection correlation + preferred-choice correlation + engine-type correlation |
| 9 | 0x00401c50 | 3016 | company_evaluate_annual_finance_policy_and_publish_news | simulation | thiscall | inferred | objdump + callsite inspection + RT3.lng strings | 2 | Large annual company finance-policy helper beneath the broader periodic service pass at `0x004019e0`. The earliest creditor-pressure or bankruptcy lane is now bounded more tightly: it requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since the last bankruptcy stamp at `[this+0x163]`, and at least `4` years since founding year `[this+0x157]`. It then scans the last three years of derived finance lanes through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, accumulating the net-profits lane `0x2b`, counting one three-year failure condition from the revenue aggregate `0x2c`, selecting one negative cash-and-debt stress ladder `-600000 / -1100000 / -1600000 / -2000000` from the current slot-`0x2c` band split at roughly `120000 / 230000 / 340000`, requiring the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` to be at least `15` or `20` depending on whether all three years failed, checking the current fuel-cost lane in slot `0x09` against `0.08` times that ladder, and requiring both `edi >= 2` plus the three-year slot-`0x2b` accumulator to clear one final `-60000` threshold before it commits bankruptcy through `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90` and formats RT3.lng `2881` `%1 has declared bankruptcy!`. The helper also has one later deep-distress fallback bankruptcy lane on the no-action fallthrough before the build-`1.03+` stock-issue branch: with the same bankruptcy toggle clear, current cash below `-300000`, at least `3` years since founding, no recent automatic finance action already chosen, the first three recent net-profits lanes each at or below `-20000`, and at least `5` years since the last bankruptcy stamp, it commits the same bankruptcy path and news family again. The later debt-capital restructuring family mutates the live company through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, `company_issue_bond_and_record_terms` `0x004275c0`, `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and `company_issue_public_shares_and_raise_capital` `0x00427450`, then formats the RT3.lng `2882..2886` headlines `%1 has refinanced %2 of debt.`, `%1 has refinanced %2 of debt and borrowed %3 on top of that.`, `%1 has refinanced %2 and paid off a further %3 of debt.`, `%1 has paid off %2 of its debt.`, and `%1 has borrowed %2 in debt.` The message-side tail is tighter now too: it accumulates total retired principal in one counter and total newly issued principal in another, then chooses the debt headline family by comparing those two totals directly: equal -> `2882` refinance only, issued greater -> `2883` refinance plus extra borrowing, retired greater -> `2884` refinance plus additional payoff, issued zero -> `2885` debt payoff only, and retired zero with issued positive -> `2886` straight new borrowing. The middle annual bond lane is tighter now too: when the bond toggle `[+0x4a8b]` is clear, it first simulates full bond repayment through repeated `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, then uses the resulting cash-side window with the fixed `-250000` and `-30000` thresholds plus the broader linked-transit train-service latch `[this+0x0d56]` to decide whether to stage one or more `500000` principal, `30`-year bond issues through `company_issue_bond_and_record_terms` `0x004275c0`. The repurchase lane is distinct from the later share-issue path: when the city-connection announcement-side latch `[this+0x0d18]` is set, editor growth setting `2` does not suppress it, and the stock toggle `[+0x4a87]` is clear, it starts from one `1000`-share batch and one default factor `1.0`, can replace that with a linked-chairman personality scalar `([table byte * 39] + 300) / 400`, scales that factor by `1.6` when growth setting `[0x006cec78+0x4c7c] == 1`, uses the resulting factor in one `800000` stock-value gate and one support-adjusted share-price scalar times factor times `1000` times `1.2` affordability gate, requires enough unassigned shares through `company_count_unassigned_shares_after_active_chairman_holdings` `0x004261b0`, and then commits repeated `1000`-share repurchases through `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`; this is the current strongest threshold owner behind RT3.lng `2887`. The repurchase tail also now reads cleanly: it accumulates the total repurchased public-share count in a dedicated counter and publishes `2887` from that total after the debt headline branch. The sequencing above this helper now bounds those two latch reads more clearly: `0x004019e0` clears them first, then the city-connection and linked-transit branches may set them earlier in the same periodic pass, so the bond and repurchase lanes are currently best read as same-cycle reaction policy rather than long-term company-state policy. The later stock-issue lane is now tighter in exact order, not just broad shape: it only opens on build `1.03+`, only after the earlier bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since founding. It derives one prospective equity tranche from roughly one-tenth of the current outstanding-share count, rounded down to `1000`-share lots with floor `2000`, trims that tranche downward until the pressured support-adjusted share-price scalar times tranche no longer exceeds the `55000` proceeds cap, recomputes the same share-price scalar under the negative tranche pressure term, clamps `Book Value Per Share` from stat-family `0x2329/0x1d` to a minimum `1.0`, and forms the normalized price-to-book ratio before any approval tests. The tested gates then run in a fixed order: share-price floor `>= 22`, pressured proceeds floor `>= 55000`, current cash from `0x2329/0x0d` against the highest-coupon live bond principal plus the fixed `5000` buffer, one later issue-cooldown or last-issue timestamp gate from `[this+0x16b..]`, and only then the piecewise coupon-versus-price-to-book ladder `0.07/1.3`, `0.08/1.2`, `0.09/1.1`, `0.10/0.95`, `0.11/0.8`, `0.12/0.62`, `0.13/0.5`, and `0.14/0.35`. On success it issues two same-sized public-share tranches through repeated `company_issue_public_shares_and_raise_capital` `0x00427450` calls and formats a separate equity-offering news family rooted at localized id `4053`, not the earlier `2882..2887` debt-or-buyback headlines. The dividend-side branch is now bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be clear, scenario mode `0x0c`, at least `1` year since `[this+0x0d2d]`, and at least `2` years since founding; it then converts a weighted `3/2/1` blend of the last three net-profits lanes `0x2b` into one tentative dividend-per-share target, supplements that target with current cash only on the tiny-unassigned-share branch below `1000`, and still folds in the map-editor building-density growth setting `[0x006cec78+0x4c7c]`. Current grounded postblend behavior is: growth setting `1` scales the existing dividend by `0.66`, growth setting `2` zeros it, computed deltas at or below `0.1` collapse to zero, larger deltas are quantized in tenths, and the final value is clamped against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. The tail also refreshes `CompanyDetail.win` when the selected company matches `[0x006cfe4c]`. This now grounds the main finance verbs and first-layer threshold ordering under the annual policy pass, though some lower helper semantics still remain open. | objdump + callsite inspection + RT3.lng strings + finance-policy correlation + bankruptcy/debt-news correlation + repurchase-news correlation + equity-offering-news correlation + finance-mutator correlation + threshold correlation + latch correlation + sequencing correlation + stock-data-label correlation + highest-coupon-bond correlation + income-statement-row correlation + derived-report-metric correlation + valuation-vs-borrowing correlation + weighted-dividend-target correlation + deep-distress-bankruptcy correlation + debt-headline-tail correlation + repurchase-headline-tail correlation + stock-issue-ordering correlation |
| 10 | 0x00402c90 | 19 | placed_structure_resolve_linked_candidate_record | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Tiny placed-structure-to-candidate resolver over the global candidate collection at `0x0062b268`. The helper reads one candidate id from `[this+0x173]`, re-enters the shared indexed-collection record resolver at `0x00518140`, and returns the resulting candidate record pointer. Current grounded caller is the BuildingDetail-side branch at `0x00506441`, where it is used immediately after resolving one placed-structure record from `0x0062b2fc`. This now looks like the direct placed-structure linked-candidate accessor rather than another anonymous local helper. | objdump + caller xrefs + callsite inspection + collection-resolver correlation |
| 11 | 0x00402cb0 | 3457 | city_connection_try_build_route_with_optional_direct_site_placement | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Shared heavy route-builder and optional direct-placement helper beneath the city-connection route and news family. The function starts at a clean prologue at `0x00402cb0`, seeds one builder-state latch band at `[this+0xf5]`, `[this+0xf6]`, `[this+0xf8]`, `[this+0xfa]`, `[this+0xfc]`, and `[this+0x10a]`, and then splits into three grounded internal lanes. The first is an early route-entry search or synthesis lane through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` over the global route-entry store `0x006cfca8`, which can seed the builder-state block and succeed without placing a new site. The second is a single-endpoint direct-placement lane around `0x00403d92..0x00403ef3`: it scans the live placed-structure collection `0x0062b2fc` for `Maintenance` and `ServiceTower` stems, projects one candidate placement through `0x00417840`, validates it through `0x004197e0`, and then commits through the first direct placement branch `0x00403ed5 -> placed_structure_collection_allocate_and_construct_entry` `0x004134d0` -> `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`. The third is a later paired-endpoint fallback lane around `0x00403f41..0x00404489`: it seeds two endpoint candidates from the same `Maintenance` and `ServiceTower` stem scan, builds one temporary route-entry candidate list, iterates that list against span and year-scaled step terms, projects trial placements through `0x00417840`, and on success commits through the second direct placement branch `0x0040446b -> 0x004134d0 -> 0x0040ef10` before clearing a small exclusion window in the temporary list. Outside those lanes it also re-enters geometry, region, and route-store helpers around `0x004423a0`, `0x00482e00`, `0x004931e0`, `0x00494310`, and the global route-entry stores `0x006cfcb4` / `0x006cfca8`, and it can still unwind through route-state cleanup without committing new placed structures. Current grounded external callers are still entirely in the city-connection family: the compact region-entry wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` `0x00404640`, the peer-route candidate builder `city_connection_bonus_build_peer_route_candidate` `0x004046a0`, the direct region-entry pair wrapper `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`. This now bounds the old unresolved `0x00403xxx..0x00404631` placement chooser as one shared city-connection route or placement helper with a cleaner internal policy split, even though some lower helper semantics remain open. | objdump + caller xrefs + callsite inspection + placement-correlation + route-builder correlation + Maintenance/ServiceTower scan correlation + route-entry search correlation |
| 12 | 0x004046a0 | 1388 | city_connection_bonus_build_peer_route_candidate | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Reusable candidate builder beneath the city-connection bonus news and status family. The helper starts from one region or city entry in collection `0x0062bae0`, rounds that entry's two normalized coordinate terms through `0x00455800/0x00455810 -> 0x005a10d0`, and then re-enters `city_connection_bonus_select_first_matching_peer_site` `0x00420280` with both selector flags forced on so it can recover one representative peer site. When a peer is found it resolves that site's derived coordinates through `0x0047df30/0x0047df50 -> 0x005a10d0`. If the caller supplies a live explicit route-anchor tuple, the helper first tries the heavy builder `0x00402cb0` directly with that tuple and, when no peer was found, falls back to the smaller wrapper `0x00404640`. If neither early path succeeds it builds one mixed local candidate list in 10-byte stack records from both global route stores `0x006cfcb4` and `0x006cfca8`: the first pass appends the two endpoint ids from each dense pair record, while the second appends the six-byte route-entry ids stepped by `+0x06`. It then marks each candidate's byte `+0x04` for route-anchor eligibility only when the site is class `2`, still has no competing runtime or route-owner state in the `0x020e..0x0244` band, and passes the `0x0048a1c0/0x0048a1a0/0x0048f290` route-anchor tests against the selected peer coordinates. The scoring tail skips ineligible or peer-owned entries, prefers the smallest span from `[site+0x206/+0x20a/+0x20e]` and the peer-coordinate rectangle, optionally upgrades the chosen route anchor through `0x0048e3c0`, and finally retries `0x00402cb0` with the best surviving candidate. Current grounded callers are the wider company-side city-connection bonus sweep at `0x00406050` and one neighboring branch at `0x00406b73`, which makes this the shared peer-route candidate builder above the city bonus peer-selector family rather than a direct UI formatter. | objdump + caller xrefs + callsite inspection + peer-selector correlation + route-builder correlation + candidate-list correlation + route-anchor-eligibility correlation |
| 13 | 0x00404640 | 82 | city_connection_bonus_try_compact_route_builder_from_region_entry | map | thiscall | inferred | objdump + caller inspection + route-builder correlation | 3 | Small route-builder helper beneath `city_connection_bonus_build_peer_route_candidate` `0x004046a0`. The helper resolves one caller-supplied region or city entry id through collection `0x0062bae0`, derives that entry's compact coordinate pair through `0x00401000`, reads one explicit route-anchor or peer-site id from `[this+0x00]`, and then re-enters the heavier route builder at `0x00402cb0` with that resolved coordinate pair plus default wildcard arguments `-1/0/-1` in the remaining route slots. Current grounded caller is the city-connection bonus candidate builder at `0x004047bf`, where this helper is used as the smaller fallback path when the earlier explicit-anchor route attempt does not apply. This now looks like the compact region-entry wrapper around the shared route builder rather than a generic coordinate helper. | objdump + caller inspection + route-builder correlation + city-bonus fallback correlation |
| 14 | 0x00404c60 | 124 | city_connection_try_build_route_between_region_entry_pair | map | fastcall | inferred | objdump + caller inspection + route-builder correlation | 3 | Compact fastcall route-builder above the shared route store at `0x006cfca8`. The helper resolves the two caller-supplied region or city entry ids through collection `0x0062bae0`, derives both endpoint coordinate pairs through `0x00401000`, and then re-enters the heavier route builder at `0x00402cb0` with those two endpoints plus the caller's remaining stack-side policy tuple. Current grounded callers are the pair-selection sweeps inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`, where it is used both for the early dense score matrix and the later selected-pair retry. This now looks like the direct region-entry pair wrapper around the shared route builder rather than another anonymous internal callsite. | objdump + caller inspection + route-builder correlation + pair-selection correlation |
| 15 | 0x00404ce0 | 3124 | simulation_try_select_and_publish_company_start_or_city_connection_news | simulation | fastcall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Broad fastcall city-pair chooser and news publisher above `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`. When the stack company-id argument is zero the helper sweeps up to `0xa0` region-or-city entries from `0x0062bae0`; when it is nonzero it first validates that company through collection `0x0062be10`, stat family `0x2329` mode `0x0d` via `0x0042a5d0`, and the territory-access gate `0x00424010`. Eligible city entries are filtered through `city_connection_bonus_exists_matching_peer_site` `0x00420030`, weighted through `city_compute_connection_bonus_candidate_weight` `0x004010f0`, damped by map-size terms, territory access, and current region flags, and stored into temporary score bands. The helper then builds one dense pair matrix, repeatedly re-enters `0x00404c60` to validate candidate city pairs, can update one company-side selected endpoint pair through `0x00426f20`, and finally publishes shell news through `0x004554e0`. Current grounded publication ids are `2889` `%1 has started a new company - the %2` and `2890` `%1 has connected %2 to %3.`. Current grounded callers are `0x00401455`, which temporarily clears region-state dwords `[0x006cfc9c+0x2d]` before a global pass, and `0x00401b36`, which re-enters the same chooser with the active company and linked chairman after the smaller company-side city-connection bonus lane falls through. This now looks like the broader company-start-or-city-connection headline chooser above the smaller city-connection bonus sweep at `0x00406050` rather than another anonymous route-builder. | objdump + caller inspection + RT3.lng strings + route-builder correlation + pair-selection correlation + publication-path correlation |
| 16 | 0x00405920 | 189 | company_query_min_linked_site_distance_to_xy | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Queries the minimum distance from one company to an input X or Y point pair. The helper walks the live placed-structure collection at `0x006cec20`, keeps only sites whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, samples each surviving site's derived coordinates through `0x0047ded0` and `0x0047df00`, and then computes one scalar distance against the caller-supplied coordinate pair through `0x0051dbe0`. It returns the minimum observed distance across all linked sites, clamped to a floor of `1.0` when a closer or degenerate result would go lower. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where this helper provides the distance term later blended into each city candidate score. | objdump + caller xrefs + callsite inspection + distance-term correlation |
| 17 | 0x00406050 | 2966 | company_evaluate_and_publish_city_connection_bonus_news | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Broader company-side city-connection bonus sweep above `city_connection_bonus_build_peer_route_candidate` at `0x004046a0`. The function first builds one announcement-value floor from several company-side helpers: stat family `0x2329` mode `0x0d` through `0x0042a5d0`, the wider company-state reader `0x00426ef0`, linked transit-site count `company_count_linked_transit_sites` `0x00426590`, the unlock gate `company_connection_bonus_lane_is_unlocked` `0x00427590`, and the bounded value ladder `company_compute_connection_bonus_value_ladder` `0x00425320`. It also enforces the version gate `0x00482e00 >= 0x67`, a transit-count cap `< 4`, and a minimum weighted city-value threshold above `50000`. Once those gates hold it walks the region-or-city collection at `0x0062bae0`, derives one per-city opportunity score from the city-side weight `city_compute_connection_bonus_candidate_weight` `0x004010f0`, the chairman-profile-scaled company metric, and current normalized city coordinates from `0x00455800/0x00455810`, and then keeps the best candidate ids in the persistent ten-entry band rooted at `[this+0x0d42]`. A second sweep validates those entries by re-entering `city_connection_bonus_build_peer_route_candidate`, then re-samples each surviving candidate's three route-anchor lanes `[site+0x206/+0x20a/+0x20e]`, counts reachable flagged peers, accumulates one integer bonus total through `0x0048b100`, refreshes transient route state through `0x0048f4c0`, and preserves `[site+0x240]` across that refresh on version `>= 0x67`. When at least one validated winner survives it publishes the winning score into company stat slot `0x0f` through `0x0042a040`, formats the city and company name lanes through `0x0051c000/0x0051b700/0x005193f0/0x00518de0`, and then emits localized news through `0x004554e0`. Current grounded publication ids remain `2888` `%1 has connected to %2.`, `2890` `%1 has connected %2 to %3.`, and `2921` `%1 has put a station in %2, but to win the %3 connection bonus, this station must be connected to ANOTHER city.`. When no winner survives it falls out without that publish and the surrounding caller can use the separate pending-bonus owner at `0x004358d0`. This is now the first grounded announcement owner above the city-connection bonus status formatter and peer-selector pair rather than just an anonymous caller around `0x004064c0`. | objdump + caller inspection + RT3.lng strings + peer-route candidate correlation + publication-path correlation + score-component correlation + validation-sweep correlation |
| 18 | 0x00407bd0 | 1697 | company_rebuild_linked_transit_autoroute_site_score_cache | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Slower per-company follow-on above the fast linked-transit peer cache. The helper stamps the current scenario tick into `[this+0x0d3a]`, then walks the live placed-structure collection and keeps only sites whose company-side cache cell at `[site+0x5bd][company_id]` is present and eligible. For each such site it refreshes the cache-cell tick at `+0x0a`, zeroes the three accumulated float lanes at `+0x0e`, `+0x12`, and `+0x16`, and then rebuilds those lanes from two phases. First it uses `placed_structure_count_candidates_with_local_service_metrics` `0x0047e330`, `0x0047e620`, and the issue-opinion helper `0x00437d20` to populate bounded candidate-local amount bands at stack `0x1a0..` and normalized scaling bands at `0x350..`. Then it re-enters the per-site peer buffer at cache `+0x06`, resolves each peer site's live service words through `0x0047de20`, and only keeps candidate lanes whose local amount still exceeds the peer baseline. The surviving excess amount accumulates raw into cache float `+0x12`, while the continuity share at peer float `+0x09` and route-step count at peer dword `+0x05` feed a second step-biased weighted accumulator in cache float `+0x0e` through the local `+0x28` denominator bias. A later grouped promotion pass chooses the strongest adjacent candidate bands and folds their weighted contribution into cache float `+0x16`, which is the final site-ranking lane consumed by the downstream site selector. That split now matters for the tracker compatibility question too: the pre-`1.03` versus `1.03+` pair-metric dispatcher at `0x004a65b0` can perturb peer step counts and continuity share, but on current evidence that only flows into the weighted `+0x0e` and promoted `+0x16` lanes, not the raw `+0x12` amount total. Current grounded callers are the company-side mode gate at `0x00401c2a`, the timed wrapper at `0x00409766`, and the fast-cache tail path at `0x004093cd`. This now reads as the slower autoroute-site score rebuild over the linked-transit peer cache family rather than an unnamed tail call. | objdump + caller xrefs + callsite inspection + linked-transit score-cache correlation + linked-transit consumer correlation + version-compatibility impact correlation |
| 19 | 0x00408280 | 255 | company_select_best_owned_linked_transit_site_by_autoroute_score | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Selects one owned linked transit site from the company-side autoroute cache family. The helper walks the live placed-structure collection, keeps only sites whose company cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the station-or-transit gate `0x0047fd50`. It then ranks the surviving sites by cache float `[cell+0x16]`, applying a small bonus when the placed-structure-side lanes `[site+0x5c1]` and `[site+0x5c5]` are both clear, and returns the winning site id or `-1` when no candidate survives. Current grounded caller is `company_build_linked_transit_autoroute_entry` `0x00408380`, where this helper provides the fallback start site when the caller does not already supply one. | objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation |
| 20 | 0x00408380 | 3215 | company_build_linked_transit_autoroute_entry | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. The downstream effect boundary is tighter now too: because this builder ranks peer-site candidates from the weighted peer-derived bands rather than the raw site totals, the pre-`1.03` versus `1.03+` tracker metric split is now best read as perturbing autoroute peer choice and seeded route-entry selection here, not the later company-wide train-pressure target at `0x00408f70`. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query. | objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation + version-compatibility impact correlation |
| 21 | 0x00408f70 | 864 | company_compute_owned_linked_transit_site_score_total | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Aggregates one company-side linked-transit train-pressure target from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the raw site score float at cache offset `+0x12` across the surviving sites while also retaining the first two representative site pointers and the eligible-site count. It then converts that raw total into the returned roster target through a year-dependent divisor ladder, later year-side multipliers, and site-count bands. On build `1.03+`, when exactly two eligible sites survive, it also measures the inter-site distance between those retained sites and applies an extra distance-side scaling branch before the final train-balance comparison. The compatibility boundary is now tighter too: because this helper sums cache `+0x12` rather than the weighted `+0x0e` or promoted `+0x16` lanes, current evidence says the pre-`1.03` versus `1.03+` tracker metric split does not directly change this company-wide roster target except through any earlier coarse candidate-survival effects, not through the step-count or continuity-weighting lanes themselves. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run. | objdump + caller xrefs + callsite inspection + linked-transit score-total correlation + linked-transit consumer correlation + version-compatibility impact correlation |
| 22 | 0x00409300 | 200 | company_publish_train_upgrade_news | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 3 | Formats and publishes the linked-transit train-upgrade news item. After one scenario gate through `[0x006cec78+0x4a97]`, the helper chooses one preferred locomotive id through `0x004078a0`, resolves the caller-supplied train id through the live train collection `0x006cfcbc`, formats the old and new locomotive names through the locomotive collection `0x006ada84` and the name helper at `0x00461ca0`, and then emits RT3.lng id `2897` `%1 has just upgraded a %2 to a %3.` through the shell news helper at `0x004554e0`. It finally sets the byte latch at `[company+0x0d56]`. Current grounded callers are the train-roster balancer at `0x00409950` and one neighboring branch at `0x00409b52`, so this now reads as the shared company-side train-upgrade headline helper rather than an anonymous news formatter. | objdump + caller xrefs + callsite inspection + RT3.lng strings + train-upgrade news correlation |
| 23 | 0x004093d0 | 837 | company_rebuild_linked_transit_site_peer_cache | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step count from `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` `0x004a6630`, and float `+0x09` stores the normalized continuity share computed from that step count and the companion mismatch-count output of the same helper. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`. | objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation + route-step-count correlation + continuity-ratio correlation |
| 24 | 0x00409720 | 80 | company_service_linked_transit_site_caches | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Timed service wrapper above the two company-side linked-transit cache lanes. The helper refreshes the fast peer cache through `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` when `[this+0x0d3e]` is zero or older than `0x7ff80` ticks, and otherwise refreshes the slower follow-on lane at `0x00407bd0` when `[this+0x0d3a]` is zero or older than `0x31380` ticks. Current grounded direct callers are `0x004097b8`, which re-enters it after one larger local mode change, and several neighboring company-side service paths. This now looks like the bounded timed owner for the company-side linked-transit cache family rather than another anonymous small wrapper. | objdump + caller xrefs + callsite inspection + timed-service correlation |
| 25 | 0x00409770 | 88 | train_try_append_linked_transit_autoroute_entry | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Attempts to append one linked-transit autoroute entry onto a live train route list. After validating the train-side state and one current route-kind gate through `0x004a8840`, the helper clears one local staging byte, re-enters `company_service_linked_transit_site_caches` `0x00409720` on the owning company, and then asks `company_build_linked_transit_autoroute_entry` `0x00408380` for a single staged `0x33`-byte route-list record using the current anchor site id at `[this+0x0a0]`. On success it either appends that record through `train_route_list_insert_staged_entry_at_index` `0x004b3160` and refreshes the new trailing selection through `train_route_list_select_entry_and_refresh_linked_site_state` `0x004b2f00`, or when the list is already at the local two-entry cap it rotates the target slot via `[this+0x08] mod [this+0x04]` and overwrites that `0x33`-byte entry in place. The weighted linked-transit cache lanes stay indirect here too: this helper inherits ranked site and peer choice only through `0x00408380`, not by reading cache `+0x0e/+0x16` itself. Current grounded caller is the company-side service sweep at `0x004019cc`, so this now reads as the single-entry train-side autoroute append helper rather than a two-entry seeding pass. | objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation + train-route-list correlation + weighted-consumer-boundary correlation |
| 26 | 0x00409830 | 274 | company_try_add_linked_transit_train_and_publish_news | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 3 | Local add-train branch beneath the linked-transit company train-roster balancer. The helper first respects scenario gate `[0x006cec78+0x4aa3]`, clears and seeds one staged route-entry buffer through `0x004b2ba0`, services the owning company's linked-transit caches, asks `company_build_linked_transit_autoroute_entry` `0x00408380` for two route-list entries, inserts those entries through `train_route_list_insert_staged_entry_at_index` `0x004b3160`, chooses one preferred locomotive id through `0x004078a0`, and then hands the staged route plus locomotive choice into the train-construction helper at `0x004b2140`. On success it emits RT3.lng id `2896` `%1 has added a new train (%2) at %3` through `0x004554e0` and sets the byte latch at `[company+0x0d56]`. The weighted linked-transit cache lanes stay indirect here too: this add-train path inherits ranked site and peer choice only through the two `0x00408380` builder calls, while the separate roster-pressure decision above it still comes from raw cache `+0x12` through `0x00408f70`. Current grounded callers are the local add branches inside `company_balance_linked_transit_train_roster` `0x00409950`, while multiplayer callers package opcode `0x75` instead. | objdump + caller xrefs + callsite inspection + RT3.lng strings + linked-transit train-add correlation + weighted-consumer-boundary correlation |
| 27 | 0x00409950 | 923 | company_balance_linked_transit_train_roster | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Balances one company's linked-transit train roster against the linked-site cache family. The helper first requires at least one linked transit site through `company_count_linked_transit_sites` `0x00426590`, then computes one aggregate train-pressure target through `company_compute_owned_linked_transit_site_score_total` `0x00408f70` and counts currently owned trains through `company_count_owned_trains` `0x004264c0`. It walks the live train collection `0x006cfcbc`, keeps only trains owned by the current company, derives one year-dependent age scalar from current scenario year `[0x006cec78+0x0d]`, and applies that scaled age against two thresholds. Very old trains above the upper band are either removed outright through the train collection vtable when the roster already exceeds target, or upgraded in place through `company_publish_train_upgrade_news` `0x00409300` when the target still needs capacity. Mid-age trains above the lower band can trigger one narrower upgrade branch when the roster is still below target. After pruning, it computes the remaining deficit between the aggregate target and the owned-train count, then repeatedly either packages multiplayer opcode `0x75` through `0x00469d30` or locally re-enters `company_try_add_linked_transit_train_and_publish_news` `0x00409830` until that deficit collapses, with one later add-train retry branch when the residual target is still high enough. Current grounded callers are the company-side service sweep at `0x00401b9d` and a neighboring company wrapper at `0x004097b8`, so this now looks like the live train-balance owner above the linked-transit autoroute and news helpers rather than an unnamed local maintenance pass. | objdump + caller xrefs + callsite inspection + linked-transit train-balance correlation + linked-transit consumer correlation |
| 28 | 0x004264c0 | 96 | company_count_owned_trains | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Counts the live trains owned by the current company. The helper walks the train collection at `0x006cfcbc`, compares each record's owning company byte at `[train+0x51]` against `[this+0x00]`, and returns the number of matches. Current grounded callers are the linked-transit train-roster balancer at `0x00409950` and the `LoadScreen.win` company train-list page at `0x004e7670`, where the count gates the no-trains fallback before the detailed roster rows are built. | objdump + caller xrefs + callsite inspection + company-owned train count correlation |
| 29 | 0x00426590 | 135 | company_count_linked_transit_sites | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Counts the live linked placed structures for this company that also pass the station-or-transit gate. The helper walks the placed-structure collection at `0x006cec20`, keeps only peers whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, requires the linked-instance class byte through `0x0047de00 -> 0x0040c990 == 1`, and optionally enforces the narrower station-or-transit predicate through `0x0047fd50` when the caller passes a nonzero stack flag. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where the helper contributes the current linked transit-site count used in the bonus-value ladder and later building-density caps. | objdump + caller xrefs + callsite inspection + connection-bonus count correlation |
| 30 | 0x00427590 | 47 | company_credit_rating_score_meets_threshold_5 | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Small boolean gate over the bounded company credit-rating score at `0x00425320`. The helper rejects immediately when scenario-state flag `0x006cec78+0x4a8b` is set or when the company-side count or age-like field `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument credit-rating score and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the neighboring branch around `0x004064a9`, so this is currently safest as a small reusable threshold gate over the same debt-market or company-strength score rather than a dedicated shell-only bond predicate. | objdump + caller xrefs + callsite inspection + credit-rating correlation + threshold-gate correlation |
| 31 | 0x00409e80 | 192 | world_set_selected_year_and_refresh_calendar_presentation_state | simulation | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small world-side year setter beneath the periodic step family and the later world-entry staged-profile rehydrate band. The helper stores the caller-supplied selected absolute calendar counter at `[this+0x15]`, resolves the paired mixed-radix calendar-point tuple through `0x0051d460` into `[this+0x0d/+0x11]`, recomputes several derived year-fraction or presentation scalars rooted at `[this+0x0bfa]`, refreshes the live shell controller at `0x006d4024` through `0x0051f070`, `0x00527c70`, and `0x00527c20`, and updates the controller's cached doubled-year field at `[controller+0x2c]`. When the unpacked year field at `[this+0x0d]` actually changes it also re-enters `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`. Current grounded callers are the smaller periodic-step wrapper at `0x0040a150`, the larger simulation-advance family through `0x0040a590/0x0040ab50`, and the late staged-profile rehydrate lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared selected-year/calendar refresh helper rather than a one-off world-entry setter. | objdump + caller inspection + local disassembly + periodic-step correlation + world-entry rehydrate correlation + year-bucket-companion correlation + calendar-counter model correlation |
| 32 | 0x0040a590 | 892 | simulation_service_periodic_boundary_work | simulation | cdecl | inferred | objdump + analysis-context | 3 | Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. The pre-recipe scalar seam is tighter here now too: after the year and threshold refresh strip, the helper derives one bounded bucket from the selected-year gap `[world+0x0d] - [world+0x05]`, reads the corresponding float from the five-slot table `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, applies the later bucket-specific scale cuts, adds one fixed bias, and multiplies the running scalar `[world+0x0bde]` by that result before it refreshes the live company and profile collections. Its scenario-runtime handoff is now explicit too: the grounded calls at `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3` re-enter `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kinds `1`, `0`, `3`, and `2` respectively. The route-style lane is tighter here now too: the neighboring recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, then later drives the same runtime-effect collection loop with trigger kinds `5` and `4` at `0x0040a930` and `0x0040a9ac`. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence. | objdump + analysis-context + caller xrefs + runtime-effect trigger-kind correlation + pre-recipe-scalar-table correlation |
| 33 | 0x0040ab50 | 339 | simulation_advance_to_target_calendar_point | simulation | cdecl | inferred | objdump + analysis-context | 3 | Advances the active world state toward one caller-selected mixed-radix calendar target while guarded by the recursion counter at `0x0062b240`. The helper compares the current local calendar-point tuple fields `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and `[this+0x14]` against a target resolved through `0x0051d550` and `0x0051d5f0`, then either recurses in larger `0x168`-sized chunks or advances through the smaller periodic step family rooted at `0x00409e80` and `0x0040a9c0`. Current tuple evidence now bounds this as the same mixed-radix counter family used by `0x0051d3c0/0x0051d460`: a packed year-plus-subfield calendar point rather than a plain year or month-only target. Each successful step notifies the live world root at `0x0062c120` through `0x00450030`. Grounded callers include the frame-time accumulator at `0x00439140`, the larger fast-forward helper at `0x00437b20`, and one shell UI command path. | objdump + analysis-context + caller xrefs + calendar-counter model correlation |
| 34 | 0x0040aeb0 | 79 | support_collection_construct_seed_counters_and_clear_large_sideband | map | thiscall | inferred | objdump + world-load correlation + local disassembly | 3 | World-load constructor for the support family later published at `0x0062b244`. The helper seeds the indexed collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0, initial_slots=5, growth=0x0a, id_base=0)`, installs vtable `0x005c8a0c`, clears the large sideband rooted at `[this+0x90]`, seeds `[this+0x8c] = 0x270f` and `[this+0x88] = 0`, and then tails into `0x0040acb0` for the remaining local initialization. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting object is stored into global `0x0062b244`. | objdump + world-load correlation + local disassembly + constructor-parameter reconstruction |
| 35 | 0x0040af00 | 146 | support_collection_release_entry_and_decrement_world_type_counters | map | thiscall | inferred | objdump + world-shutdown correlation + local disassembly + field xrefs | 3 | Per-entry release helper beneath the support collection rooted at `0x0062b244`. After resolving the live entry through `0x00518140`, the helper uses entry byte `[entry+0x261]` to choose which live world counter to decrement: nonzero entries decrement `[0x006cec78+0x4c9e]`, zero entries decrement `[0x006cec78+0x4c9a]`. Both counters are then clamped back to nonnegative. When the released entry matches the active world-view side subject at `[0x0062be68+0x60]`, the helper clears that focus through `0x004349f0(0, 0)` before releasing the entry's local runtime through `0x004584e0` and erasing it from the collection through `0x00518a30`. Current grounded caller is `support_collection_release_entries_and_collection_storage` `0x0040b720`, which uses this as the collection-side release callback on old-world teardown. | objdump + world-shutdown correlation + local disassembly + field xrefs + support-entry-release correlation |
| 36 | 0x0040b010 | 77 | support_collection_find_first_live_entry_matching_stem_string | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small support-collection lookup helper over the fixed sideband at `[this+0x90]`. The helper scans up to `0x20` live `0x5c`-byte sideband rows, compares the caller-supplied zero-terminated stem against each row through `0x005a57cf`, and returns the first matching entry id by tail-calling `support_collection_allocate_entry_from_sideband_slot` `0x0040afa0` with the matching slot index. When no sideband row matches it returns `0`. Current grounded callers are the two goose-side owners `0x0040b0b0` and `0x0040b2d0`, both of which query the stem literal at `0x005c8a2c` `goose`. | objdump + caller inspection + local disassembly + sideband-layout correlation + stem-literal correlation |
| 37 | 0x0040b0b0 | 540 | support_collection_try_spawn_goose_entry_in_primary_counter_lane | map | thiscall | inferred | objdump + caller inspection + local disassembly + stem-literal correlation | 3 | Periodic support-entry owner beneath `simulation_advance_to_target_calendar_point` `0x0040ab50`. The helper rejects when scenario gate `[0x006cec78+0x46c38]` is live, derives one year-bucket quota from current year `[0x006cec78+0x0d]`, optionally scales that quota down for larger map areas from `[0x0062c120+0x2155/+0x2159]`, and then refuses to continue when the current live primary counter `[0x006cec78+0x4c9a]` already exceeds that quota. It next walks the collection sideband and selects the strongest empty `goose` row whose year window admits the current year, using one random threshold branch before the final choice. On success it materializes a live entry through `support_collection_allocate_entry_from_sideband_slot` `0x0040afa0`, increments `[0x006cec78+0x4c9a]`, seeds one world-space triplet from the selected entry through `0x00455800`, `0x00455810`, `0x0051b700`, and `0x00518de0`, and then forwards the finished local payload into the runtime-object collection at `0x006acd34` through `0x004554e0`. Current grounded caller is the year-step branch at `0x0040ab04`, where this owner runs beside the selector sibling `0x0040b2d0` and the collection-wide entry service pass `0x0040b060`. | objdump + caller inspection + local disassembly + stem-literal correlation + year-window correlation + counter-field correlation |
| 38 | 0x0040b2d0 | 675 | support_collection_select_or_spawn_goose_entry_id | map | thiscall | inferred | objdump + caller inspection + local disassembly + command-caller correlation | 3 | Selector-side sibling of `support_collection_try_spawn_goose_entry_in_primary_counter_lane` `0x0040b0b0`. The helper first rejects under the same scenario gate `[0x006cec78+0x46c38]`; when the caller-supplied force flag is clear it additionally requires live counter `[0x006cec78+0x4c9e] <= 0x60` and one random float branch against the caller-supplied threshold. It then resolves the first live `goose` sideband row through `support_collection_find_first_live_entry_matching_stem_string` `0x0040b010`, increments `[0x006cec78+0x4c9e]`, derives one world-space triplet and heading window from the created entry, and returns the selected live support-entry id to the caller after seeding the same runtime-object follow-on family. Current grounded callers are the shell focus command `shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0` `0x00441360`, the matching command-registration branch at `0x0046461d`, and the periodic year-step lane at `0x0040ab12`, so this is the strongest current read for the support-side selector or spawn owner that feeds shell focus and open commands rather than a pure periodic spawner. | objdump + caller inspection + local disassembly + command-caller correlation + stem-literal correlation + counter-field correlation |
| 39 | 0x0040b5d0 | 199 | support_collection_refresh_records_from_tagged_bundle | map | thiscall | inferred | objdump + world-load correlation + local disassembly + tag correlation | 3 | Bundle-load sibling for the support family rooted at `0x0062b244`. The helper reads tagged sections `0x2af9/0x2afa/0x2afb` through repeated `0x00531360` calls, refreshes the collection-side metadata through `0x00518680`, and then walks every live entry, dispatching each record through entry vtable slot `+0x40` with the active bundle handle before closing the final tag. Current grounded callers are the world-entry runtime bringup strip `0x00443a50` and the neighboring tagged world-load family, where this support collection is rehydrated beside the region, territory, and event managers. | objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation |
| 40 | 0x0040b6a0 | 118 | support_collection_serialize_tagged_records_into_bundle | map | thiscall | inferred | objdump + package-save correlation + local disassembly + tag correlation | 3 | Package-save sibling for the support family rooted at `0x0062b244`. The helper opens the three tagged sections `0x2af9/0x2afa/0x2afb` through repeated `0x00531340` calls, serializes the collection payload through `0x00517d90`, and then walks every live entry, dispatching each record through entry vtable slot `+0x44` with the active bundle handle before closing the final tag. Current grounded caller is `shell_map_file_world_bundle_coordinator` `0x00445de0`, which emits this family in the fixed package-save order. | objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation |
| 41 | 0x0040b720 | 59 | support_collection_release_entries_and_collection_storage | map | thiscall | inferred | objdump + world-shutdown correlation + local disassembly | 3 | Release-side companion to `support_collection_construct_seed_counters_and_clear_large_sideband` `0x0040aeb0`. The helper reinstalls vtable `0x005c8a0c`, walks all live entries, releases each one through `0x0040af00`, re-enters `0x00518600`, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`. | objdump + world-shutdown correlation + local disassembly + companion correlation + live-entry-release sweep |
| 42 | 0x0040c950 | 18 | placed_structure_construct_concrete_specialization_vtable_5c8c50 | map | thiscall | inferred | objdump + allocator caller correlation + constructor chain inspection | 2 | Small constructor thunk used by the shared placed-structure allocator `0x004134d0`. The helper first re-enters `0x0045b680`, which seeds the common placed-structure base table `0x005cb4c0`, clears the derived field band `[this+0x23a..+0x26a]`, and re-enters the older base initializer `0x00455610`; it then installs the concrete placed-structure specialization table `0x005c8c50` and returns `this`. Current grounded callers are the live allocator path at `0x004134d0` and the temporary stack-object path at `0x00413363`, so this is the safest current read for the concrete placed-structure constructor thunk beneath the shared placement family rather than a standalone helper object constructor. | objdump + allocator caller correlation + constructor chain inspection + vtable install correlation |
| 43 | 0x0040c970 | 11 | placed_structure_reset_concrete_specialization_to_base_vtable_5cb4c0 | map | thiscall | inferred | objdump + allocator caller correlation + destructor chain inspection | 2 | Small cleanup or destructor-style thunk paired with `0x0040c950`. The helper briefly reinstalls the concrete specialization table `0x005c8c50`, then immediately tails into `0x0045b040`, which demotes the record back to the common base table `0x005cb4c0` and re-enters the base cleanup path `0x00455650`. Current grounded callers are the stack-object teardown sites at `0x00413363` and `0x0041353a`, both immediately before freeing or unwinding the temporary placed-structure object, so this is the safest current read for the specialization-to-base cleanup thunk rather than another constructor. | objdump + allocator caller correlation + destructor chain inspection + vtable demotion correlation |
| 44 | 0x0040c980 | 5 | placed_structure_serialize_concrete_specialization_payload_via_0x45b560 | map | thiscall | inferred | objdump + vtable scan + serializer chain inspection | 2 | Tiny serializer thunk in the concrete placed-structure specialization table `0x005c8c50`. The helper simply tails into `0x0045b560`, which first re-enters the common base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1/0x5dc2` over fields `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`. This is the safest current read for the specialization-side serializer entry rather than an independent data-writer. | objdump + vtable scan + serializer chain inspection |
| 45 | 0x0040cbc0 | 4 | placed_structure_clear_shared_byte42_state_flag | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `0`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct clear accessor over that shared site-state byte rather than a standalone semantic owner. | objdump + local disassembly + neighboring accessor correlation |
| 46 | 0x0040cbd0 | 4 | placed_structure_set_shared_byte42_state_flag | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `1`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct set accessor over that shared site-state byte rather than a standalone semantic owner. | objdump + local disassembly + neighboring accessor correlation |
| 47 | 0x0040cbe0 | 3 | runtime_object_false_stub_vtable_5cfd00_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 48 | 0x0040cbf0 | 5 | placed_structure_query_shared_byte42_state_flag | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny raw getter over shared placed-structure byte `[this+0x42]`, zero-extending that byte into `EAX`. Current local evidence keeps this on the same byte-lane as the direct setters `0x0040cbc0/0x0040cbd0` and the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0`, so this is the safest current read for the direct query accessor over that shared site-state byte. | objdump + local disassembly + neighboring accessor correlation |
| 49 | 0x0040cc00 | 6 | runtime_object_true_stub_vtable_5cfd00_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-true virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 50 | 0x0040cc10 | 3 | placed_structure_specialization_false_stub_vtable_5c8c50_slot0 | map | thiscall | inferred | objdump + vtable scan | 1 | Tiny pure-false stub in the concrete placed-structure specialization table `0x005c8c50`. The helper clears `EAX` and returns immediately, with no field access or side effects. Current evidence only grounds it as one literal-false virtual slot beneath the specialization, so the note stays structural rather than semantic. | objdump + vtable scan |
| 51 | 0x0040cc20 | 3 | placed_structure_specialization_false_stub_vtable_5c8c50_slot1 | map | thiscall | inferred | objdump + vtable scan | 1 | Second tiny pure-false stub in specialization table `0x005c8c50`. Like the neighboring false slots, it simply clears `EAX` and returns. Current evidence grounds this only as a literal-false virtual slot rather than a named predicate. | objdump + vtable scan |
| 52 | 0x0040cc30 | 3 | placed_structure_specialization_false_stub_vtable_5c8c50_slot2 | map | thiscall | inferred | objdump + vtable scan | 1 | Third tiny pure-false stub in specialization table `0x005c8c50`. The helper only returns `0`, with no field reads or writes. Current evidence keeps the row at that structural predicate-slot level. | objdump + vtable scan |
| 53 | 0x0040cc40 | 32 | placed_structure_subject_candidate_is_subtype1 | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small shared candidate-profile predicate adjacent to the `0x005c8c50` specialization cluster. The helper follows candidate or profile id `[this+0x173]` through collection `0x0062b268`, reads candidate subtype byte `[candidate+0x32]`, and returns `1` only when that subtype equals `1`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the returned boolean becomes one of the two mode inputs for `0x00415020`. This is the safest current read for a subtype-`1` predicate over the linked candidate/profile chain rather than a specialization-vtable slot. | objdump + caller inspection + local disassembly + candidate-subtype correlation |
| 54 | 0x0040cc60 | 26 | placed_structure_subject_candidate_query_flag_byte_ba | map | thiscall | inferred | objdump + caller inspection + local disassembly | 1 | Tiny shared candidate-profile accessor adjacent to the specialization cluster. The helper follows id `[this+0x173]` through candidate collection `0x0062b268` and returns byte `[candidate+0xba]`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the byte is only used as a boolean mode input. Current evidence keeps the field at the raw candidate-byte level, so the note stays deliberately raw. | objdump + caller inspection + local disassembly + candidate-byte-field correlation |
| 55 | 0x0040cc80 | 42 | placed_structure_subject_candidate_is_subtype1_class3 | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Shared candidate-profile predicate over the same `[this+0x173] -> 0x0062b268` chain as `0x0040cc40`. The helper returns `1` only when candidate subtype byte `[candidate+0x32]` equals `1` and candidate class byte `[candidate+0x8c]` equals `3`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where this branch helps select the flagged-region float-stat mode beneath `0x00415020`. This is the safest current read for the combined subtype-`1` plus class-`3` predicate rather than a direct specialization method. | objdump + caller inspection + local disassembly + candidate-subtype correlation + candidate-class correlation |
| 56 | 0x0040ccb0 | 14 | placed_structure_has_cached_linked_site_id | map | thiscall | inferred | objdump + vtable scan + local disassembly | 2 | Small specialization-side predicate over cached linked-site id `[this+0x2a8]`. The helper returns `1` when that dword is nonzero and `0` otherwise. Because it sits directly in the `0x005c8c50` vtable beside the linked-peer UI and route-anchor family, this is the safest current read for the specialization's cached-linked-site-id presence predicate rather than a broader linked-site resolver. | objdump + vtable scan + local disassembly + linked-site-field correlation |
| 57 | 0x0040ccc0 | 6 | placed_structure_specialization_true_stub_vtable_5c8c50_slot | map | thiscall | inferred | objdump + vtable scan | 1 | Tiny pure-true stub in specialization table `0x005c8c50`. The helper loads literal `1` into `EAX` and returns immediately. Current evidence keeps it at the literal-true virtual-slot level beneath the specialization. | objdump + vtable scan |
| 58 | 0x0040ccd0 | 30 | world_grid_resolve_cell_pointer_by_xy_indices | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small world-grid address calculator over the live world root at `0x0062c120`. The helper multiplies the caller-supplied Y-like index by world width `[this+0x2145]`, adds the X-like index, scales the resulting linear slot by fixed cell stride `0x1d7`, and returns the corresponding cell pointer under base `[this+0x2129]`. Current grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386`, several world-grid or overlay-side passes at `0x004525bc..0x00452bb2`, and one later shell-side caller at `0x004df4d4`, so this is the safest current read for the shared `(x,y) -> world-cell*` resolver rather than an object-specific helper. | objdump + caller inspection + local disassembly + world-grid correlation + cell-stride correlation |
| 59 | 0x0040ccf0 | 23 | placed_structure_query_linked_instance_candidate_class_byte | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small linked-instance candidate-class reader adjacent to the specialization cluster. The helper first resolves one linked instance through `0x0047de00`, then follows that instance's vtable `+0x80` owner chain, and finally returns candidate class byte `[candidate+0x8c]`. Current grounded callers include later world or UI-side branches at `0x00480fb5` and `0x004b03ce`, where the returned class is compared against `3` and `4`. This is the safest current read for a linked-instance candidate-class accessor rather than a general placed-structure vtable slot. | objdump + caller inspection + local disassembly + candidate-class correlation |
| 60 | 0x0040cd10 | 88 | placed_structure_scan_center_cell_site_roster_when_shell_gate_enabled | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Gated center-cell site-roster sweep adjacent to the specialization cluster. The helper first requires shell or modal latch `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current subject's center world-grid cell through `0x00455f60`, reads the local roster count and packed site-id list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through collection `0x006cec20`. Current grounded caller is the broader collection walk at `0x00413860`, so this is the safest current read for a gated center-cell linked-site roster scan rather than another candidate predicate or direct vtable override. | objdump + caller inspection + local disassembly + center-cell roster correlation |
| 61 | 0x0040cd70 | 228 | placed_structure_resolve_cached_source_and_candidate_ids_from_current_stem_or_warn | map | thiscall | inferred | objdump + local disassembly + string correlation + collection correlation | 3 | Common specialization-side stem refresh helper beneath `0x0040ce60`. The helper clears cached ids `[this+0x3cc]` and `[this+0x3d0]`, scans source collection `0x0062b2fc` for a case-sensitive stem match against `[this+0x3ae]`, and on the first match stores the matched source id into `[this+0x3cc]` plus the corresponding candidate or profile id from `[source+0x173]` into `[this+0x3d0]`. When no source stem matches, it formats localized id `0x00ad` with the current stem buffer and publishes that warning through `0x0051e980`. Current local callers are the radio-stem canonicalizer `0x0040ce60` and the broader placed-structure constructor or geometry refresh family, so this is the safest current read for the cached source/candidate resolver beneath the `0x005c8c50` specialization rather than a generic geometry helper. | objdump + local disassembly + string correlation + collection correlation + cached-id-field correlation |
| 62 | 0x0040ce60 | 83 | placed_structure_canonicalize_radio_station_stem_and_refresh_specialization_state | map | thiscall | inferred | objdump + local disassembly + string correlation | 2 | Small specialization-side stem normalizer. The helper compares the site stem at `[this+0x3ae]` against the literal `Radio Station`, and when that compare matches it rewrites the same stem buffer to the compact form `RadioStation`. It then re-enters the common stem or geometry refresh helper `0x0040cd70` and the neighboring specialization-side follow-on `0x0045c150` with the caller-supplied stack argument. Current local evidence is strong enough to ground the `Radio Station -> RadioStation` normalization, but not the broader semantic role of the owning specialization table `0x005c8c50`, so this note stays narrow. | objdump + local disassembly + string correlation + neighboring specialization-method correlation |
| 63 | 0x0040cec0 | 18 | placed_structure_resolve_cached_source_record_from_id3cc | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny cached-record resolver over source id `[this+0x3cc]`. The helper resolves and returns the corresponding entry through source collection `0x0062b2fc`. Current local callers sit on the `0x005c8c50` specialization side beside the stem refresh family, so this is the safest current read for the direct cached source-record resolver rather than another generic collection helper. | objdump + local disassembly + cached-id-field correlation |
| 64 | 0x0040cee0 | 18 | placed_structure_resolve_cached_candidate_record_from_id3d0 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 2 | Tiny cached-record resolver over candidate or profile id `[this+0x3d0]`. The helper resolves and returns the corresponding entry through collection `0x0062b268`. Because this function is itself a `0x005c8c50` vtable slot and directly follows the stem-refresh family, this is the safest current read for the specialization's cached candidate-record resolver rather than an unrelated collection bridge. | objdump + vtable scan + local disassembly + cached-id-field correlation |
| 65 | 0x0040cf00 | 527 | placed_structure_build_secondary_specialization_transient_handle_with_four_slot_offsets | map | thiscall | inferred | objdump + local disassembly + transient-family correlation | 2 | Heavier specialization-side transient build branch beneath the `0x005c8c50` table. The helper first requires creation-mode byte `[this+0x3d4] == 1` and live transient seed `[this+0x24e]`, then re-enters the neighboring cleanup gate `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, `[this+0x21]`, `[this+0x3a]`, and the constant at `0x005c8cf4`, and allocates one new handle through `0x00475ed0` into `[this+0x25a]`. It then resolves a current world-position tuple through `0x00414450` and `0x0052e720`, publishes several local offset triplets through `0x00475010`, and configures four numbered channels on the new handle through `0x00475030` with selector ids `1..4`. Current evidence carries this row conservatively as the second transient-handle builder in the same specialization-side payload family as `0x0045c310/0x0045b210`. | objdump + local disassembly + transient-family correlation + geometry-derived offset correlation |
| 66 | 0x0040d170 | 56 | placed_structure_build_primary_specialization_transient_when_candidate_flag4b_enabled | map | thiscall | inferred | objdump + local disassembly + candidate-flag correlation | 2 | Small specialization-side hook that conditionally builds the primary transient handle through `0x0045c310`. The helper resolves the current candidate from cached stem id `[this+0x3cc]`, follows that candidate's profile or source id through `[entry+0x173]`, and reads dword flag `[candidate+0x4b]`. When that flag is nonzero it tail-calls `placed_structure_specialization_build_primary_transient_handle_from_payload_strings` `0x0045c310`; otherwise it returns immediately. This is the strongest current owner for the candidate-flag-gated primary transient build hook in the `0x005c8c50` specialization family. | objdump + local disassembly + candidate-flag correlation + transient-build correlation |
| 67 | 0x0040d1b0 | 56 | placed_structure_release_primary_specialization_transient_when_candidate_flag4b_enabled | map | thiscall | inferred | objdump + local disassembly + candidate-flag correlation | 2 | Release-side companion to `0x0040d170`. The helper resolves the same candidate chain from cached stem id `[this+0x3cc]`, reads dword flag `[candidate+0x4b]`, and when that flag is nonzero tail-calls `placed_structure_specialization_release_primary_transient_handle_and_siblings` `0x0045c3c0`; otherwise it returns immediately. Current evidence grounds this as the candidate-flag-gated release hook for the primary specialization transient rather than a generic cleanup entry. | objdump + local disassembly + candidate-flag correlation + transient-release correlation |
| 68 | 0x0040d1f0 | 23 | placed_structure_resolve_linked_peer_record_from_cached_site_id | map | thiscall | inferred | objdump + local disassembly | 3 | Tiny cached-record resolver over linked site id `[this+0x2a8]`. When that id is nonzero the helper resolves and returns the linked placed-structure record through collection `0x006cec20`; otherwise it returns null. Current grounded callers include the contextual status publisher `0x0040e4e0` and the linked-anchor service family, so this is the safest current read for the direct linked-peer resolver rather than another boolean gate. | objdump + local disassembly + linked-peer resolver correlation |
| 69 | 0x0040d210 | 26 | placed_structure_resolve_owner_record_from_cached_owner_id | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny cached-record resolver over owner id `[this+0x276]`. When that id is nonzero the helper resolves and returns the corresponding record through collection `0x0062be10`; otherwise it returns null. Current local callers sit on the UI-facing specialization side near `0x0040e9d0`, so the safest current read is one direct owner-record resolver rather than a wider ownership test. | objdump + local disassembly + owner-resolver correlation |
| 70 | 0x0040dc40 | 1047 | placed_structure_validate_station_detail_aux_candidate_action_and_optionally_apply_linked_site_mutation | map | thiscall | inferred | objdump + local disassembly + caller correlation + callsite inspection | 4 | World-side validator and optional commit owner beneath the lower `StationDetail.win` action band. The helper first requires the current linked peer id `[this+0x2a8]` to resolve and pass `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, then resolves the auxiliary candidate id from `0x0062b2fc`, the linked candidate root from `0x0062b268`, and computes one projected float cost scalar from candidate field `[candidate+0x22]`, the current owner company at `[this+0x276]`, current site coordinates through `0x00455800/0x00455810`, world scalar query `0x0044ad60`, and scenario-side scale owner `0x00436590(0x3b, ...)`. When the caller supplies the optional float out-pointer, that scalar is returned there. When the caller supplies the optional notice sink and the current owner company exists, the helper compares that scalar against company metric `(0x0d, 0x2329)` through `0x0042a5d0`; on failure it formats localized notice `0x0b52` through `0x005193f0` and returns failure without mutating local runtime state. The success-side path is tighter too: it derives projected offsets from the linked peer through `0x0047df30/0x0047df50`, materializes a packed projected cell list through `0x00417840`, replays that list into compact-grid mode `2` around `placed_structure_validate_projected_candidate_placement` `0x004197e0`, and then restores the temporary compact-grid bits through `0x004142c0/0x004142d0`. When placement fails it returns false; when placement succeeds and the optional notice sink is null it commits the linked-site mutation through `0x0040d1f0`, `0x00480710`, transient teardown or rebuild `0x0045b160/0x0045b9b0`, display-name or source refresh `0x00455750/0x0040cd70`, and local-runtime record rebuild `0x00418be0`, then posts the signed scalar into the owner company through `0x0042a040` and accumulates the running total in `[this+0x27a]`. Even on the validate-only path it still republishes the linked site anchor through `0x0040d1f0 -> 0x00480710` when the caller requested the confirmation-modal preview branch. Current grounded caller is the lower action dispatch inside `shell_station_detail_window_handle_message` `0x00505e50`. | objdump + local disassembly + caller correlation + callsite inspection + affordability-notice correlation + projected-placement correlation + linked-site-mutation correlation |
| 71 | 0x0040d230 | 60 | placed_structure_has_linked_station_or_transit_peer | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Boolean linked-peer gate over one placed structure. The helper first requires the placed-structure vtable `+0x70` latch, then resolves optional linked site id `[this+0x2a8]` through the live placed-structure collection `0x006cec20`, and finally re-enters `placed_structure_is_station_or_transit_site_class` `0x0047fd50` on that linked peer. Current local callers include the broader `cargo id 0` bypass family and several neighboring linked-site maintenance branches, so this is the safest current read for the narrower linked-peer station-or-transit gate rather than a cargo-reference helper. | objdump + caller xrefs + local disassembly + linked-peer gate correlation |
| 72 | 0x0040d2d0 | 128 | placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Linked-peer visual or state refresh beneath the broader placed-structure rebuild family. The helper first re-enters placed-structure vtable `+0x54` with stack argument `0`, then requires scenario latch `[0x006cec78+0x4ae7]`, the placed-structure vtable `+0x70` linked-site-capable latch, and the narrower linked-peer class gate `0x0047fd50` over optional linked site id `[this+0x2a8]`. When the resolved linked peer carries nonzero byte `[peer+0x5bc]`, it re-enters placed-structure vtable `+0x58` on the current site with literal arguments `(0x5f, 0x5f, 0xff)`. Current grounded caller is `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, so this is the safest current read for a linked-peer-dependent overlay or status refresh rather than a cargo-side helper. | objdump + caller xrefs + local disassembly + linked-peer flag correlation |
| 73 | 0x0040d350 | 16 | placed_structure_query_linked_instance_candidate_flag_byte_b9 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Tiny linked-instance candidate-field accessor adjacent to the linked-site helpers. The helper resolves one linked instance through `0x0047de00`, follows that instance's vtable `+0x80` owner chain, and returns signed candidate byte `[candidate+0xb9]`. Current grounded caller is the collection-side subtype-`4` sweep `0x00413b40`, where the returned byte is only tested against zero, so the note stays deliberately raw rather than overnaming candidate byte `0xb9`. | objdump + local disassembly + caller correlation + candidate-byte-field correlation |
| 74 | 0x0040d360 | 22 | placed_structure_subject_candidate_is_subtype4 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small shared candidate-profile predicate adjacent to the linked-site helper strip. The function resolves the current subject's candidate through vtable slot `+0x80`, reads subtype byte `[candidate+0x32]`, and returns `1` only when that subtype equals `4`. Current grounded callers are the broader collection-side sweeps `0x00413750` and `0x00413b40`, so this is the safest current read for a subtype-`4` predicate over the current placed-structure subject rather than another specialization method. | objdump + local disassembly + caller correlation + candidate-subtype correlation |
| 75 | 0x0040e080 | 432 | placed_structure_release_local_runtime_and_unlink_linked_site_followon_state | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Broader placed-structure release-side helper beneath the collection remove path. The function first resolves the current candidate through vtable slot `+0x80`; when subtype byte `[candidate+0x32]` equals `4` it removes the current site id `[this+0x2a4]` from proximity-bucket collection `0x006cec20` through `0x004814c0`. It then re-enters the placed-structure vtable `+0x70` latch and, when local mode byte `[this+0x3d4]` equals `1`, performs the linked-site cleanup follow-on: it resolves the specialization-side local record through `0x00455f60`, walks the linked peer-id roster at `[record+0xef]`, removes the current site id from each peer through `0x0047d810`, optionally resolves owner record `[this+0x276]` through collection `0x0062be10`, derives one signed scalar from `[this+0x27a]` plus candidate fields `[candidate+0x22/+0x43]`, and posts paired company-stat deltas through `0x0042a040` and `0x0042a080`. The tail also notifies the live route-link collection `0x006ada90` through `0x004681f0` when present. Current grounded caller is `placed_structure_collection_remove_entry_by_id_release_local_runtime_and_unlink` `0x00413550`, so this is the safest current read for the placed-structure release-and-unlink side owner rather than a generic destructor leaf. | objdump + local disassembly + caller correlation + linked-site cleanup correlation + company-stat correlation + proximity-bucket correlation |
| 76 | 0x0040dba0 | 66 | placed_structure_clear_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle | map | thiscall | inferred | objdump + caller xrefs + local disassembly + rdata method-table scan | 2 | Small linked-site route-entry state helper. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, then resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `1` into `0x0047dda0`, and finally clears local byte `[this+0x42]` to `0`. Current local callers are neighboring placed-structure maintenance branches, and the paired companion at `0x0040dbf0` performs the same route-entry dispatch with the opposite literal and byte writeback. A local `.rdata` scan now tightens the owner split too: `0x0040dba0` and `0x0040dbf0` each appear exactly once, together with getter `0x0040cbf0`, in one concrete placed-structure specialization table rooted at `0x005c8c50`, so this is now the safest current read for one half of a specialization-specific linked-site route-entry state toggle pair rather than a generic family-wide setter. | objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation |
| 77 | 0x0040dbf0 | 65 | placed_structure_set_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle | map | thiscall | inferred | objdump + caller xrefs + local disassembly + rdata method-table scan | 2 | Companion linked-site route-entry state helper paired with `0x0040dba0`. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `0` into `0x0047dda0`, and finally sets local byte `[this+0x42]` to `1`. Current local callers are neighboring placed-structure maintenance branches. A local `.rdata` scan now shows that this paired override appears only in the same concrete placed-structure specialization table at `0x005c8c50` as `0x0040dba0` and `0x0040cbf0`, which keeps this on the specialization-specific linked-site route-entry side rather than on one generic shared-byte setter lane. | objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation |
| 78 | 0x0040e360 | 235 | placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Subtype-specific local-runtime follow-on beneath `0x0040eba0` and `0x0040ee10`. The helper resolves the current placed structure's candidate from `[this+0x3cc]` through `0x0062b2fc` and `0x0062b268`, requires subtype byte `[candidate+0x32] == 1` plus candidate class byte `[candidate+0x8c] == 3`, then requires a linked site id at `[this+0x2a8]`. When the linked peer exists and its route-entry anchor at `[peer+0x08]` is live in collection `0x006cfca8`, the helper samples one anchor-side float through `0x0048aab0`, subtracts the fixed offset at `0x005c8738`, combines that result with the current placed structure's coordinate pair through `0x00455810` and `0x00455800`, and publishes the resulting triplet through the shared position setter `0x00530720`. Current grounded caller is the broader local side helper `0x0040ee10`, plus the heavier subtype-driven refresh path at `0x0040eba0`, so this is now the safest current read for the linked-site anchor position-triplet refresh beneath the placed-structure local-runtime family rather than a generic route query. | objdump + caller inspection + local disassembly + linked-site-anchor correlation + local-runtime correlation |
| 79 | 0x0040e450 | 131 | placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small wrapper that rebuilds one placed structure's cloned local-runtime record from its current candidate stem and cached profile slot. The helper copies the current stem string from the candidate referenced by `[this+0x3cc]`, resolves the matching live candidate id through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, seeds the projected-rectangle profile-slot cache from `[this+0x252]` through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470`, and then re-enters `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` `0x00418a60` with the current placed-structure pointer. It stores the returned cloned record into `[this+0x24e]`, refreshes the local cached profile slot from `[record+0x732]` into `[this+0x252]`, and ties the clone back to the owning placed structure through `[record+0x73a] = this`. Current grounded caller is the collection-wide wrapper `0x004133b0`, so this now reads as the cloned local-runtime rebuild helper for one live placed structure rather than an unowned stem lookup. | objdump + caller inspection + local disassembly + local-runtime-clone correlation + projected-rect-profile correlation |
| 80 | 0x0040e4e0 | 921 | placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state | map | thiscall | inferred | objdump + local disassembly + localization-call correlation | 2 | Large contextual status-text publisher in the same concrete placed-structure specialization family rooted at `0x005c8c50`. The helper first requires creation-mode byte `[this+0x3d4] == 1`, the specialization's linked-site-capable vtable `+0x70` latch, and several shell or modal gates under `0x006d1a8c` and `0x006d12f0`; it then branches across linked-peer checks through `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current owner checks through `0x004337a0`, and candidate or linked-peer display-name lookups through `0x0051c920`. The resulting text is localized through ids such as `0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd`, assembled through `0x00518de0`, and finally pushed into the shell presenter `0x00538c70` with mode `3`. Several branches also trigger world-side follow-ons through `0x00452db0` and `0x00452fa0`, so this is best read as a contextual linked-peer or selection-status publisher with mode-specific side effects rather than a pure formatter. | objdump + local disassembly + localization-call correlation + linked-peer gate correlation + shell-presenter correlation |
| 81 | 0x0040e880 | 329 | placed_structure_dispatch_primary_context_action_and_reset_status_presenter | map | thiscall | inferred | objdump + local disassembly + linked-peer gate correlation | 2 | Primary context-action dispatcher paired with `placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state` `0x0040e4e0`. The helper first resets the active shell presenter through `0x00538c70` using the fixed token rooted at `0x005c87a8`, then reuses the same linked-site-capable vtable `+0x70` latch, creation-mode byte `[this+0x3d4] == 1`, linked-peer path `0x0040d230 -> 0x0047f310 -> 0x0048b660`, and world-mode gates `[0x0062c120+0x2175/+0x2179/+0x2181]` to dispatch one of several follow-ons including `0x00413620`, `0x00453510`, `0x00452db0`, and `0x00452fa0`. Current evidence grounds this as the specialization-side primary action or activation dispatcher that accompanies the contextual status publisher, not as another local-runtime refresh helper. | objdump + local disassembly + linked-peer gate correlation + shell-presenter correlation + world-mode branch correlation |
| 82 | 0x0040e9d0 | 464 | placed_structure_format_context_label_or_owner_name_for_ui_query | map | thiscall | inferred | objdump + local disassembly + string correlation | 2 | Query-style label formatter in the same specialization table `0x005c8c50`. The helper first short-circuits when vtable slot `+0x14` says the current object should not answer, then chooses between three outcomes: when shell branch `[0x006cec74+0x74]` is live it formats one localized label through id `0x00b4`, appends the fixed suffix `\\nAbsIndex %d`, copies that text into the caller buffer through `0x0051d8a0`, and returns `1`; under a narrower owner or company-state path gated by `[this+0x276]`, shell mode `[0x006cec74+0x253]`, the linked-site latch, and the active modal state at `0x006d12f0`, it resolves one company-side display label through `0x00426b10`, stores it through the caller out-pointer, and returns `2`; otherwise it falls back to `0x00455860`. This is therefore the safest current read for a specialization-side UI label or owner-name query wrapper rather than another action dispatcher. | objdump + local disassembly + string correlation + ui-query correlation |
| 83 | 0x0040eba0 | 620 | placed_structure_set_world_coords_and_refresh_local_runtime_side_state | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavier placed-structure world-coordinate mutation helper above the local-runtime side refresh family. The function updates the current record's world position through `0x00455860`, recomputes cached grid coordinates `[this+0x388]` and `[this+0x38c]`, and rewrites the world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`. On the candidate subtype-`4` branch it also removes and then re-appends the current site to the nearby-transit proximity bucket family through `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0` and `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480`. After that it rebuilds the same local position or scalar triplet family later serviced by `0x0040ee10`, caches the accepted scalar pair in `[this+0x392]` and `[this+0x396]`, publishes the chosen triplet through the shared setter `0x00530720`, optionally refreshes the linked peer route-entry anchor through `0x00480710`, and finally tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers include the broader rebuild paths `0x0040ef10` and `0x0040f6d0`, later site-mutation branches `0x00419110`, `0x0046ef40`, `0x004707da`, and `0x00473bf0`, plus shell-side subject updates around `0x00507cf0` and `0x00508bb0`, so this is now the safest current owner for world-coordinate updates plus local-runtime side-state refresh rather than a generic movement helper. | objdump + caller inspection + local disassembly + world-coordinate mutation correlation + local-runtime correlation + proximity-bucket correlation |
| 84 | 0x0040ee10 | 248 | placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small placed-structure local-runtime side refresh over one live record. The helper samples the current structure coordinate pair through `0x00455800` and `0x00455810`, converts that pair through the basis at `0x006d4024`, `0x0051f090`, and `0x00534490` into one base scalar, and then conditionally adjusts that scalar when the linked candidate-side structure record keeps nonzero byte `[candidate+0xba]` via the rounded world-grid sampler `0x0044ae40` and the fixed subtractive offset at `0x005c8840`. When the auxiliary preview owner gate `shell_has_auxiliary_preview_owner` `0x00434050` is active, it rounds that scalar to an integer float. It then publishes the resulting position triplet through the shared setter `0x00530720` and tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers are the collection-wide local-runtime refresh wrapper `0x004133b0` and the connected-component recursion tail `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`, so this is now the strongest current owner for the per-site local-runtime position-triplet refresh rather than a generic coordinate helper. | objdump + caller inspection + local disassembly + local-runtime correlation + connected-component correlation |
| 85 | 0x0040ef10 | 1984 | placed_structure_finalize_creation_or_rebuild_local_runtime_state | map | thiscall | inferred | objdump + caller inspection + placement and mutation correlation | 3 | Broad placed-structure post-create or post-edit rebuild above the narrower route-style lane. The helper validates several linked-site and world-state preconditions before keeping the current site live, increments the global live-site count at `0x0062be40`, seeds runtime mode and year fields at `[this+0x390]`, `[this+0x3d4]`, and `[this+0x3d5]`, refreshes the adjacent site-status or overlay family through `0x0040d2d0`, and rebuilds one larger local owner or service bundle through `0x00418be0`, `0x0040eba0`, and the scalar-staging family `0x00475ed0` / `0x00474fe0` / `0x00475010` / `0x00475030` into fields such as `[this+0x24e]`, `[this+0x252]`, `[this+0x25a]`, and `[this+0x25e]`. Later in the same body it re-enters `0x0040db30`, and when the local latch at `[this+0x29e]` is still zero it also re-enters `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `1`. The tail is tighter now too: when creation-mode byte `[this+0x3d4]` equals `1`, the branch at `0x0040f692` triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6` just before the local live-site follow-on at `0x433b80`. Current grounded callers include the placement-side builders at `0x00403ef3` and `0x00404489`, later site-mutation paths at `0x0046f073` and `0x004707ff`, and one train-side site operation at `0x005098eb`, so this now looks like the broad post-create or post-edit runtime rebuild above route-style scoring and peer-link emission rather than a route-style-only helper. | objdump + caller inspection + placement and mutation correlation + route-style rebuild correlation + runtime-effect trigger-kind correlation |
| 86 | 0x0040f6d0 | 891 | placed_structure_construct_entry_from_candidate_and_world_args | map | thiscall | inferred | objdump + constructor inspection + caller correlation | 3 | Lower constructor beneath the shared placed-structure allocator at `0x004134d0`. The helper writes the new placed-structure id into `[this+0x2a4]`, clears a large band of local runtime fields, copies the candidate stem or label payload from the caller-supplied construction scratch record, initializes local world geometry through `0x0040cd70`, `0x0045b9b0`, `0x00455750`, and `0x00455720`, quantizes the input coordinates into the cached grid terms at `[this+0x388]` and `[this+0x38c]`, seeds the current scenario year into `[this+0x3d5]`, and initializes the class-weight lanes near `[this+0x28a]` from the linked candidate vtable owner. It then zeroes the local route-style and service-score bands, conditionally builds the first local owner or service record through `0x00418be0` and `0x0040eba0`, resolves the initial linked site id at `[this+0x2a8]` through `0x00481390` when the backing candidate subtype byte `[candidate+0x32]` is `1`, seeds region linkage through `0x0044a800` and `0x0041f7e0`, optionally re-enters `0x0040db30` for subtype `4`, and finally seeds the trailing random-like dwords at `[this+0x3d9]` and `[this+0x3dd]` from `0x518d70`. Current grounded caller is `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, so this is now the concrete placed-structure constructor rather than an anonymous lower helper beneath the placement-side builders. | objdump + constructor inspection + caller correlation + placed-structure runtime-state correlation |
| 87 | 0x0040fbe0 | 224 | placed_structure_endpoint_pair_has_shared_route_entry_key | map | thiscall | inferred | objdump + caller inspection + world-grid chain comparison | 3 | Boolean peer-test between one placed structure and one caller-supplied peer site id. The helper converts the current site and the peer site into their derived world-grid owner records through `0x00455800`, `0x00455810`, the world-grid tables rooted at `[0x0062c120+0x2129]`, and the placed-structure resolver `0x0040fa50`. It then compares the two route-entry chains rooted at `[cell+0x0ef]`, using the chain lengths at `[cell+0x0eb]`, and returns `1` on the first shared leading `u16` route-entry key; otherwise it returns `0`. Current grounded callers are the route-link emitter at `0x0040fef0`, where it blocks duplicate endpoint pairing before `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50`, and the neighboring cleanup sweep at `0x0040d2aa`, where it decides whether an existing site-owned route-link should be erased. This now looks like the shared duplicate-or-overlap test for the route-link family rather than a generic proximity check. | objdump + caller inspection + world-grid chain comparison + route-link duplicate-check correlation |
| 88 | 0x0040fef0 | 752 | placed_structure_try_emit_best_route_style_peer_link_for_candidate_class | map | thiscall | inferred | objdump + caller inspection + placed-structure sweep inspection | 3 | Scans the live placed-structure collection for one best peer site and emits a missing route-link for one caller-selected candidate class when a qualifying endpoint pair survives. The helper first derives one distance cap from the current placed-structure population size at `0x0062b26c`, scales that cap by the caller-supplied float, and then walks the live placed-structure ids in a wrapped pseudo-random order. Candidate peers must have a positive class-specific weight in the placed-structure lane `[peer+class*4+0x27e]`, differ from the source site, pass the linked-instance class gate `0x0040c990 == 1`, and lie inside the chosen distance window after the coordinate and span checks built from `0x00455800`, `0x00455810`, `0x00455f60`, and nearby math helpers. The strongest surviving peer is kept through a weighted comparison, and if one remains the helper re-enters `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0`; only when that duplicate check fails does it call `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` with the source site id from `[this+0x2a4]`, the chosen peer id, and the same candidate-class argument. Current grounded callers are the larger per-site world pass around `0x00410665` and the route-style grid contribution branch at `0x0042cafe`, so this now looks like the current peer-selection emitter for site-owned route-style links rather than a low-level allocator wrapper. | objdump + caller inspection + placed-structure sweep inspection + route-link emission correlation |
| 89 | 0x004101e0 | 6843 | placed_structure_rebuild_route_style_candidate_scores_and_peer_links | map | thiscall | inferred | objdump + caller inspection + route-style emission correlation | 3 | Large per-site rebuild pass above the route-style link emitter. The helper first requires the current placed structure to pass the linked-instance class gate `0x0040c990 == 1` and several scenario-state gates rooted at `0x006cec78` and `0x006cec7c`, then derives one set of per-class route-style score scalars from the current site's local state, scenario opinion multipliers through `0x00436590`, year-dependent dampers, and the placed-structure class-weight lanes near `[this+0x28a]`. The early compatibility side is tighter now too: it probes the current placed-structure stem against `Nuclear Power Plant`, `Electric Plant`, and `Recycling Plant`, stages three local boolean latches from those matches, and then clears the `Recycling Plant` latch again when the shared build-version query `0x00482e00` reports below `0x68` (`1.04`), so that stem-specific branch is now bounded as a post-`1.04` compatibility lane rather than one timeless route-style rule. For the first three route-style classes it conditionally re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the caller-supplied mode flag and one computed float score. The function then continues into a larger descriptor-driven scoring phase over the current candidate's runtime descriptor array at `[candidate+0x37]`, building temporary score bands and normalizing them against the same local totals before later write-back. That later phase has another bounded version gate: on one descriptor-accumulation subbranch the helper consults `0x00482e00` again at `0x41109f`, and build `1.05+` (`>= 0x69`) skips one older fallback attenuation path that earlier builds still apply through the local multiplier tables. Current grounded callers are the local per-site branch at `0x0040f640`, which reaches it with stack flag `1`, and the broader placed-structure sweep at `0x004135e3`, which reaches it with stack flag `0`; this is therefore the strongest current owner for route-style candidate scoring and peer-link emission on one live placed structure rather than a narrow one-off helper. | objdump + caller inspection + route-style emission correlation + descriptor-loop inspection + version-gate correlation + stem-probe correlation |
| 90 | 0x004134d0 | 112 | placed_structure_collection_allocate_and_construct_entry | map | thiscall | inferred | objdump + caller xrefs + constructor inspection | 3 | Shared direct placement helper above the broader placed-structure runtime rebuild. The helper first obtains one temporary `0x3e1`-sized construction scratch object through `0x53b070` and `0x0040c950`, then allocates one live placed-structure entry from the current collection through `0x518900`, resolves the new record through `0x518140`, and finally re-enters the lower constructor at `0x0040f6d0` with the new entry id plus the caller-supplied coordinate and candidate payload tuple. Current grounded callers include the candidate-placement branches at `0x00403ed5`, `0x0040446b`, and `world_region_try_place_candidate_structure` `0x00422ee0`, plus later mutation or editor-side branches at `0x0046efbf`, `0x0047074b`, `0x00472bef`, `0x00472d03`, and `0x00508fd1`. This now looks like the shared placed-structure allocator and constructor entrypoint beneath the placement-side builders rather than a route-style-specific helper. | objdump + caller xrefs + constructor inspection + placement correlation |
| 91 | 0x00413550 | 32 | placed_structure_collection_remove_entry_by_id_release_local_runtime_and_unlink | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small collection-side removal helper for the live placed-structure collection. It resolves the caller-supplied site id through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, re-enters `0x0040e080` to release the subject's local runtime and linked side state before removal, and then removes the id from the collection through `0x00518a30`. Current grounded caller is the broader placed-structure mutation branch at `0x00419110`, so this is the narrow remove-and-release sibling beneath the shared placed-structure collection family rather than a generic collection erase helper. | objdump + local disassembly + caller correlation + collection-removal correlation |
| 92 | 0x00413620 | 56 | placed_structure_collection_refresh_linked_peer_overlay_when_linked_peer_flagged | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide sweep over the live placed-structure store that simply re-enters `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0` for every live record. The helper walks every live entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, forwarding each record into the narrower linked-peer overlay refresh helper. Current grounded callers are the world-side preview linked-site setter `0x00452db0`, the broader preview or tool mode switch owner `0x00452fa0`, the specialization action dispatcher `0x0040e880`, and StationPlace cleanup `0x005079c0`, so this is the safest current read for the collection-side linked-peer overlay refresh sweep rather than another anonymous iterator. | objdump + local disassembly + caller correlation + collection-sweep correlation + linked-peer-overlay correlation |
| 93 | 0x00413660 | 117 | placed_structure_collection_publish_owner_match_color_through_vtable_slot_0x58 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Collection-wide color-publish sweep over live placed structures keyed by one caller-supplied owner id. For each live entry, the helper reads owner field `[site+0x276]`; when that field is nonzero it compares it against the caller argument, converts the boolean result into a packed color through `0x0051dfc0`, and forwards the split RGB lanes into placed-structure vtable slot `+0x58`. Current local evidence grounds this as a collection-side owner-match color sweep rather than a linked-site or route-style helper, so the note stays deliberately structural. | objdump + local disassembly + caller correlation + owner-field correlation + color-publish correlation |
| 94 | 0x004136e0 | 112 | placed_structure_collection_publish_scaled_candidate_field_0x3f_through_vtable_slot_0x54_for_nonlinked_entries | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Collection-wide scalar-publish sweep over the live placed-structure store. The helper skips entries whose vtable `+0x70` linked-site-capable latch is nonzero, then resolves the current candidate through vtable slot `+0x80`, keeps only entries with nonzero dword `[candidate+0x3f]`, derives one float through `0x0040fcc0`, quantizes it through `0x0051dfc0`, and forwards the resulting scalar into placed-structure vtable slot `+0x54`. Current local evidence grounds this as a non-linked-entry candidate-field scalar publish sweep rather than a narrower status or cargo helper. | objdump + local disassembly + caller correlation + candidate-field correlation + scalar-publish correlation |
| 95 | 0x00413750 | 256 | placed_structure_collection_refresh_mode3_or_mode6_linked_site_preview_membership | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide owner for the shared linked-site preview membership sweep used by the world-side preview families. The helper walks every live placed structure through the indexed-collection accessors and then splits by candidate subtype. On the subtype-`4` branch it requires `placed_structure_subject_candidate_is_subtype4` `0x0040d360`, tests the current site id `[site+0x2a4]` against the caller-supplied linked-site token through `0x00481500`, and then either activates the site through vtable slot `+0x54` with scenario scalar `[0x006cec78+0x66ba]` or clears it through vtable slot `+0x58(0,0,0)`. On the non-subtype-`4` branch it resolves the current center world-grid cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, scans the six-byte site roster at `[cell+0xeb/+0xef]`, optionally filters that roster by the caller-supplied token, keeps the smallest float lane from each matching row, and activates the site through vtable slot `+0x54` when a match survives; otherwise it tails into `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0`. Current grounded callers are the preview linked-site setter `0x00452db0` and the broader preview or tool mode switch owner `0x00452fa0`, so this is the safest current read for the collection-side mode-`3/6` linked-site preview membership refresh rather than a plain id-indexed lookup. | objdump + local disassembly + caller correlation + preview-mode correlation + center-cell-roster correlation + subtype4 correlation |
| 96 | 0x00413860 | 72 | placed_structure_collection_scan_center_cell_site_rosters_when_shell_gate_enabled | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide sweep over the live placed-structure store that simply re-enters `placed_structure_scan_center_cell_site_roster_when_shell_gate_enabled` `0x0040cd10` for every live record. The helper first checks shell latch `[0x006cec74+0x1c3]`, then walks every live entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, forwarding each record into the narrower center-cell roster scan. Current grounded callers are the zero-depth optional collection-refresh dispatcher `0x00433b80` and the broader post-load collection families around `0x004384d0`, so this is the clearest current owner for the collection-side linked-site center-cell roster sweep rather than another anonymous refresh stub. | objdump + local disassembly + caller correlation + collection-sweep correlation + center-cell-roster correlation |
| 97 | 0x004138b0 | 62 | placed_structure_collection_remove_route_links_for_sites_whose_center_cell_roster_contains_u16_token | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide route-link cleanup sweep over the live placed-structure store keyed by one caller-supplied `u16` token. The helper walks every live entry through the indexed-collection accessors and re-enters `0x0040d270` on each record. That narrower helper resolves the current center world-grid cell through `0x0040fa50`, requires `world_grid_cell_has_packed_u16_token_in_6byte_roster` `0x0042b2d0` to find the caller token in the cell's six-byte roster, and then walks the site's owned route-link chain at `[site+0x272]`, erasing overlapping links through the route-link collection owner `0x006ada90` whenever `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0` says the current link already shares the same route-entry key. Current local evidence grounds this as the collection-side route-link cleanup sweep keyed by one center-cell roster token rather than a generic route-style iterator. | objdump + local disassembly + caller correlation + route-link cleanup correlation + center-cell-token correlation |
| 98 | 0x004138f0 | 69 | placed_structure_collection_count_entries_with_cached_candidate_id_0x3d0 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small live-collection counter over the placed-structure store. The helper walks every live entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares cached dword `[entry+0x3d0]` against the caller-supplied id, and returns the number of matches. Current grounded callers are the year-threshold owner `0x00435b50` and a later world-side site sweep around `0x004d2600`, so this is the safest current read for the cached-candidate-id match counter rather than a generic collection size helper. | objdump + local disassembly + caller correlation + cached-candidate-id correlation |
| 99 | 0x00413940 | 93 | placed_structure_collection_sum_source_field_0x141_by_cached_candidate_id_with_floor1 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small placed-structure aggregation helper over the live collection. The helper walks every live entry through the indexed-collection accessors, filters by cached dword `[entry+0x3d0] == caller_id`, resolves the matching entry's source record through `placed_structure_resolve_source_record_from_current_stem` `0x0040cec0`, reads source dword `[source+0x141]`, floors that value to at least `1`, and accumulates the result. Current grounded caller is `structure_candidate_accumulate_positive_cargo_summary_channels_scaled_by_link_count` `0x0041e7be`, where this sum acts as the positive link-count scale factor above the four cargo-summary banks, so this is the safest current read for the source-field aggregation sibling rather than a generic count helper. | objdump + local disassembly + caller correlation + source-field correlation + cargo-summary correlation |
| 100 | 0x004139a0 | 95 | placed_structure_collection_count_entries_with_linked_station_or_transit_peer | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide counter over the live placed-structure store that counts only entries passing the narrower linked-peer station-or-transit gate. The helper walks every live entry through the indexed-collection accessors, first requires the linked-instance class gate `0x0040c990 == 1`, and then requires `placed_structure_has_linked_station_or_transit_peer` `0x0040d230` before incrementing the returned total. Current grounded callers sit in the same linked-site reporting strip as the neighboring class-specific counters, so this is the safest current read for the collection-side linked-peer station-or-transit counter rather than a generic class scan. | objdump + local disassembly + caller correlation + linked-peer gate correlation + station-or-transit correlation |
| 101 | 0x00413a00 | 146 | placed_structure_collection_count_linked_site_entries_with_peer_candidate_class3 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide counter over the linked-site-capable subset of live placed structures that counts only peers whose linked candidate class byte is `3`. The helper walks every live entry through the indexed-collection accessors, requires the linked-instance class gate `0x0040c990 == 1`, then requires the placed-structure vtable `+0x70` latch, resolves the cached linked peer through `placed_structure_resolve_linked_peer_record_from_cached_site_id` `0x0040d1f0`, follows that peer into the linked instance owner `0x0047de00`, and increments the total only when candidate class byte `[candidate+0x8c]` equals `3`. Current grounded callers sit in the same linked-site reporting strip as the neighboring counters, so this is the safest current read for the class-`3` linked-peer counter rather than a broader collection predicate. | objdump + local disassembly + caller correlation + linked-peer resolver correlation + candidate-class correlation |
| 102 | 0x00413aa0 | 146 | placed_structure_collection_count_linked_site_entries_with_peer_candidate_class4 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide companion to `0x00413a00` over the same linked-site-capable subset of live placed structures. The helper walks every live entry through the indexed-collection accessors, requires the linked-instance class gate `0x0040c990 == 1`, requires the placed-structure vtable `+0x70` latch, resolves the cached linked peer through `placed_structure_resolve_linked_peer_record_from_cached_site_id` `0x0040d1f0`, and increments the total only when that peer's resolved candidate class byte `[candidate+0x8c]` equals `4`. Current grounded callers sit in the same linked-site reporting strip as the class-`3` sibling, so this is the safest current read for the class-`4` linked-peer counter rather than another anonymous collection walk. | objdump + local disassembly + caller correlation + linked-peer resolver correlation + candidate-class correlation |
| 103 | 0x00413b40 | 124 | placed_structure_collection_count_subtype4_entries_without_linked_instance_candidate_flag_b9 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide counter over the live placed-structure subset that passes both the linked-instance class gate and the subtype-`4` candidate predicate. The helper walks every live entry through the indexed-collection accessors, requires `0x0040c990 == 1`, requires `placed_structure_subject_candidate_is_subtype4` `0x0040d360`, and then increments the returned total only when `placed_structure_query_linked_instance_candidate_flag_byte_b9` `0x0040d350` returns zero. Current local evidence grounds this as the subtype-`4` companion counter adjacent to the linked-peer class counters rather than overnaming candidate byte `0xb9`. | objdump + local disassembly + caller correlation + subtype4 correlation + candidate-byte-field correlation |
| 104 | 0x0041d550 | 574 | locomotive_era_and_engine_type_pass_company_policy_gate | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + engine-type correlation | 2 | Policy gate beneath the preferred-locomotive chooser and its non-electric fallback. The helper operates on one locomotive-era or availability record whose linked locomotive id sits at `[this+0x126]`. On the fuller policy path, reached when record field `[this+0x41]` is `2` or `3`, it first respects several scenario-state locks rooted at `[0x006cec74+0x180]`, `[0x006cec78+0x4c8c]`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x247]`, then resolves the linked locomotive record from `0x006ada84` and dispatches its engine-type dword `[locomotive+0x10]` across three scenario opinion slots through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`: `0x1c6`, `0x1c7`, and `0x1c8`, which current evidence now best aligns with the steam, diesel, and electric lanes. It also special-cases the locomotive stem at `[locomotive+0x34]` against the local string `WhaleL`; current data-file correlation now ties that stem to the `Orca NX462` locomotive family and its `WhaleL_NE` asset set, and when that compare hits the helper explicitly zeros the accumulated issue-opinion result before the later availability checks, so that family loses the positive-opinion shortcut rather than taking a bonus branch. It then consults one neighboring locomotive-derived issue or policy id through `0x00442a85`, and applies a late scenario availability triplet from `[0x006cec78+0x4c97..0x4c99]` against three per-record bytes `[this+0x30..0x32]` plus record field `[this+0x7b]`. That triplet now has a stronger player-facing read: the same three scenario bytes are the live editor-policy fields owned by `map_editor_locomotive_availability_panel_construct` `0x004cd680` and `map_editor_locomotive_availability_panel_handle_message` `0x004cf0d0`, and their localized labels `2863..2865` are `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All Electric Locos Avail.`. The current gate is narrower than a plain override: when the issue-opinion result stays positive and none of those three editor bytes are enabled, that positive result alone seeds the local availability flag; but once any of the editor family bytes is nonzero, the helper instead requires one matching intersection between the per-record family bytes `[this+0x30..0x32]` and the corresponding scenario bytes `0x4c97..0x4c99`. Independent of that family check, record field `[this+0x7b]` can still carry the path into the later year-window gate. On the simpler path it falls straight to an era-window gate using the current scenario year with floor `0x726` against `[this+0x105]` and `[this+0x109]`, plus one current-month-like check from `[0x006cec78+0x0f]`. The helper returns `1` when the era and engine family pass those combined scenario, opinion, availability, and year gates; otherwise `0`. Current grounded callers are `company_select_preferred_available_locomotive_id` `0x004078a0` and `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0`. | objdump + caller xrefs + callsite inspection + engine-type correlation + year-window correlation + scenario-gate correlation + editor-locomotive-availability correlation + WhaleL carveout correlation + engine-data correlation |
| 105 | 0x00417790 | 160 | map_angle_rotate_grid_offset_pair_into_world_offset_pair | map | cdecl | inferred | objdump + callsite inspection + math-table correlation | 2 | Small angle-table rotation helper beneath the placement projection family. The helper normalizes the caller-supplied heading float into the engine's cyclic angle domain, indexes one sine or cosine-like basis table under `0x006d4024`, and then applies that basis pair to the caller-supplied X or Y grid offsets before writing the rotated world-space offset pair through the two out-pointers. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, so this now looks like the low-level offset-rotation helper rather than a generic trig wrapper. | objdump + callsite inspection + math-table correlation |
| 106 | 0x00417840 | 205 | placed_structure_project_candidate_grid_extent_offset_by_rotation | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Projects one candidate-sized local grid extent into rotated world-space X or Y offsets for placement and mutation previews. The helper resolves the caller-supplied placed-structure id through the current collection, pulls one local grid basis pair through `0x00413d80`, reads the linked candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, converts those grid extents into local offset terms, and then re-enters `map_angle_rotate_grid_offset_pair_into_world_offset_pair` `0x00417790` with the caller-supplied heading float to produce the rotated output pair. Current grounded callers include the city-connection placement chooser `0x00402cb0`, the placed-structure local rebuild lane at `0x0040de78`, subtype-`1` placement validation inside `0x004197e0`, and later world-side update branches at `0x00417b6f`, `0x00417e27`, `0x0041a250`, `0x0041a615`, `0x004802c6`, `0x00480875`, and `0x00480d50`. This now looks like the shared projected-footprint offset helper beneath placement validation rather than an unnamed geometry routine. | objdump + caller xrefs + callsite inspection + placement-correlation |
| 107 | 0x00417b40 | 986 | route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading | map | thiscall | inferred | objdump + caller xrefs + local disassembly + callsite inspection | 3 | Tries to reuse one already-existing route entry from the global route-entry collection `0x006cfca8` for a caller-supplied site id, world-space point, and heading instead of synthesizing a new endpoint entry. The helper first projects the current candidate footprint through `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, probes the route-entry collection through `0x00494cb0`, and then subjects the returned entry plus its linked neighbors at `[entry+0x206/+0x20a/+0x20e]` to a tighter compatibility screen: `[entry+0x226]` must be clear, `[entry+0x222]` must be unset or already owned by the same site id, `[entry+0x20e]` must be `-1`, and the neighboring entries cannot already point back through the same side-link pattern selected by byte `[entry+0x201]`. When a candidate survives, the helper computes one accepted local heading and anchor offset through `0x0048bb40`, `0x005a1390`, `0x005a152e`, `0x0048a1a0`, `0x0048a1c0`, and `0x0051db80`, writes the accepted world-space pair and heading back through the caller out-pointers, optionally stores the reused route-entry id through stack arg `+0x2c`, and returns `1`; otherwise it returns `0`. Current grounded callers are the linked-site constructor `0x00480210`, the linked-site runtime refresh owner `0x00480710`, the broader route-anchor chooser around `0x0041a137`, and the StationPlace orientation-search helper `0x00508040`, so this is the safest current read for the reusable covering-route-entry search path rather than another route-synthesis owner. | objdump + caller xrefs + local disassembly + route-entry reuse correlation + linked-site correlation + station-place correlation |
| 108 | 0x004185a0 | 100 | world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Small world-grid mask helper beneath the neighboring projected-rectangle raster family. The helper walks one caller-supplied rectangle from the four dwords rooted at stack arg `+0x04`, reads the aligned float sample band from the caller buffer at stack arg `+0x08`, skips cells whose sample is still the sentinel `0x497423f0`, and otherwise toggles bit `0x01` in the grid-byte mask rooted at `[0x0062c120+0x2135]` by XORing it with the low bit of the caller-supplied byte flag at stack arg `+0x0c`. Current grounded callers are the higher projected-rectangle workers at `0x00418610`, `0x00418a60`, and `0x00418d40`, so this is now bounded as a non-sentinel mask-toggle helper rather than another generic grid writer. | objdump + caller inspection + local disassembly + grid-mask correlation |
| 109 | 0x00418610 | 584 | world_grid_refresh_projected_rect_sample_band_and_flag_mask | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan. | objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation |
| 110 | 0x00419110 | 234 | placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map | map | cdecl | inferred | objdump + caller xrefs + local disassembly + bucket-map correlation | 3 | Rectangular placed-structure refresh wrapper over a hashed per-cell bucket map. The helper clamps the caller rectangle against live world dimensions `[0x0062c120+0x2155/+0x2159]`, packs each cell key as `(row << 16) | col`, resolves one bucket head through the caller-supplied map root at `[arg0+0x88]` and the shared hash lookup `0x0053dae0`, and then walks the returned linked chain. For every resolved bucket entry it forwards the stored coordinate pair from `[entry+0x04/+0x08]` plus two zero stack flags into `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` on the current placed-structure owner carried by that entry, so the current effect is a local-runtime side-state refresh across every bucketed site in the rectangle rather than a generic collection iterator. Current grounded caller is the edit-side branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations, so this is the safest current read for the bucket-map-driven rect refresh wrapper rather than another world-grid brush helper. | objdump + caller xrefs + local disassembly + bucket-map correlation + local-runtime-side-state correlation |
| 111 | 0x00419200 | 41 | world_grid_query_projected_rect_scratch_cell_dword_if_present | map | cdecl | inferred | objdump + caller xrefs + local disassembly + projected-rect correlation | 3 | Tiny projected-rectangle scratch-bank getter over the temporary dword cell-value bank rooted at `0x0062b300`. When that bank exists, the helper flattens the caller-supplied cell coordinates through live world width `[0x0062c120+0x2155]` and returns the corresponding dword from the bank; otherwise it returns `0`. Current grounded caller is the later world-side branch at `0x0048af99`, which uses the returned nonzero test as one score or gating input, so this is the safest current read for the projected-rect scratch-cell dword getter rather than another permanent world-grid query. | objdump + caller xrefs + local disassembly + projected-rect correlation + scratch-bank correlation |
| 112 | 0x0041ab50 | 6 | city_database_entry_constant_38_stub_vtable_5c9750_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `38` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level. | objdump + vtable scan + local disassembly |
| 113 | 0x0041ab60 | 6 | city_database_entry_constant_34_stub_vtable_5c9750_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `34` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level. | objdump + vtable scan + local disassembly |
| 114 | 0x0041ab70 | 5 | city_database_entry_load_tagged_payload_via_0x45c6f0 | map | thiscall | inferred | objdump + vtable correlation + local disassembly | 2 | Tiny city-database-entry-family loader thunk in the sibling vtable rooted at `0x005c9750`. The helper simply jumps into `0x0045c6f0`, which stages tag family `0x61a9/0x61aa/0x61ab`, restores two strings into `[this+0x32e]` and `[this+0x332]`, and iterates the child runtime band rooted at `[this+0x316]`. The table-family alignment is now direct: `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540` iterates its loaded records and dispatches vtable slot `+0x40`, which in `0x005c9750` resolves into the same record family immediately adjacent to this loader slot. | objdump + vtable correlation + local disassembly + city-database loader correlation |
| 115 | 0x0041ab80 | 127 | city_database_entry_refresh_named_handle_and_return_scaled_primary_float | map | thiscall | inferred | objdump + caller inspection + local disassembly + city-database family correlation | 2 | City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The row is therefore carried conservatively as a named-handle refresh within the city-database collection family refreshed by `0x00474540` and serialized by `0x00474610`. | objdump + caller inspection + local disassembly + city-database family correlation |
| 116 | 0x0041ac00 | 3 | city_database_entry_false_stub_vtable_5c9750_slot0 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 117 | 0x0041ac10 | 3 | city_database_entry_false_stub_vtable_5c9750_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Second tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 118 | 0x0041ac20 | 3 | city_database_entry_false_stub_vtable_5c9750_slot2 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Third tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 119 | 0x0041ac30 | 6 | city_database_entry_constant_10_stub_vtable_5c9750_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny constant-return virtual slot in the city-database-entry table `0x005c9750`. The helper returns literal `10` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level. | objdump + vtable scan + local disassembly |
| 120 | 0x0041ac40 | 6 | city_database_entry_true_stub_vtable_5c9750_slot0 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 121 | 0x0041ac50 | 6 | city_database_entry_true_stub_vtable_5c9750_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Second tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 122 | 0x0041f5c0 | 134 | world_region_load_tagged_payload_and_profile_collection_0x37f | map | thiscall | inferred | objdump + vtable scan + local disassembly + region-family correlation | 2 | Payload-side virtual slot in the world-region record table rooted at `0x005c9a60`. The helper clamps scalar `[region+0x31b]` to at least `1.0`, clears `[region+0x317]` when that clamp fires, reloads the shared tagged string-triplet payload through `0x00455fc0`, allocates one `0x88`-byte indexed-collection object through `0x0053b070`, constructs that collection through `0x00518b90`, stores it into `[region+0x37f]`, and then forwards the caller-supplied bundle or stream context into that collection through `0x00518680`. The function returns the accumulated size from the payload reload plus collection load. Constructor-side evidence now ties `[region+0x37f]` to the same profile-collection family rebuilt by `0x00420e00` and `0x00420ed0`. | objdump + vtable scan + local disassembly + region-family correlation + profile-collection correlation |
| 123 | 0x0041f650 | 31 | world_region_serialize_tagged_string_triplet_and_profile_collection_0x37f | map | thiscall | inferred | objdump + vtable scan + local disassembly + region-family correlation | 2 | Small stream-side virtual slot in the same world-region record table `0x005c9a60`. The helper first emits the tagged string-triplet payload through `0x004559d0`, then forwards the same caller-supplied bundle or stream context into profile collection `[region+0x37f]` through `0x00517d90`. Constructor-side and rebuild-side evidence now tie that field to the live region profile subcollection rather than an anonymous dynamic helper. | objdump + vtable scan + local disassembly + region-family correlation + profile-collection correlation |
| 124 | 0x0041f680 | 25 | world_region_refresh_global_preview_helper_and_dispatch_mode1_preview_handle_0x23a | map | thiscall | inferred | objdump + vtable scan + local disassembly + region-family correlation | 2 | Small virtual slot in the world-region record table `0x005c9a60`. The helper first re-enters `0x00455de0`, which refreshes the current global preview or helper owner from the region's normalized coordinates and anchor triplet. It then loads preview handle `[region+0x23a]`, sets `ECX = 1`, and tails into `0x004cf830`, which allocates or refreshes one `0xa0`-byte helper object before forwarding both values into `0x004cf550`. Constructor-side evidence now grounds this family as the live world-region record cluster, so this note no longer needs the open subtype qualifier. | objdump + vtable scan + local disassembly + region-family correlation + global-preview-helper correlation |
| 125 | 0x0041f6a0 | 11 | world_region_query_profile_collection_slot_count_field_0x37f | map | thiscall | inferred | objdump + local disassembly + region-family correlation | 2 | Tiny world-region helper that treats field `[region+0x37f]` as one indexed collection and returns its current slot count through `indexed_collection_slot_count` `0x00517cf0`. Current grounded caller is `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, where it bounds one region-local profile or structure-count loop. | objdump + local disassembly + region-family correlation + profile-collection correlation |
| 126 | 0x0041f6b0 | 40 | world_region_query_world_scalar_at_rounded_normalized_coords | map | thiscall | inferred | objdump + local disassembly + region-family correlation | 2 | Small helper in the world-region record family. It queries the normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, rounds both through `0x005a10d0`, then forwards the resulting integer pair plus the active world root `0x0062c120` into `0x0044afa0`. Current evidence is strong enough for the rounded region-coordinate world-scalar query shape, but not for a tighter semantic name for the returned scalar. | objdump + local disassembly + region-family correlation + world-scalar-query correlation |
| 127 | 0x0041f6e0 | 12 | world_region_center_world_grid_cell_has_packed_u16_token | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small helper that resolves the current region's center world-grid cell through `world_region_resolve_center_world_grid_cell` `0x00455f60` and then tails into `world_grid_cell_has_packed_u16_token_in_6byte_roster` `0x0042b2d0` with the caller-supplied `u16` token. Current grounded callers include the city-connection bonus sweep `0x004010f0`, where it acts as a center-cell token probe rather than a broader route or ownership query. | objdump + local disassembly + caller correlation + packed-roster correlation |
| 128 | 0x0041f6f0 | 5 | world_region_query_flag_byte_0x42 | map | thiscall | inferred | objdump + local disassembly + field inspection | 1 | Tiny raw byte getter over region field `[this+0x42]`. The helper zero-extends that byte into `EAX` and returns immediately, with no side effect. Current evidence keeps the row at the raw flag-byte level. | objdump + local disassembly + field inspection + region-family correlation |
| 129 | 0x0041f700 | 3 | runtime_object_false_stub_vtable_5cfd00_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 130 | 0x0041f710 | 6 | runtime_object_true_stub_vtable_5cfd00_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-true virtual slot immediately after `0x0041f700` in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 131 | 0x0041f720 | 136 | world_region_publish_formatted_name_and_enter_preview_mode_0x12_when_world_state_0_or_0x15 | map | thiscall | inferred | objdump + vtable scan + local disassembly + caller correlation | 2 | Virtual slot in the world-region record table rooted at `0x005c9a60`. The helper formats the current name lane `[region+0x356]` into one stack-local shell text buffer through `0x005193f0` and `0x00518de0`, publishes that buffer through `0x00538c70`, and then checks world state `[0x0062c120+0x2175]`. When that state is `0` or `0x15`, it dispatches `world_switch_preview_or_tool_mode_and_seed_parameter_block` `0x00452fa0` with preview handle `[region+0x23a]`, literal action `0x12`, and the paired sentinel dwords `0x1869f/0x1869f`. Constructor-side evidence now grounds this family as the live world-region record cluster rather than an unnamed sibling subtype. | objdump + vtable scan + local disassembly + caller correlation + region-family correlation + world-mode branch correlation |
| 132 | 0x0041f7b0 | 42 | world_region_publish_fixed_shell_payload_and_clear_preview_mode_when_world_state_0x12 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Small virtual slot in the same world-region record table `0x005c9a60`. The helper publishes the fixed payload at `0x005c87a8` through `0x00538c70`, then checks world state `[0x0062c120+0x2175]`; when that state equals `0x12`, it tails into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`. Current evidence is strong enough for the fixed-payload publish plus conditional preview-clear shape on the world-region family. | objdump + vtable scan + local disassembly + region-family correlation + world-mode branch correlation |
| 133 | 0x0041f7e0 | 35 | world_region_prepend_linked_structure_site_id_into_cached_chain_head_field_0x383 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small world-region chain-link helper over cached head word `[region+0x383]`. The caller-supplied placed-structure record receives the old head id in `[site+0x270]`, and the current region then replaces `[region+0x383]` with that site's own placed-structure id `[site+0x2a4]`. Current grounded caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, which reaches this helper while seeding the region linkage for one newly created site. | objdump + caller xrefs + local disassembly + region-link-chain correlation |
| 134 | 0x0041f810 | 51 | world_region_resolve_live_linked_structure_from_cached_chain_head_field_0x383 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small resolver over region cached head word `[region+0x383]`. The helper first asks the live placed-structure collection `0x0062b26c` whether that `u16` id is still live through `0x00517d40`; when present it resolves and returns the corresponding placed-structure record through `0x00518140`, otherwise it returns null. Current grounded caller is the higher route-style or transient branch at `0x0043bd62`, which uses the returned linked structure before re-entering `0x0040cf00`. | objdump + caller xrefs + local disassembly + region-link-chain correlation |
| 135 | 0x0041f850 | 126 | world_region_remove_linked_structure_site_from_cached_chain_and_clear_site_link_words_0x26e_0x270 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Removal-side companion to `0x0041f7e0` over the world-region linked-structure chain. The current region owns cached head word `[region+0x383]`, while the caller-supplied placed-structure record contributes its site id `[site+0x2a4]` and next-link word `[site+0x270]`. When the head equals that site id, the helper replaces `[region+0x383]` with the site's next link; otherwise it walks the current linked `u16` chain through collection `0x0062b26c` and each site's own `[record+0x270]` until it finds the predecessor, then patches that predecessor's next-link word to the site's successor. Before returning it clears both site link words `[site+0x26e]` and `[site+0x270]`. Current grounded caller is the placed-structure rebuild branch at `0x0040e25e`. | objdump + caller xrefs + local disassembly + region-link-chain correlation |
| 136 | 0x0041f8d0 | 55 | world_region_clear_linked_structure_site_chain_from_head_field_0x383 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small chain-clear helper over region cached head word `[region+0x383]`. Starting from that `u16` head id, the helper repeatedly resolves each live placed-structure record through collection `0x0062b26c`, follows link word `[site+0x270]`, and clears both `[site+0x26e]` and `[site+0x270]` on every traversed record until the chain reaches zero. Current grounded caller is the release-side helper `0x00420670`, which uses this pass immediately before tailing into base cleanup `0x00455d20`. | objdump + caller xrefs + local disassembly + region-link-chain correlation |
| 137 | 0x0041f910 | 46 | runtime_object_query_mode_gate_or_flag_byte_0x42_when_class0 | map | thiscall | inferred | objdump + local disassembly + mode-gate correlation | 2 | Small mode-gated flag query adjacent to the sibling runtime-object family. It first checks shell mode gate `0x004338c0` on the active scenario root `0x006cec78`; when that gate is inactive it returns literal `1`. When the gate is active it also returns `1` for nonzero class dword `[this+0x23e]`, and only on the class-0 path does it return byte `[this+0x42]`. This keeps the current note structural around the mode-gated runtime-flag query rather than overnaming the flag itself. | objdump + local disassembly + mode-gate correlation + field inspection |
| 138 | 0x00412af0 | 117 | indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small indexed-collection lookup by casefolded name. The helper walks the live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the first byte of the caller string against entry field `[entry+0x04]` after normalizing both through `0x0051d660`, and then falls back to full string comparison through `0x005a57cf`. On the first exact match it returns that live entry id; otherwise it returns `0`. Current grounded caller is `0x00412b70`, which uses it over the structure-candidate pool `0x0062b268`. | objdump + local disassembly + caller correlation + collection-name-lookup correlation |
| 139 | 0x00412b70 | 35 | indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small resolve-by-name wrapper over `indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04` `0x00412af0`. It searches the current collection for the caller-supplied casefolded name, and when a live id is found it resolves and returns the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`; otherwise it returns null. Current grounded callers are the region-profile helpers `0x0041f940` and `0x0041f9b0`, where it resolves structure-candidate records from region-profile labels against the global candidate pool `0x0062b268`, plus the `.smp` restore lane inside `world_load_saved_runtime_state_bundle` `0x00446d40`, where each restored named candidate-availability record is kept only when its copied stem survives the fixed built-in rejects and resolves back into that same live candidate pool. | objdump + local disassembly + caller correlation + collection-name-lookup correlation + restore-side-name-validation correlation |
| 140 | 0x00412ba0 | 32 | structure_candidate_collection_remove_entry_by_id_release_runtime_descriptor_tables | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small collection-side removal helper for the live structure-candidate pool. It resolves the caller-supplied candidate id through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, releases that candidate's dependent runtime descriptor and cargo-membership tables through `structure_candidate_release_runtime_descriptor_and_cargo_membership_tables` `0x00411cb0`, and then removes the id from the collection through `0x00518a30`. Current grounded callers sit in the same candidate rebuild and load strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow remove-and-release sibling for runtime-backed candidate records rather than a generic collection erase helper. | objdump + local disassembly + caller correlation + candidate-runtime-release correlation |
| 141 | 0x00412bd0 | 56 | structure_candidate_collection_rebuild_cargo_membership_tables_counts_and_scaled_rate_bands_for_all_live_records | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide sweep over the live structure-candidate pool that simply re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes each candidate's two compact cargo-membership tables at `[candidate+0x79c/+0x7a0]`, the paired counts at `[candidate+0x7a4/+0x7a8]`, and the scaled runtime rate band at `[candidate+0xa1..+0xb8]` from the already-materialized `0xbc` descriptor strip. Current grounded callers sit in the same rebuild and load family as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side cargo-summary rebuild sibling rather than a broader scenario projection owner. | objdump + local disassembly + caller correlation + cargo-summary-sweep correlation + candidate-table-field correlation |
| 142 | 0x00412c10 | 144 | structure_candidate_collection_refresh_named_availability_latch_0x7ac_and_tail_into_cargo_economy_filter_refresh | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide refresh of candidate availability latch `[candidate+0x7ac]` beneath the startup and editor availability family. When scenario state `0x006cec78` exists, the helper walks every live candidate through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Candidates whose paired availability bytes `[candidate+0xba]` or `[candidate+0xbb]` are already nonzero, or whose subtype byte `[candidate+0x32]` is not `2`, are forced to `[candidate+0x7ac] = 1`. The remaining subtype-`2` candidates query the scenario-side named availability table through `scenario_state_query_named_candidate_availability_record_value` `0x00434ea0` using the candidate stem at `[candidate+0x04]`, and store that returned override bit into `[candidate+0x7ac]`. When the live structure collection `0x0062ba8c` exists, the helper then tails into `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`, so the strongest current read is one candidate-availability refresh followed immediately by the dependent cargo-economy filter rebuild. Current grounded caller is `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20`, and the same startup-side candidate filter family later writes the same latch. | objdump + local disassembly + caller correlation + named-availability correlation + cargo-economy-followon correlation |
| 143 | 0x00412fb0 | 561 | structure_candidate_collection_stream_load_rebuild_runtime_summaries_and_refresh_named_availability | map | thiscall | inferred | objdump + local disassembly + caller correlation | 4 | Broader collection-load owner for the live structure-candidate pool rooted at `0x0062b268`. The helper opens one repeated tagged import source around the fixed stem `0x005c93fc` through the callback trio at `0x005c8190/0x005c8194/0x005c819c`, allocates or resolves each live candidate id through collection vtable slot `+0x04`, and then re-enters `structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state` `0x004120b0` for every imported record. After the per-record loop it reprojects the scenario-side recipe runtime back into the same pool through `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, reruns the stem-policy sweep `0x00412ab0`, clears the collection aggregate quintet `[this+0x8c..+0x9c]`, and then accumulates the subtype-`3` record summary lanes `[candidate+0x8d/+0x91/+0x95/+0x99/+0x9d]` back into that collection-level band. A later fixed name-catalog sweep is tighter now too: for every non-subtype-`1` candidate whose availability bytes `[candidate+0xba]` and `[candidate+0xbb]` are both zero and whose live id stays within `0x6e`, the helper localizes the candidate stem at `[candidate+0x4f]` through `0x51c920`, formats localized string id `0x0b53`, copies up to `0x46` bytes into row `0x0061dbc2 + id*0x6e`, and stores that same live id into dword slot `0x0061dc09 + id*0x6e`. Only after that catalog rebuild does it re-enter `structure_candidate_collection_refresh_named_availability_latch_0x7ac_and_tail_into_cargo_economy_filter_refresh` `0x00412c10`. Current grounded caller is the constructor-side load owner `0x004131f0`, which stores the resulting collection at `0x0062b268`. | objdump + local disassembly + caller correlation + tagged-import-source correlation + collection-aggregate correlation + named-catalog correlation |
| 144 | 0x004131f0 | 49 | structure_candidate_collection_construct_and_stream_load_runtime_records | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Constructor-side load owner for the live structure-candidate collection rooted at `0x0062b268`. The helper runs the shared collection base initializer `0x00517ce0`, installs vtable `0x005c93cc`, seeds the collection through `0x00518570` with literal configuration `(1, 0x7c8, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `structure_candidate_collection_stream_load_rebuild_runtime_summaries_and_refresh_named_availability` `0x00412fb0`. Current grounded caller is the world bring-up load branch at `0x00438c8e`, which allocates a `0xa0`-byte object and stores the result into global `0x0062b268`. | objdump + local disassembly + caller correlation + collection-constructor correlation |
| 145 | 0x00413230 | 39 | placed_structure_collection_construct_empty_runtime_pool | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Constructor for the live placed-structure collection rooted at `0x0062b26c`. The helper runs the shared collection base initializer `0x00517ce0`, installs vtable `0x005c9414`, and seeds the collection through `0x00518570` with literal configuration `(0, 0, 0x0a, 0x14, 0, 0, 0)` before returning `this`. Current grounded caller is the world-entry bring-up branch at `0x00448871`, which allocates an `0x8c`-byte object and stores the result into global `0x0062b26c`. | objdump + local disassembly + caller correlation + collection-constructor correlation |
| 146 | 0x00413260 | 22 | placed_structure_collection_release_and_free | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small destructor-side wrapper for the live placed-structure collection rooted at `0x0062b26c`. The helper reinstalls collection vtable `0x005c9414`, re-enters the shared collection release body `0x00518600`, and then tails into common collection teardown `0x00518bd0`. Current grounded caller is the world-release lane at `0x0044933d`, which clears the same global collection root during teardown. | objdump + local disassembly + caller correlation + collection-layout correlation |
| 147 | 0x00413280 | 291 | placed_structure_collection_stream_load_tagged_entries_and_publish_progress | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Tagged stream-load owner for the live placed-structure collection at `0x0062b26c`. The helper reads the three tagged section markers `0x36b1`, `0x36b2`, and `0x36b3` through `0x00531360`, seeds the collection header through `0x00518680`, snapshots the current global progress scalar `0x00ccb9e8`, and then walks every live placed-structure entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. For each entry it materializes one temporary stack-local entry shim through `0x0040c950`, dispatches the load-side entry virtual `slot+0x40` with the caller bundle, advances `0x00ccb9e8` in one evenly distributed step from that saved base, re-enters `0x004834e0` on the active world root, and then tears the temporary shim back down through `0x0040c970`. Current grounded caller is the larger world-entry load path at `0x00444467`, where this helper is the concrete collection-side import owner rather than one bare tagged reader. | objdump + local disassembly + caller correlation + tagged-stream correlation + progress-publish correlation + temporary-entry-shim correlation |
| 148 | 0x00413440 | 129 | placed_structure_collection_stream_save_tagged_entries | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Tagged stream-save owner for the live placed-structure collection at `0x0062b26c`. The helper writes the section markers `0x36b1`, `0x36b2`, and `0x36b3` through `0x00531340`, serializes the collection header through `0x00517d90`, emits the fixed side records at `0x005c9438` and `0x005c9420` through `0x00442660`, and then walks every live placed-structure entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each entry's save-side virtual `slot+0x44` with the caller bundle. Current grounded caller is the world-save path at `0x004452f5`, so this is the collection-side tagged save owner paired with `0x00413280` rather than another generic collection iterator. | objdump + local disassembly + caller correlation + tagged-stream correlation + collection-save correlation |
| 149 | 0x0041f940 | 88 | world_region_count_structure_profiles_passing_availability_gate | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70` and passes the neighboring availability gate `0x0041f998`. The helper walks the live subcollection backward through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, increments the running count only for candidates that survive both gates, and returns that total. Current grounded caller is the editor-side region panel family around `0x004cbe19`, where it acts as the ungated companion to the stricter year-filtered counter `0x0041f9b0`. | objdump + local disassembly + caller correlation + region-subcollection correlation |
| 150 | 0x0041f998 | 23 | structure_candidate_availability_gate_reject_subtype2_without_availability_word_or_recipe_runtime | map | cdecl | inferred | objdump + local disassembly + caller correlation | 2 | Tiny flag-setting predicate over one structure-candidate record. Candidates whose subtype byte `[candidate+0x32]` is not `2` pass immediately. Subtype-`2` candidates only pass when availability word `[candidate+0xba]` is nonzero or runtime recipe latch `[candidate+0x7ac]` is nonzero; when both are zero the helper leaves the zero flag set so its callers reject the candidate. Current grounded callers are the two region-profile counters `0x0041f940` and `0x0041f9b0`. | objdump + local disassembly + caller correlation + candidate-availability correlation |
| 151 | 0x0041f9b0 | 126 | world_region_count_structure_profiles_matching_subtype_and_max_year_after_availability_gate | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70`, passes the neighboring availability gate `0x0041f998`, has subtype byte `[candidate+0x32]` equal to the caller-supplied subtype, and has year word `[candidate+0x26]` less than or equal to the caller-supplied max-year threshold. The helper walks the same live subcollection as `0x0041f940` through `0x00517cf0/0x00518380/0x00518140`, increments only when all four gates pass, and returns that stricter count. Grounded callers include the editor region panel around `0x004cbd41`, where it supplies the subtype-`2`, year-`0x726` companion count, and the later summary or warning pass at `0x004d0b1f`. | objdump + local disassembly + caller correlation + region-subcollection correlation + editor-panel correlation |
| 152 | 0x0041fa30 | 133 | world_region_query_profile_weight_by_casefolded_label | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Linearly scans the current region subcollection `[region+0x37f]`, compares each live profile label against the caller-supplied casefolded string through `0x005a57cf`, and returns float field `[entry+0x1e]` from the first match. When no label matches, the helper returns the shared zero float at `0x005c8598`. The editor copy-industry and region-summary paths already ground `[entry+0x1e]` as the mutable profile-weight lane, so the safest read is a casefolded profile-weight query by label rather than a broader scalar lookup. | objdump + local disassembly + caller correlation + region-subcollection correlation + profile-weight correlation |
| 153 | 0x0041fac0 | 59 | world_region_copy_nth_profile_label_and_weight_by_1_based_ordinal | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Resolves the caller-requested 1-based ordinal out of the current region subcollection root `[region+0x37f]`, copies the matched live profile label string into the caller buffer, and stores float field `[entry+0x1e]` through the caller-supplied out pointer. The helper uses `0x00518380/0x00518140` beneath the same subcollection root as `0x0041f940/0x0041fa30`, and grounded editor callers around `0x00421db7`, `0x00421ec7`, and `0x004d1817` use it as the ordinal enumerator for region profile labels plus weights. The current evidence is strong enough for a 1-based ordinal copy helper, not for a broader iterator name. | objdump + local disassembly + caller correlation + region-subcollection correlation + profile-weight correlation |
| 154 | 0x0041fb00 | 1130 | world_region_class0_stamp_local_secondary_overlay_and_scored_refinement_pass | map | thiscall | inferred | objdump + caller xrefs + local disassembly + raster-helper correlation | 3 | Heavy per-region helper used only on class-0 region records. The function skips any region whose class dword `[region+0x23e]` is nonzero, rounds the region's normalized coordinates through `0x00455800`, `0x00455810`, and `0x005a10d0`, derives one orientation bucket from `(x+y)&3`, and then runs two bounded local passes around that center. The first pass walks one orientation-dependent ring pattern from the static offset tables `0x00624b28/0x00624b48`, probes quarter-resolution secondary-raster cells through `0x00534e10`, and when that predicate stays clear marks the local secondary overlay through `0x004497a0(world, x, y, 1, 3, 1)`. The second pass scans a bounded square around the same center, scores each in-bounds cell through `math_measure_float_xy_pair_distance` `0x0051db80`, and then combines the local helper cluster `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0` before returning. Current grounded callers are the region collection walk at `0x00421d04` and the earlier world-build special case at `0x0044308e`, where the same helper runs immediately before `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`. | objdump + caller xrefs + local disassembly + raster-helper correlation + region-build correlation |
| 155 | 0x0041fff0 | 61 | world_query_shell_mode2_or_thresholded_preview_scalar_gate | map | cdecl | inferred | objdump + caller xrefs + local disassembly + global-field correlation | 2 | Small global gate over shell state `0x006cec74` and preview owner `0x0062be68`. The helper reads dword `[shell+0x2bb]` and returns `1` immediately when that mode equals `2`; when the mode is nonzero but not `2` it instead compares preview scalar `[0x0062be68+0x20]` against float threshold `0x005c9a9c` and returns `1` only when that comparison passes. Zero mode returns `0`. Current grounded callers are the scored world-scalar helper `0x0044afa0` and the city-connection status formatter band around `0x00420b09`, so the safest current read is the shared shell-mode-or-thresholded-preview gate rather than a region-only predicate. | objdump + caller xrefs + local disassembly + global-field correlation + threshold-gate correlation |
| 156 | 0x00455660 | 131 | runtime_object_publish_world_anchor_triplet_from_normalized_xy_and_height_bias | map | thiscall | inferred | objdump + caller xrefs + local disassembly + sibling-vtable correlation | 2 | Shared helper over the broader `0x23a` runtime-object family. The function scales the caller-supplied normalized coordinate pair through `0x005c8700`, converts that pair through world-basis owner `0x006d4024` plus `0x0051f090` and `0x00534490`, adds one caller-supplied integer height bias, optionally rounds that height when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting world-anchor triplet through `0x00530720`. It is used directly from both the city-entry side (`0x00455d09`, `0x00474253`) and the placed-structure specialization side through `0x0045b110`, so the safest current read is one shared world-anchor triplet publisher from normalized XY plus height bias rather than a city-only geometry helper. | objdump + caller xrefs + local disassembly + sibling-vtable correlation + world-anchor correlation |
| 157 | 0x004557b0 | 64 | record_collection_release_global_iteration_root_0x6acd40_if_present | map | cdecl | inferred | objdump + caller xrefs + local disassembly | 2 | Small release-side helper over the current global iteration root at `0x006acd40`. When that root is live the helper clears companion dword `0x006acd3c`, re-enters `0x0045b160` and `0x0045b040` on the pointed record, frees the record through `0x0053b080`, and finally clears `0x006acd40` itself. Current grounded callers include the shell detail-panel manager `0x004ddfc1`, the earlier world-side branch `0x00434a8c`, the building-detail side branch `0x004b6f64`, and later shell constructors at `0x00505dc6` and `0x005147e4`, so the safest current read is one shared global-iteration-root release helper rather than a tool-window-specific cleanup path. | objdump + caller xrefs + local disassembly + global-root correlation |
| 158 | 0x00455800 | 13 | runtime_object_query_normalized_primary_coord | map | thiscall | inferred | objdump + caller xrefs + field inspection + sibling-vtable correlation | 2 | Tiny float getter shared across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1e2]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455810` from city-side, placed-structure, route-link, and world-grid callers, and now also appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized primary coordinate getter rather than a fully named X/Y accessor. | objdump + caller xrefs + field inspection + sibling-vtable correlation |
| 159 | 0x00455810 | 13 | runtime_object_query_normalized_secondary_coord | map | thiscall | inferred | objdump + caller xrefs + field inspection + sibling-vtable correlation | 2 | Tiny float getter paired with `0x00455800` across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1ea]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455800` and appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized secondary coordinate getter rather than a fully named X/Y accessor. | objdump + caller xrefs + field inspection + sibling-vtable correlation |
| 160 | 0x00455930 | 148 | runtime_object_serialize_two_triplet_scalar_bands | map | thiscall | inferred | objdump + local disassembly + serializer symmetry + sibling-vtable correlation | 2 | Shared serializer over the broader `0x23a` runtime-object family. The helper first queries two triplet-like scalar bands through `0x0052e720` and `0x0052e880`, then writes the six resulting dwords to the caller-supplied bundle or stream through `0x00531030`. The grounded load-side stream counterpart is `0x00455870`, which reads those same six four-byte lanes back through `0x00531150` and republishes the resulting triplets. The same serializer slot appears in both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one shared serializer for two triplet scalar bands rather than a city-only stream helper. | objdump + local disassembly + serializer symmetry + sibling-vtable correlation |
| 161 | 0x004559d0 | 102 | runtime_object_serialize_tagged_string_triplet_and_dispatch_slot_0x4c | map | thiscall | inferred | objdump + local disassembly + serializer symmetry + sibling-vtable correlation | 2 | Shared tagged string-triplet serializer beneath the broader `0x23a` runtime-object family. The helper writes bracket tags `0x55f1/0x55f2/0x55f3` through `0x00531340`, emits the three string lanes `[this+0x206/+0x20a/+0x20e]` through `0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before writing the closing tag. Current grounded callers include the common placed-structure serializer path `0x0045b560` and the sibling-table wrapper `0x0041f650`, so this is the safest current read for the tagged string-triplet save-side helper rather than a load-side mirror. | objdump + local disassembly + serializer symmetry + sibling-vtable correlation + tagged-string correlation |
| 162 | 0x00455a40 | 3 | record_collection_dispatch_entry_virtual_slot_0x44 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 1 | Tiny collection-side dispatcher that jumps directly through the current entry vtable slot `+0x44`. Current grounded caller is the linked-list sweep at `0x0048a766`, where it is used while iterating sibling records under `0x00556ef0/0x00556f00`. The safest current read is a raw `slot+0x44` dispatch helper rather than a more semantic serializer name. | objdump + caller xrefs + local disassembly + linked-list sweep correlation |
| 163 | 0x00455a50 | 28 | record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 1 | Small collection-side wrapper that pushes one caller argument into current entry vtable slot `+0x40`, then clears the three global roots at `0x006acd38`, `0x006acd3c`, and `0x006acd40`. Current grounded caller is the object-construction path at `0x0048dd77`, so the safest current read is a raw `slot+0x40` dispatch plus global-iteration-root reset helper rather than a more semantic load or attach name. | objdump + caller xrefs + local disassembly + global-root reset correlation |
| 164 | 0x00455a70 | 135 | runtime_object_publish_current_position_triplet_with_height_bias | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small runtime-object helper that queries the current position pair through `0x0052e720`, converts that pair through `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds one caller-supplied integer height bias, optionally rounds the result through `0x005a10d0` when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting triplet through `0x00530720`. Current grounded callers are the bounded-region sweeps at `0x00421fef` and `0x00461808`, which makes this the safest current read for a generic current-position triplet publisher rather than a city-entry-only helper. | objdump + caller xrefs + local disassembly + position-triplet correlation |
| 165 | 0x00455820 | 23 | runtime_object_store_byte43_triplet_from_three_bytes_and_recurse_children | map | thiscall | inferred | objdump + local disassembly + wrapper inspection | 2 | Tiny wrapper over `0x0052e680`. The helper forwards three caller-supplied byte lanes plus literal recursion flag `1`, causing the downstream packed-byte setter to write byte-triplet lane `[this+0x43]` and recurse across child list `[this+0x75]` when present. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from three explicit byte arguments. | objdump + local disassembly + wrapper inspection + packed-byte-family correlation |
| 166 | 0x00455840 | 23 | runtime_object_store_byte43_triplet_from_packed_u24_and_recurse_children | map | thiscall | inferred | objdump + local disassembly + wrapper inspection | 2 | Tiny wrapper over `0x0052e680`. The helper unpacks one caller-supplied dword into three byte lanes, forces recursion flag `1`, and forwards the result into the shared packed-byte setter for lane `[this+0x43]`. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from one packed `u24`-style value rather than three explicit byte arguments. | objdump + local disassembly + wrapper inspection + packed-byte-family correlation |
| 167 | 0x00455860 | 5 | runtime_object_thunk_to_shared_formatter_0x530820 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 1 | Tiny tail-jump thunk that forwards directly into `0x00530820`. Current grounded callers include the placed-structure UI formatter `0x0040e9d0` and the city-site connection-status formatter `0x004207d0`, so the safest current read is a shared fallback formatter thunk rather than a standalone owner. | objdump + local disassembly + caller correlation |
| 168 | 0x00455870 | 83 | runtime_object_load_two_triplet_scalar_bands_from_stream_and_publish_them | map | thiscall | inferred | objdump + local disassembly + stream-load symmetry | 2 | Shared load-side helper over the broader `0x23a` runtime-object family. The function reads six four-byte lanes from the caller-supplied stream through `0x00531150`, then publishes the first three as one triplet through `0x00530720` and the second three through `0x0052e8b0`. The accumulated return value is the summed byte count from those six `0x531150` reads. This is the strongest current load-side counterpart to `runtime_object_serialize_two_triplet_scalar_bands` `0x00455930` rather than an unrelated stream helper. | objdump + local disassembly + stream-load symmetry + triplet-publish correlation |
| 169 | 0x00455b20 | 72 | runtime_object_initialize_base_0x23a_record_fields | map | thiscall | inferred | objdump + caller xrefs + local disassembly + field-layout correlation | 2 | Shared base initializer for one `0x23a`-sized runtime object family. The helper installs base vtable `0x005cb1c0`, clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, and re-enters `0x0052ecd0` before returning `this`. Current grounded callers include the city-entry temporary constructor `0x00474110`, multiple specialization loaders around `0x0045b683/0x0045c893`, and the object-construction path at `0x0048dd65`, so the safest current read is a shared base-field initializer rather than a city-only constructor. | objdump + caller xrefs + local disassembly + field-layout correlation + object-size correlation |
| 170 | 0x00455b00 | 1 | runtime_object_noop_stub_vtable_5cfd00_slot0 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level. | objdump + vtable scan + local disassembly |
| 171 | 0x00455b10 | 1 | runtime_object_noop_stub_vtable_5cfd00_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Second literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level. | objdump + vtable scan + local disassembly |
| 172 | 0x00455b70 | 266 | runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults | map | thiscall | inferred | objdump + caller xrefs + local disassembly + field-layout correlation | 2 | Shared initializer over the same `0x23a`-sized runtime object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, optionally copies up to three caller-supplied strings into `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` through `0x0051d820`, synthesizes one default local token buffer when the middle string is absent through `0x00518de0`, chooses one effective mode string from the third or first input, derives one owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and then re-enters `0x0052edf0` plus `0x0052e670` to seed the remaining runtime scalar band. Current grounded callers span the city-entry constructor `0x004741e3`, several specialization-side rebuilds, and later object constructors at `0x0048a299`, `0x0048a31d`, and `0x00490a79`, so the safest current read is a shared scalar-band initializer from optional string triplet plus mode defaults rather than a city-only helper. | objdump + caller xrefs + local disassembly + field-layout correlation + optional-string correlation + mode-default correlation |
| 173 | 0x00455fc0 | 250 | runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands | map | thiscall | inferred | objdump + local disassembly + serializer symmetry + sibling-vtable correlation | 2 | Shared tagged-payload loader over the broader `0x23a` runtime-object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, opens the tagged bracket `0x55f1..0x55f3`, reads three temporary strings through `0x00531380`, reseeds the runtime scalar band through `runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults` `0x00455b70` with default float lanes `1.0/1.0` and flag `0`, then dispatches vtable slot `+0x48` and re-enters `0x0052ebd0`. Current grounded callers include the city-entry refresh helper `0x00474260` and the placed-structure specialization loader `0x0045c150`, so the safest current read is a shared tagged string-triplet loader plus scalar-band reseed rather than a city-only payload helper. | objdump + local disassembly + serializer symmetry + sibling-vtable correlation + scalar-band reseed correlation |
| 174 | 0x004560c0 | 53 | runtime_object_query_nested_lookup_float_via_fields_0x14_0x3a_0x21 | map | thiscall | inferred | objdump + local disassembly + field-chain correlation | 1 | Small shared float query over the broader `0x23a` runtime-object family. When lookup root `[this+0x14]` is nonnull, the helper derives one nested table offset from `[this+0x3a]` and `[this+0x21]`, follows that chain, and returns the float at the resolved record's `+0x18`; otherwise it returns `0.0`. Current evidence grounds the lookup chain but not the higher semantic meaning of those fields, so the note stays deliberately structural. | objdump + local disassembly + field-chain correlation |
| 175 | 0x00418a60 | 372 | placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan. | objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation |
| 176 | 0x00418be0 | 346 | placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper. | objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation |
| 177 | 0x00419230 | 851 | aux_candidate_collection_rebank_or_clone_records_by_availability_pass_and_refresh_owner_links | map | thiscall | inferred | objdump + local disassembly + caller correlation + collection-layout correlation | 4 | Broader post-load follow-on refresh for the auxiliary or source record pool rooted at `0x0062b2fc`, reached directly from `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. The helper first requires live scenario state `0x006cec78` and live structure-candidate pool `0x0062b268`, then runs two full passes keyed by the paired candidate availability bytes `[candidate+0xba]` and `[candidate+0xbb]`. Within each pass it scans the full auxiliary collection to find one current-bank template source record through owner-candidate dword `[entry+0x173]`, while separately trying to reuse one target slot whose prior ordinal field `[entry+0x187]` already equals the current ordinal. When no reusable slot exists it clones the current template body into the local stack image and allocates one fresh collection entry through vtable slot `+0x04`; otherwise it resolves the reusable target directly. If the chosen target differs from the current template source, the helper deep-copies the full fixed record body plus up to four optional heap payload planes at `[entry+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, with byte counts derived from footprint bytes `[entry+0xb8]` and `[entry+0xb9]` scaled by `<< 5`. It then stamps the current ordinal back into `[entry+0x187]`, formats one built-in label root from `0x005c93e8` for pass `0` or `0x005c93d8` for pass `1` into display buffer `[entry+0x22]` through `0x005a19c4`, mirrors that final text into the stem field at `[entry+0x04]`, scans the live candidate pool for an exact stem match, and stores the resolved owner-candidate id back into `[entry+0x173]`. The loop repeats for ordinals `0..11` in both passes. Current grounded caller is `0x004196c0`, so this is the safest current read for the load-side rebank-or-clone refresh that reprojects the imported `0x0062b2fc` records against live candidate availability rather than a generic collection copy helper. | objdump + local disassembly + caller correlation + collection-layout correlation + availability-pass correlation + ordinal-reuse correlation + deep-copy correlation + owner-link refresh correlation |
| 178 | 0x00419590 | 227 | aux_candidate_collection_find_entry_id_by_station_detail_action_index_and_family | map | thiscall | inferred | objdump + local disassembly + caller correlation + station-detail-action correlation | 3 | Resolves one auxiliary-candidate collection entry id from a small station-detail action key. The helper first formats one localized action stem by indexing the fixed string table at `0x005f3c6c` with the caller action index, then formats one second family-dependent string root from `0x005f3c80` with the caller family selector, concatenates those two local strings, and scans the live auxiliary collection for the first entry whose stem at `[entry+0x04]` matches that combined text through `0x005a57cf`. On success it returns the matching live entry id; otherwise it returns `0`. Current grounded caller is the lower `StationDetail.win` action band inside `shell_station_detail_window_handle_message` `0x00505e50`, where control `0xb3bd` selects family `1`, the sibling controls select family `2`, and the action index itself is derived from linked-site flag bits `[entry+0xc3]` before the resulting auxiliary id feeds the later world-side action query and confirmation-modal path. | objdump + local disassembly + caller correlation + station-detail-action correlation + localized-stem-table correlation |
| 179 | 0x00419680 | 46 | aux_candidate_collection_release_templates_queues_and_indexed_storage | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Destructor-side wrapper for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper first reinstalls vtable `0x005c9718`, re-enters `0x00416950` to walk and release every live entry plus the local-runtime scratch globals `0x0062b2f8`, `0x0062b300`, `0x0062ba58..0x0062ba74`, and the two owned helper bands at `[this+0x88]`, `[this+0x8c]`, and `[this+0x90]`, and only then tails into the shared indexed-collection teardown `0x00518bd0`. Current grounded caller is the world-release strip at `0x00434460`, where the same global root is cleared during runtime teardown, so this is the safest current read for the release-side companion to the `0x0062b2fc` collection load/save family rather than a generic collection destructor. | objdump + local disassembly + caller correlation + scratch-global correlation + teardown-order correlation |
| 180 | 0x004196c0 | 280 | aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons | map | thiscall | inferred | objdump + local disassembly + caller correlation + tagged-import correlation | 4 | Load-side constructor and import owner for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper builds two temporary tagged import contexts around the fixed stem `0x005c93fc` through the callback trio `0x005c8190/0x005c8194/0x005c819c`, then repeatedly opens the next imported payload and re-enters `0x00414490` to decode one fixed source record into the local stack image. When that decode succeeds it dispatches the collection's allocate-or-insert vtable slot `+0x04` with the decoded record body, posts shell progress through `0x004834e0`, and continues until the tagged source is exhausted. After the import loop it re-enters `0x00419230` for the broader runtime follow-on refresh. Current grounded caller is the world-entry load branch at `0x00438c70`, where the resulting object is stored into global `0x0062b2fc`, so this is the safest current read for the load-side constructor plus stream-import companion to `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70` rather than a generic constructor wrapper. | objdump + local disassembly + caller correlation + tagged-import correlation + decode-owner correlation |
| 181 | 0x0041a990 | 184 | aux_candidate_collection_allocate_helper_bands_and_tail_into_stream_load_refresh | map | thiscall | inferred | objdump + local disassembly + caller correlation + helper-band correlation | 3 | Lower helper beneath the `0x0062b2fc` constructor family. The function clears scratch global `0x0062b304`, allocates and zero-initializes three owned helper bands, stores them into `[this+0x88]`, `[this+0x90]`, and `[this+0x8c]`, seeds those bands through `0x53dbf0` and `0x53dcf0` with literal capacities `0x65`, `0x08`, and `0x74e`, and then tail-jumps directly into `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. Current grounded caller is the outer constructor `0x0041aa50`, so this is the safest current read for the helper-band allocator and import tail beneath the auxiliary or source record pool rather than a standalone collection owner. | objdump + local disassembly + caller correlation + helper-band correlation + import-tail correlation |
| 182 | 0x0041aa50 | 130 | aux_candidate_collection_construct_seed_globals_and_helper_bands_then_import_records | map | thiscall | inferred | objdump + local disassembly + caller correlation + constructor correlation | 3 | Constructor-side world-load owner for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c9718`, clears constructor-side globals `0x0062b2f0`, `0x0062b2f4`, and `0x0062b2f8`, zeroes the owned helper pointers `[this+0x88]`, `[this+0x8c]`, `[this+0x90]`, seeds `[this+0x98] = 1`, `[this+0x9c] = 0`, and the fixed float-like pair `[this+0xa0/+0xa4]`, resets shell-side dword `[0x006cec74+0x4fd]`, seeds the indexed-collection configuration through `0x00518570` with literal tuple `(1, 0x1a7, 0x0a, 5, 1, 0, 0)`, and then re-enters `aux_candidate_collection_allocate_helper_bands_and_tail_into_stream_load_refresh` `0x0041a990`. Current grounded caller is the world-entry load branch at `0x00438cc5`, which stores the finished object into global `0x0062b2fc`, so this is the current safest read for the real constructor above the `0x0062b2fc` load/import family rather than a generic collection allocator. | objdump + local disassembly + caller correlation + constructor correlation + world-load correlation |
| 183 | 0x004197e0 | 5232 | placed_structure_validate_projected_candidate_placement | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`. | objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation |
| 184 | 0x00480210 | 448 | placed_structure_construct_linked_site_record_from_anchor_and_coords | map | thiscall | inferred | objdump + caller inspection + constructor inspection | 3 | Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`. | objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation |
| 185 | 0x0048a1e0 | 336 | runtime_object_attach_infrastructure_child_with_optional_first_child_triplet_clone | map | thiscall | inferred | objdump + caller xrefs + local disassembly + rdata correlation | 2 | Shared `Infrastructure` child-attach helper over the broader `0x23a` runtime-object family. The function first checks the caller's child list at `[this+0x08]`. When that list holds more than one child, it samples the first child's two triplet scalar bands through `0x0052e880` and `0x0052e720`, destroys the caller-selected prior child through vtable slot `+0x18(0)`, allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, attaches it back to the owner through `0x005395d0`, and republishes the sampled triplets through `0x0052e8b0` and `0x00530720`. When the owner has at most one child, it still allocates and seeds the same `Infrastructure` object but attaches it through `0x0053a5d0` without the cloned-triplet republish. Current grounded callers are the repeated builder branches around `0x004a2cde..0x004a37d9`, so this is the safest current read for attaching one seeded `Infrastructure` child with an optional first-child triplet clone rather than a subtype-specific UI helper. | objdump + caller xrefs + local disassembly + rdata correlation + child-attach correlation |
| 186 | 0x0048abc0 | 11 | linked_site_set_route_entry_anchor_id_field_0x222 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Tiny direct setter over linked-site dword `[this+0x222]`. The helper stores the caller-supplied route-entry id and returns. Current grounded callers are the linked-site constructor and refresh family at `0x00480210`, `0x00480bb0`, and nearby repair branches `0x00480463`, `0x00480968`, `0x00480ac1`, and `0x00480da1`, where this field is treated as the currently chosen route-entry anchor id. The safest current read is therefore a direct linked-site route-entry-anchor setter rather than a generic scalar write. | objdump + caller xrefs + local disassembly + route-anchor correlation |
| 187 | 0x0048abd0 | 1 | linked_site_noop_stub | map | thiscall | inferred | objdump + local disassembly | 1 | Literal no-op stub adjacent to the linked-site route-entry-anchor helpers. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level. | objdump + local disassembly |
| 188 | 0x0048abe0 | 15 | linked_site_query_mode_field_0x226_equals_2 | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny predicate over linked-site dword `[this+0x226]`. The helper returns `1` only when that field equals literal `2`. Current local callers are still indirect through the linked-site vtable, so the field's player-facing meaning remains open; the safest current read is a direct `mode == 2` predicate over linked-site field `0x226`. | objdump + local disassembly + linked-site-field correlation |
| 189 | 0x0048dd50 | 359 | runtime_object_rebuild_infrastructure_children_and_refresh_primary_child_slot | map | thiscall | inferred | objdump + local disassembly + caller correlation + rdata correlation | 2 | Loop-driven `Infrastructure` child rebuild beneath the same `0x005cfd00` family. For each ordinal `0..count-1`, the helper allocates a fresh `Infrastructure` child, dispatches that child through `record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots` `0x00455a50`, and either tears the child down when the current ordinal is above `5` or attaches it back to the owner through `0x005395d0` after republishing the child's current triplet bands. When owner field `[this+0x248]` still points at the same ordinal index byte, it replaces that cached primary-child slot with the rebuilt child. After the loop it recomputes one grid anchor from current world-space fields, refreshes the current world cell through `0x00448a70`, conditionally re-enters `0x00493660` and `0x0048b660` when byte `[this+0x216]` equals `1`, and finally re-enters `0x0048b660` once more before returning. The current note stays structural because the user-facing subtype semantics remain open, but the `Infrastructure` child-rebuild ownership is strong. | objdump + local disassembly + caller correlation + rdata correlation + child-rebuild correlation |
| 190 | 0x0048e140 | 24 | runtime_object_resolve_route_entry_from_field_0x206 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Tiny direct resolver over owner dword `[this+0x206]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2cec` and the tracker regroup helper `0x004a4ff0`. | objdump + caller xrefs + local disassembly + route-entry-field correlation |
| 191 | 0x0048e160 | 24 | runtime_object_resolve_route_entry_from_field_0x20a | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Tiny direct resolver over owner dword `[this+0x20a]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2d15` and the tracker regroup helper `0x004a4ff0`. | objdump + caller xrefs + local disassembly + route-entry-field correlation |
| 192 | 0x0048e180 | 24 | runtime_object_resolve_route_entry_from_field_0x20e | map | thiscall | inferred | objdump + local disassembly + route-entry-field correlation | 2 | Tiny direct resolver over owner dword `[this+0x20e]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. It is the third direct sibling of `0x0048e140` and `0x0048e160` over the same triplet-backed route-entry field family. | objdump + local disassembly + route-entry-field correlation |
| 193 | 0x00490a3c | 123 | runtime_object_attach_optional_infrastructure_child_and_seed_three_position_lanes | map | thiscall | inferred | objdump + local disassembly + rdata correlation | 2 | Optional `Infrastructure` child-attach branch beneath the same broader runtime-object family. When the caller-supplied payload stem is nonnull, the helper allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, and attaches it back to the current owner through `0x005395d0`. It then publishes two caller-supplied position lanes through `0x00539530`, one third lane through `0x0053a5b0`, and optionally stores the new child into owner field `[this+0x248]` when the trailing pointer argument is nonnull. The safest current read is therefore an optional `Infrastructure` child attach plus three-lane seed helper rather than a broader constructor for the whole owner object. | objdump + local disassembly + rdata correlation + child-attach correlation |
| 194 | 0x00413580 | 160 | placed_structure_collection_refresh_quarter_subset_route_style_state | map | thiscall | inferred | objdump + caller inspection + collection-iteration inspection | 3 | Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper derives one four-way start bucket from scenario byte `[0x006cec78+0x11]` through the local divide-by-seven ladder, then walks every fourth live placed-structure record in the collection from that starting slot, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass. | objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation + start-bucket correlation |
| 195 | 0x00414fa0 | 118 | world_grid_count_flagged_cells_and_collect_float_samples | map | cdecl | inferred | objdump + callsite inspection | 3 | Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues. | objdump + callsite inspection + world-grid scan correlation |
| 196 | 0x00415020 | 1968 | world_grid_refresh_flagged_region_float_extrema_and_mean | map | cdecl | inferred | objdump + caller inspection | 3 | Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper. | objdump + caller inspection + version-gate correlation + world-grid scan correlation |
| 197 | 0x004153f0 | 384 | projected_rect_profile_slot_probe_template_cells_and_height_span | map | cdecl | inferred | objdump + caller xrefs + local disassembly + projected-rect correlation | 3 | Shared probe beneath the projected-rectangle profile-slot selector `0x00415570`. The helper scans one fixed `8x8` template mask from `0x005edd30 + slot*8`, aligned around the current projected-rectangle origin, rejecting immediately when any required cell is out of bounds, already occupied in the temporary dword cell-value bank at `0x0062b300`, or fails the paired world-grid acceptance gates `0x00448af0(mode 0)` and `0x004499c0`. For every surviving required cell it samples the companion float grid through `0x00448aa0`, tracks local min and max values, and finally requires the sampled height span to exceed a threshold scaled from `0x005c9680`, using `1.0` or `5.0` depending on manager state `[0x0062bae0+0x88]`. Current grounded callers are the cached and iterative search paths inside `0x00415570`, so this is the strongest current read for the template-and-height-span acceptance probe rather than a generic float-range helper. | objdump + caller xrefs + local disassembly + projected-rect correlation + float-span correlation |
| 198 | 0x004156b0 | 384 | placed_structure_build_projected_rect_profile_mask_bands_from_selected_slot | map | cdecl | inferred | objdump + caller xrefs + local disassembly + projected-rect correlation | 3 | Builds the four projected-rectangle bitmask bands rooted at `[record+0xcf/+0xd3/+0xd7/+0xdb]` from the currently selected profile slot. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, defaults the target record to global scratch owner `0x0062b308` when the caller passes null, requires a live selected slot id at `[record+0x732]`, and then uses the fixed `8x8` template family at `0x005edd30` plus the selected profile record `[record+0x736]` to rasterize four mask planes across the candidate footprint dimensions `[record+0xb8/+0xb9/+0xba]`. As each plane is built, the helper records whether that plane received any bits through flags `[record+0x177/+0x17b/+0x17f/+0x183]`, and frees any empty plane buffer before returning; current callers seed `[record+0x736]` from `0x00413eb0` or `0x00415570` immediately before entering this helper. Grounded callers are the current-subject clone path `0x00418b36` and the broader projected-runtime scratch path `0x00418c68`, so this is the strongest current read for the selected-slot mask-band builder rather than a generic local-runtime allocator. | objdump + caller xrefs + local disassembly + projected-rect correlation + bitmask-band correlation |
| 199 | 0x00415f20 | 403 | placed_structure_recursive_collect_connected_component_tile_bounds | map | thiscall | inferred | objdump + caller inspection | 3 | Recursive connected-component bounds collector over linked placed-structure records. Starting from one placed-structure node, the helper expands four caller-owned tile-bound out slots from the record-local rectangle fields `[record+0x4a0..0x4ac]`, tags the record with the current component pass id at `[record+0x73e]`, then walks the component membership map rooted at `0x0062ba7c` to find adjacent records whose packed tile key falls inside the current rectangle and whose prior pass id differs. Matching adjacent records recurse through the same helper until the reachable component rectangle is exhausted. On return the helper also seeds one default local rectangle owner through `0x004159e0` when `[record+0x732] == -1`, then refreshes the neighboring runtime side through `0x0040ee10`. Current grounded callers are the wrapper at `0x004160c0` and internal recursive self-calls. | objdump + caller inspection + recursive-component correlation + placed-structure-bound correlation |
| 200 | 0x004160c0 | 168 | placed_structure_collect_connected_component_tile_bounds_with_version_gate | map | cdecl | inferred | objdump + caller inspection | 3 | Wrapper above `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`. The helper initializes four tile-bound accumulators to sentinel values, increments one world-grid reentry depth counter at `0x0062c120+0x2205`, and then chooses between two paths. On builds `1.03` and earlier, or when scenario field `[0x006cec78+0x46c38]` is still clear, it re-enters the recursive component walk through `0x00415f20`; otherwise it skips that older walk entirely. In both cases it decrements the reentry counter and then expands the surviving rectangle by `2` tiles on each side before publishing it through `0x0044d410`. Current grounded caller is the route-entry-backed component wrapper at `0x004161a0`, so this now looks like the version-gated connected-component bounds collector rather than another generic tracker helper. | objdump + caller inspection + version-gate correlation + connected-component correlation |
| 201 | 0x00416170 | 345 | placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tile-range wrapper above `placed_structure_collect_connected_component_tile_bounds_with_version_gate` `0x004160c0`. The helper seeds the current connected-component pass keys at `0x0062ba7c` and `0x0062ba80`, iterates the caller-supplied tile rectangle, allocates or reuses one small per-tile record from the caller-owned queue, and looks up the packed `(row << 16) | col` key through the component map rooted at `0x0062ba7c` via `0x0053dae0`. When one mapped component record exists and the current placed-structure owner at stack arg `+0x0c` still has `[site+0x732] == -1`, the world-side latch at `[0x0062b2fc+0x9c]` is clear, scenario field `[0x006cec74+0x4fd]` is clear, and the caller-supplied suppress-refresh flag at stack arg `+0x10` is zero, it follows the mapped component chain and re-enters `0x004160c0` for each linked record; otherwise it clears one world-grid byte through `0x00448a70`. The resolved or refreshed record is then stored back through `0x0053d9e0` and `0x0053d960`. Current grounded callers are the neighboring local-runtime passes at `0x00418a60` and `0x00418be0`, so this is now the strongest current owner for mapping one tile rectangle into connected-component records with optional bounds refresh rather than another bare recursive walk. | objdump + caller inspection + local disassembly + connected-component-map correlation |
| 202 | 0x00416830 | 164 | aux_candidate_record_chain_callback_collect_unique_link_keys_into_save_queue | map | cdecl | inferred | objdump + local disassembly + caller correlation + queue-correlation | 3 | Save-side callback beneath `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`. The helper walks the caller record's linked chain rooted at `[entry+0x04]`, follows each node's forward link at `[node+0x04]` to the terminal node, and then chooses one dedupe key from either the raw terminal id or the transformed key `0x7fffffff - id` depending on the callback mode dword at `[arg+0x00]`. It probes the temporary scored-node set rooted at `0x0062ba58` through `0x53d440`, pushes only unique keys through `0x53d320`, and increments the queued-count latch at `0x0062ba64`. Current grounded caller is the save-side collection walk inside `0x00416a70`, so this is the safest current read for the unique link-key gather callback that seeds the temporary save queue rather than a generic chain iterator. | objdump + local disassembly + caller correlation + queue-correlation + dedupe-key correlation |
| 203 | 0x004168e0 | 106 | aux_candidate_collection_release_entry_optional_mask_planes_and_erase | map | thiscall | inferred | objdump + local disassembly + caller correlation + field-layout correlation | 3 | Per-entry release helper beneath the `0x0062b2fc` auxiliary or source record pool. The helper resolves one live entry by id through the collection vtable, frees any optional plane allocations still owned by that record at `[entry+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, and then erases the entry through the shared indexed-collection removal path `0x00518a30`. Current grounded caller is the broader collection teardown body `0x00416950`, so this is the safest current read for the per-entry optional-mask-plane release plus erase helper rather than a generic indexed-collection callback. | objdump + local disassembly + caller correlation + field-layout correlation + erase-path correlation |
| 204 | 0x00416950 | 283 | aux_candidate_collection_release_live_entries_scratch_roots_and_helper_bands | map | thiscall | inferred | objdump + local disassembly + caller correlation + teardown-order correlation | 4 | Broader release body beneath `aux_candidate_collection_release_templates_queues_and_indexed_storage` `0x00419680`. The helper walks every live entry in the `0x0062b2fc` collection, re-enters `0x004168e0` to free the per-entry optional planes and erase the slot, clears the shared scratch root `0x0062b300`, releases the temporary scored-node family rooted at `0x0062ba58..0x0062ba74`, and then tears down the three owned helper bands at `[this+0x88]`, `[this+0x8c]`, and `[this+0x90]` through the `0x53dbe0/0x53dcb0` release pair before freeing their backing roots. Current grounded caller is the destructor-side wrapper `0x00419680`, so this is the safest current read for the real live-entry plus scratch-band teardown body rather than a generic collection cleanup. | objdump + local disassembly + caller correlation + teardown-order correlation + helper-band correlation |
| 205 | 0x00416a70 | 621 | aux_candidate_collection_serialize_records_into_bundle_payload | map | thiscall | inferred | objdump + caller inspection + local disassembly + bundle-save correlation | 4 | Save-side collection owner for the auxiliary or source record pool rooted at `0x0062b2fc`, reached directly from the early package-save prelude `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`. The helper first allocates one temporary scored-node queue at `0x0062ba58`, clears the queued-count latch `0x0062ba64`, and walks collection field `[this+0x88]` through `0x53db20` with callback `0x00416830`, which scans each record's linked chain at `[entry+0x04]`, deduplicates the chain nodes through `0x53d440`, and pushes unique nodes into the queue through `0x53d320` while counting them in `0x0062ba64`. It then writes one leading `0x0c`-byte header whose first dword is the fixed tag `0xbabe`, derives one normalized world-space float pair through `0x00415370`, and drains the queued nodes through `0x53d390`. For each popped live record it serializes the fixed dword band at `[record+0x74a]`, `[+0x04]`, `[+0x08]`, `[+0x0c]`, `[+0x4b8]`, and `[+0x4bc]`, the counted inline dword run rooted at `[record+0x10]` with count `[record+0x49c]`, the fixed `0x10`-byte payload at `[record+0x4a0]`, the optional counted byte payload `[record+0x4c0]` with count `[record+0x4c4]`, the counted dword run rooted at `[record+0x4c8]` with count `[record+0x65c]`, the paired one-byte streams rooted at `[record+0x664]` and `[record+0x6c9]` with count `[record+0x72e]`, and the trailing dword at `[record+0x732]`. When the queue drains it releases the temporary scored-node queue and clears the scratch globals `0x0062ba58..0x0062ba74` plus cache slot `0x005ee030`. Current grounded caller is the fixed save-order branch at `0x0044528c`, immediately before chunk `0x3315`, so this is the safest current read for the direct package-save serializer over the `0x0062b2fc` record family rather than another tagged collection wrapper. | objdump + caller inspection + local disassembly + bundle-save correlation + scored-queue correlation + scratch-global correlation |
| 206 | 0x00416e20 | 156 | indexed_collection_resolve_live_entry_id_by_stem_string | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small live-entry resolver over an indexed collection. The helper walks the live slot count through `indexed_collection_slot_count` `0x00517cf0`, fetches each live id through `indexed_collection_get_nth_live_entry_id` `0x00518380`, resolves the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and compares the caller-supplied string against the record stem at `[record+0x04]` through `0x005a57cf`. On success it returns the matching live id. On failure it emits localized id `189` through the shell string helpers and returns `-1`. Current grounded callers are the neighboring placed-structure local-runtime builders at `0x00418be0` and `0x0040e450`, plus one shell-side branch at `0x00507e80`, so this is now the strongest current match for a stem-to-live-id resolver rather than an unowned search loop. | objdump + caller inspection + local disassembly + stem-compare correlation |
| 207 | 0x00416ec0 | 1867 | placed_structure_build_projected_runtime_scratch_from_candidate_and_coords | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavy projected-runtime scratch builder beneath the neighboring local placed-structure runtime family. The helper resolves one candidate record from the caller-supplied id, derives rotated footprint extents and centered world-space bounds from the caller-supplied coordinate and heading inputs, allocates and clears several temporary per-footprint mask bands on the stack, then walks up to four candidate-side shape or access sublanes rooted at `[candidate+0xcf]`, `[candidate+0xd3]`, `[candidate+0xd7]`, and `[candidate+0xdb]`. Within that deeper loop it projects rotated footprint cells through the basis pair at `0x006d4024`, rejects out-of-bounds or duplicate cells, checks multiple world-grid acceptance gates through `0x00448af0`, `0x00534e10`, `0x004499c0`, and `0x00413df0`, and marks the surviving cells into both temporary stack masks and the live world-grid byte lane at `[0x0062c120+0x2131]`. The tail publishes the finished scratch payload through `0x00416620`. Current grounded caller is `0x00418be0`, which then copies that scratch block into one queued local runtime record, so this is now the safest current name for the projected-runtime scratch builder rather than a generic placement validator. | objdump + caller inspection + local disassembly + projected-footprint correlation |
| 208 | 0x00418040 | 1168 | placed_structure_render_local_runtime_overlay_payload_from_projected_bounds | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavy local-runtime overlay-payload builder beneath the broader local-runtime record family. The helper derives one projected bounds rectangle through `0x004142e0` and `0x00417f20`, rejects very small payloads, allocates one temporary dword buffer, folds that buffer through `0x00415370`, and then walks the projected rectangle producing one packed dword payload per cell. Current bounded gates include a duplicate-entry or occupancy fast path keyed by `[var_10h]`, world-grid rejection through `0x004499c0`, and several distance- and ratio-shaped thresholds built from the projected rectangle geometry. On accepted cells it writes one four-byte packed value into the caller output stream. Current grounded caller is `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` `0x00418be0`, where the result is stored into `[0x0062b7c8]`, so this is now the safest current read for the local-runtime overlay payload renderer rather than a generic geometric sweep. | objdump + caller inspection + local disassembly + overlay-payload correlation |
| 209 | 0x00414470 | 10 | placed_structure_cache_projected_rect_profile_slot_id | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tiny setter for the projected-rectangle profile-slot cache at `0x005ee030`. The helper just stores the caller-supplied dword into that global cache. Current grounded caller is `0x0040e450`, where the cached value is set immediately before the current-subject local-runtime clone path at `0x00418a60`. | objdump + caller inspection + local disassembly + global-cache correlation |
| 210 | 0x00414490 | 1063 | aux_candidate_record_stream_decode_fixed_fields_and_optional_mask_planes | map | cdecl | inferred | objdump + local disassembly + caller correlation + field-layout correlation | 4 | Low decode body beneath the `0x0062b2fc` auxiliary or source record import family. The helper reads the fixed record header and six `0x1e`-byte string bands into the caller record image at `[record+0x04]`, `[+0x22]`, `[+0x40]`, `[+0x5e]`, `[+0x7c]`, and `[+0x9a]`, imports the small scalar tail at `[+0xb8/+0xb9/+0xba/+0xbb/+0xbf/+0xc3/+0xc7/+0xcb/+0xcd]`, applies the two exact-stem fixups that rewrite `[record+0xcd]` to `0x81` or `0x9d`, and then derives one footprint-sized plane length from `[record+0xb8] * [record+0xb9] << 5`. It allocates and zeroes up to four optional heap planes at `[record+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, decodes the packed nibble or bitplane payload into those four buffers, stamps the corresponding presence latches at `[record+0x177]`, `[+0x17b]`, `[+0x17f]`, and `[+0x183]`, frees any plane whose decode path stayed empty, seeds `[record+0x1a3] = 1.0f`, and returns a success flag. Current grounded caller is `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`, so this is the current safest read for the fixed record decode plus optional mask-plane materializer rather than a generic stream helper. | objdump + local disassembly + caller correlation + field-layout correlation + optional-plane correlation |
| 211 | 0x00416620 | 521 | placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Publishes one projected-runtime rectangle and its companion globals beneath the local-runtime scratch builder. The helper copies the current scratch owner id from `0x0062b304` into `0x0062b308`, stores the caller-supplied pair into `0x0062b30c/0x0062b310`, grows the active rectangle bounds at `0x0062b7ac` and `0x0062b7b4` when needed, clears one current index slot in `0x0062b318`, and then validates the rectangle against the route-entry store `0x006cfca8` through `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`. On failure it raises localized id `185`; on one special-candidate branch keyed by `[record+0x123]` it re-enters `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, either expands the rectangle by three cells on each side and refreshes the per-cell side tables through `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` or fails with localized id `186`; and on the ordinary branch it can scan the temporary cell-value bank at `0x0062b300` across the rectangle and fail with localized id `187` before again tailing into `0x00414e10`. Current grounded callers are `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0` and the placement validator `0x004197e0`, so this now looks like the projected-runtime rectangle publisher plus side-window validator rather than an anonymous scratch tail. | objdump + caller inspection + local disassembly + projected-rectangle-global correlation |
| 212 | 0x00415570 | 317 | placed_structure_try_select_projected_rect_profile_slot | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Small projected-rectangle profile selector beneath `0x00416620`. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, resets the shared slot id at `0x0062ba3a`, derives one companion value through `0x00413eb0` into `0x0062ba3e`, and then probes the current rectangle at `0x0062b7a8..0x0062b7b4` through repeated `0x004153f0` checks. One fast path reuses the cached selector at `0x005ee030`; one fallback seeds the same search from localized id `11` through `0x00518be0`; and one final iterative path scans slots `0..11` until the probe accepts. On success the helper writes the chosen slot id into `0x0062ba3a`, and the cache fast path also clears `0x005ee030` back to `-1` after consuming it. Current grounded caller is the special-candidate branch inside `0x00416620`, where the returned success decides whether the rectangle can be expanded and the companion byte tables refreshed. This is therefore best-read as a projected-rectangle profile-slot selector rather than a broad route or placement policy helper. | objdump + caller inspection + local disassembly + rectangle-probe correlation |
| 213 | 0x00414e10 | 200 | world_grid_refresh_projected_rect_surface_and_region_byte_tables | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan. | objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation |
| 214 | 0x00494240 | 195 | route_entry_collection_query_rect_window_passes_entry_type_gate | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan. | objdump + caller inspection + local disassembly + route-entry-window correlation |
| 215 | 0x00411cb0 | 30 | structure_candidate_release_runtime_descriptor_and_cargo_membership_tables | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Tiny release-side helper beneath the port-or-warehouse candidate runtime family. The helper clears the two cargo-membership pointer tables at `[this+0x79c]` and `[this+0x7a0]` and then clears the descriptor-array pointer at `[this+0x37]`, all through the shared release helper `0x0053afd0`. Current grounded callers sit in the same candidate rebuild and teardown strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the safest current read for the narrow descriptor-and-membership release sibling rather than a generic pointer scrub. | objdump + local disassembly + caller correlation + release-helper correlation |
| 216 | 0x00411ce0 | 99 | structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Post-import mode-flag classifier immediately beneath `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`. The helper clears candidate dwords `[this+0x78c]` and `[this+0x790]`, then only runs its descriptor scan when byte `[this+0x32]` equals `2`. In that mode it starts with `[this+0x78c] = 1`, walks every live `0xbc` runtime descriptor in `[this+0x37]`, sets `[this+0x790] = 1` when it finds any mode-`0` descriptor, and clears `[this+0x78c]` when it finds any mode-`0` descriptor whose subordinate-row count at `[desc+0x2c]` is zero. If the scan finishes without ever seeing a mode-`0` descriptor, it forces `[this+0x78c]` back to `1`. So the strongest current static read is a two-flag summary over the freshly imported recipe runtime strip: `[this+0x790]` records whether any mode-`0` runtime descriptor exists, while `[this+0x78c]` stays armed only for subtype-`2` cases where every mode-`0` descriptor carries at least one subordinate row, or where no mode-`0` descriptors exist at all. Current grounded caller is `0x00412d70`. | objdump + local disassembly + caller correlation + descriptor-scan correlation |
| 217 | 0x00411d50 | 58 | structure_candidate_query_all_runtime_descriptors_are_mode0_and_any_direct_descriptor_exists | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Predicate over the candidate's current `0xbc` runtime descriptor strip. It walks all descriptors in `[this+0x37]` and returns true only when every descriptor keeps mode dword `[desc+0x00] == 0` and at least one descriptor also has subordinate-row count `[desc+0x2c] == 0`; any nonzero mode descriptor forces immediate failure. Current grounded callers are editor-side summary passes `0x004cbb3b` and `0x004d26d4`, where it acts as a narrower descriptor-pattern gate than the broader post-import flags `[this+0x78c/+0x790]`. | objdump + local disassembly + caller inspection + descriptor-pattern correlation |
| 218 | 0x00411d90 | 1 | structure_candidate_post_collection_construct_noop_placeholder | map | thiscall | inferred | objdump + caller correlation | 1 | Bare `ret` placeholder in the candidate bringup strip. Current grounded caller is the world-entry load branch at `0x00438ca0`, immediately after the live candidate pool `0x0062b268` is constructed and before the auxiliary candidate collection at `0x0062b2fc` is allocated. Current local evidence does not show any side effects beyond preserving that callsite boundary. | objdump + caller correlation + world-entry load-strip correlation |
| 219 | 0x00411da0 | 111 | structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_pair | map | thiscall | inferred | objdump + local disassembly + caller inspection + fixed-table inspection | 2 | Reads one fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When that slot is not `-1` and the row's leading name pointer at `+0x04` is nonnull, the helper copies the pointed zero-terminated string to the caller buffer and writes the two adjacent scalar dwords from row offsets `+0x0c` and `+0x10` to the caller outparams before returning `1`; otherwise it returns `0`. Current grounded caller is the placed-structure specialization service around `0x0045b245`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-pair accessor rather than a more specific asset-label decode. | objdump + local disassembly + caller inspection + fixed-table inspection |
| 220 | 0x00411e10 | 50 | structure_candidate_try_query_positive_fixed_profile_slot_0x798_scalar_and_trailing_value | map | thiscall | inferred | objdump + local disassembly + caller inspection + fixed-table inspection | 2 | Queries the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and the row dword at offset `+0x14` is positive, the helper writes row dword `+0x20` to the caller outparam and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, where it acts as a prerequisite gate before the heavier fixed-row payload copy sibling `0x00411e50`. | objdump + local disassembly + caller inspection + fixed-table inspection |
| 221 | 0x00411e50 | 133 | structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_triplet | map | thiscall | inferred | objdump + local disassembly + caller inspection + fixed-table inspection | 2 | Reads the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and row dword `+0x14` is positive, the helper copies the pointed zero-terminated string at row offset `+0x04` to the caller buffer, writes row dwords `+0x18`, `+0x1c`, and `+0x14` to the caller outparams, and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-triplet accessor rather than a narrower effect-family decoder. | objdump + local disassembly + caller inspection + fixed-table inspection |
| 222 | 0x00411ee0 | 451 | structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables | map | thiscall | inferred | objdump + callsite inspection + local disassembly | 3 | Rebuilds the per-candidate cargo-membership tables and scaled per-cargo rate band after one runtime descriptor array has been materialized. The helper clears the two compact cargo-id tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and the thirteen-dword per-cargo accumulator band rooted at `[this+0x0a1]`, then fills one local `0x35`-byte scratch status array from the live `0xbc` descriptor strip in `[this+0x37]`. The year-status rule is tighter now too: with current scenario year `[0x006cec78+0x0d]`, or fallback year `0x709` when no live world is present, each subordinate cargo row is marked `2` only while `start_year <= current_year < end_year`; rows outside that active window still contribute status `1` as referenced cargo. The helper keeps the maximum status seen per remapped cargo id through `0x0062ba8c+0x9a`. The scaled-rate side is tighter in the same way: for descriptor mode `0` it multiplies each subordinate row amount by the shared production-cap float `[this+0x2a]` and divides by the descriptor amount `[desc+0x04]`, while nonzero-mode descriptors bypass that normalization and publish their row amount directly. After the scan it counts every cargo with scratch status `>= 1` into `[this+0x7a4]`, every cargo with status `>= 2` into `[this+0x7a8]`, allocates the two final `u16` id tables as `(count*2)+1`-byte buffers, zeroes them, and compacts the `status>=1` and `status>=2` sets into `[this+0x79c]` and `[this+0x7a0]` respectively. That keeps the stronger current split narrow and concrete: the first table is the referenced-cargo set, the second is the currently active-cargo set, and the per-cargo float band at `[this+0x0a1..+0x0b8]` is the same cap-scaled runtime rate band later queried by `0x004129d0`. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`. | objdump + callsite inspection + local disassembly + scenario-state correlation + cargo-collection correlation + membership-table compaction correlation + year-window correlation |
| 223 | 0x004120b0 | 1119 | structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state | map | thiscall | inferred | objdump + local disassembly + caller correlation | 4 | Stream-load owner for one live structure candidate record beneath the broader collection load path at `0x00412fb0`. The helper seeds runtime id `[this+0xe4]` from its first caller argument, clears the cargo-membership pointers and mode-summary band at `[this+0x79c..+0x7b0]`, sets the cached summary year `[this+0x788] = -1`, opens one named bundle slot through `0x00530c80`, and then reads the packed candidate body through repeated `0x00531150` calls. The fixed header import is tighter now too: it reads one outer dword header, then the candidate stem or display band at `[this+0x04]` length `0x1e`, the scalar fields at `[this+0x22]`, `[this+0x2a]`, and `[this+0x2e]`, the year words `[this+0x26/+0x28]`, byte `[this+0x32]`, and runtime descriptor count `[this+0x33]`. The descriptor strip itself is allocated as `count*0xbc + 1` bytes into `[this+0x37]`, then every `0xbc` slot is zeroed before the raw read. Descriptor import is tighter in the same way: mode-`0` descriptors immediately resolve their primary token string at `+0x08` back into cargo id `[desc+0x1c]`, subordinate-row descriptors resolve each row token at `+0x30 + row*0x1c` back into `[desc+0x44 + row*0x1c]`, and both paths clamp the descriptor start-year word `[desc+0x20]` upward to the resolved cargo availability floor at `[cargo+0x21]`. The later import band is explicit too: bundles at `>= 0x3ed` load `[this+0x3b..+0xbb]`, including the scalar strip `[this+0x3b/+0x3f/+0x43/+0x47/+0x4b]`, label band `[this+0x4f]`, summary quartet `[this+0x8c..+0xa0]`, per-cargo float lanes `[this+0xa1..+0xb8]`, and selector bytes `[this+0xb9..+0xbb]`; bundles at `>= 0x3f2` then load the wider `0x24`-byte trailer at `[this+0xc0]`, while older bundles keep that trailer in its narrow `0x02`-byte form. When `[this+0x4b]` is nonzero the helper also forces `[this+0x47] = 1.0`, rescales `[this+0x43]` from `[this+0x22]` through `0x005a10d0`, and clamps the final value to at least `0x1388`. After closing the slot through `0x00530a00` it re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, resets stem index `[this+0x798]` to `-1`, normalizes the candidate stem through the two built-in aliases at `0x005c8f94` and `0x005c8e4c`, and then scans the fixed row table `0x005ed338..0x005edca4` until it finds the matching stem index. Current grounded caller is the collection-wide stream-load path at `0x00412fb0`. | objdump + local disassembly + caller correlation + bundle-slot correlation + descriptor-year-floor correlation + stem-table correlation + version-gate correlation + field-width correlation |
| 224 | 0x00412510 | 72 | structure_candidate_is_enabled_for_current_runtime_year_gate | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small enable-or-year gate beneath the live candidate cargo-summary family. The helper first requires latch `[this+0x7ac]` to be nonzero. When shell state `[0x006cec74+0x17c]` is already armed it returns true immediately; otherwise it consults the scenario-side runtime gate at `[0x006cec78+0x46c38]` and compares the current effective year from `[0x006cec78+0x05]` or `[0x006cec78+0x0d]` against candidate word `[this+0x26]`, returning true only when the scenario year has reached that threshold. Current grounded callers are the collection-side wrapper at `0x00413de0` and the linked-count cargo-summary accumulator at `0x0041e795`, so this is the safest current read for the candidate-side availability gate above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` rather than a general profile or editor predicate. | objdump + local disassembly + caller correlation + year-gate correlation |
| 225 | 0x00412560 | 144 | structure_candidate_runtime_descriptor_is_active_for_current_year_and_selected_mode_bank | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by requiring the primary cargo id at `[desc+0x1c]` to map through the live cargo-availability latch at `0x0062ba8c[cargo].+0x16e`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the inclusive descriptor year window `[desc+0x20]..[desc+0x22]`. The selected-bank split is tighter now too: when caller bank `0` is active the helper rejects descriptors whose dword gate `[desc+0x24]` is nonzero, while caller bank `1` rejects descriptors whose dword gate `[desc+0x28]` is nonzero. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to keep that same live cargo-availability latch `[cargo+0x16e]` nonzero. Current grounded callers are `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`. | objdump + caller xrefs + callsite inspection + cargo-availability-latch correlation + selected-bank-gate correlation + special-condition correlation |
| 226 | 0x004125f0 | 87 | structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Counts the currently active mode-`0` runtime descriptors that still own at least one subordinate row for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, keeps only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active mode-`0` descriptors that contribute cap-shared subordinate-row output. | objdump + caller xrefs + callsite inspection + cap-share-bank correlation |
| 227 | 0x00412650 | 543 | structure_candidate_query_cargo_runtime_summary_channels | map | thiscall | inferred | objdump + caller xrefs + local disassembly + callsite inspection | 3 | Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it stamps the current scenario year into `[this+0x788]`, clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, and then walks every live `0xbc` descriptor across both mode banks `0` and `1` through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. The bank split is tighter now too because it is driven first by descriptor mode and then by whether subordinate rows exist. Mode-`0` descriptors with no subordinate rows accumulate their primary cargo scalar `[desc+0x04]` into the direct primary-cargo bank rooted at `[this+0x03a]`, keyed by resolved cargo id `[desc+0x1c]`. Mode-`0` descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, then publish that cap share into the primary-cargo bank rooted at `[this+0x0a4]`, again keyed by `[desc+0x1c]`, and finally scale each subordinate row amount `[desc+0x48+row*0x1c]` into the zero-mode subrow bank rooted at `[this+0x178]`, keyed by `[desc+0x44+row*0x1c]`. Nonzero-mode descriptors bypass the primary-cargo banks entirely and accumulate their subordinate-row amounts directly into the nonzero-mode subrow bank rooted at `[this+0x10e]`, keyed by `[desc+0x44+row*0x1c]`. The return epilogue reads one caller-selected cargo lane back out of those exact roots as four distinct out channels: direct primary-cargo scalar from `[this+0x03a]`, cap-share primary-cargo scalar from `[this+0x0a4]`, nonzero-mode subrow scalar from `[this+0x10e]`, and zero-mode cap-scaled subrow scalar from `[this+0x178]`. There is still no post-resolution failure guard between the importer writes and this consumer, so unresolved imported marker rows would still fall into the first summary-bank bucket here. Current caller-side evidence keeps that boundary narrow too: steady-state helpers do not probe cargo id `0` like an ordinary cargo lane, and the explicit `cargo id 0` placed-structure branch bypasses the normal cargo-reference helper for linked-site classification instead. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`. | objdump + caller xrefs + local disassembly + callsite inspection + scenario-state correlation + year-stamp correlation + cargo-id-0 caller-boundary correlation |
| 228 | 0x00412960 | 49 | structure_candidate_query_direct_and_normalized_supply_channels | map | thiscall | inferred | objdump + callsite inspection | 3 | Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the sum of the wrapper's two supply-side out lanes rather than exposing all four summary channels directly. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the direct-supply-side cargo presence test. The wrapper does not add any post-query special case for unresolved cargo bucket `0`; it just sums the returned supply-side floats. | objdump + callsite inspection + wrapper-correlation |
| 229 | 0x004129a0 | 45 | structure_candidate_query_scaled_production_output_channel | map | thiscall | inferred | objdump + callsite inspection | 3 | Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the single scaled production-output subrow channel without combining it with the neighboring supply lanes. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the scaled-supply or production-side cargo presence test. Like the sibling wrapper at `0x00412960`, it does not special-case unresolved cargo bucket `0` after the underlying query returns. | objdump + callsite inspection + wrapper-correlation |
| 230 | 0x004129d0 | 179 | structure_candidate_supports_or_references_cargo_id | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned nonzero-mode subrow channel plus zero-mode cap-scaled subrow channel are positive. One final fallback follows the global cargo remap at `0x0062ba8c+0x9a`: if the requested cargo has a valid remap target, the helper checks the two cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` for that remapped index before deciding. The current caller picture is tighter too: the placed-structure sweep around `0x00452e60` only enters this helper when the requested cargo id is nonzero. When that sweep receives requested id `0`, it explicitly routes around the cargo-reference branch into a separate linked-site or station-or-transit gate over the current placed structure's subtype latch, linked site id `[site+0x2a8]`, and the narrower linked-site predicate at `0x0047fd50`. So this helper itself does not currently look like the intentional owner for a null-cargo query. | objdump + caller xrefs + callsite inspection + cargo-summary correlation + caller-branch correlation + linked-site-bypass correlation |
| 231 | 0x00412a90 | 22 | structure_candidate_collection_destructor_reset_vtable_and_release_indexed_storage | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small destructor-side wrapper for the live structure-candidate pool rooted at `0x0062b268`. The helper first resets the collection vtable to `0x005c93cc`, then releases the indexed live-entry storage through `indexed_collection_release_slot_storage` `0x00518600` and tails into the common indexed-collection cleanup `0x00518bd0`. Current grounded caller is the global teardown branch at `0x00434480`, where the current candidate pool is destroyed immediately before the backing object is freed through `0x0053b080`. | objdump + local disassembly + caller correlation + global-pool-teardown correlation |
| 232 | 0x004128e0 | 119 | structure_candidate_refresh_stem_overridable_policy_dword_0xbc | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small stem-table policy refresh beneath the candidate collection support family. The helper seeds `[this+0xbc]` with default `0x1869f`, overrides that default to `3` when post-import flag `[this+0x78c]` is armed, or to `4` when subtype byte `[this+0x32] == 2`, and then walks the fixed eight-byte `(stem_ptr, value)` table at `0x005edca8..0x005edd20`. Each row compares the candidate display stem at `[this+0x04]` against the table stem through `0x005a5f26`, and on the first exact match it overwrites `[this+0xbc]` with the paired table dword before returning. Current grounded caller is the collection-wide sweep `0x00412ab0`, so this is the safest current read for a stem-overridable policy dword refresh rather than a broader candidate rebuild owner. | objdump + local disassembly + caller correlation + stem-table correlation + post-import-flag correlation |
| 233 | 0x004128d4 | 12 | aux_candidate_collection_find_entry_id_by_runtime_owner_id_e4 | map | cdecl | inferred | objdump + local disassembly + caller correlation | 2 | Tiny resolver over the auxiliary collection at `0x0062b2fc`. The helper scans that collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares each live entry's owner or runtime id dword at `[entry+0x173]` against the caller candidate's runtime id `[candidate+0xe4]`, and returns the matching collection id or `0` when none match. Current grounded caller is the wrapper at `0x00413dd0`, so this is the safest current read for the auxiliary-record lookup by candidate runtime owner id rather than a broader collection service owner. | objdump + local disassembly + caller correlation + collection-scan correlation |
| 234 | 0x00413d80 | 68 | aux_candidate_entry_query_owner_subtype1_grid_basis_pair_words_0xcb_0xcd | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small auxiliary-entry helper beneath the projected-footprint placement family. It resolves the owning structure candidate from the auxiliary entry's runtime-owner id dword `[entry+0x173]` through the live candidate pool `0x0062b268`, requires the resolved candidate subtype byte `[candidate+0x32]` to equal `1`, and on success copies candidate words `[candidate+0xcb]` and `[candidate+0xcd]` into the caller output pointers before returning `1`; all other cases return `0`. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, where those two words act as the local grid basis pair beneath rotated footprint projection. | objdump + local disassembly + caller correlation + auxiliary-owner correlation + projected-footprint correlation |
| 235 | 0x00413dd0 | 18 | aux_candidate_entry_owner_candidate_is_enabled_for_current_runtime_year_gate | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Tiny availability wrapper over one auxiliary candidate entry. The helper resolves the owning structure candidate from auxiliary dword `[entry+0x173]` through the live candidate pool `0x0062b268`, then tail-jumps into `structure_candidate_is_enabled_for_current_runtime_year_gate` `0x00412510`. Current grounded caller is the neighboring summary family around `0x00413de0`, so this is the narrow auxiliary-entry year-visibility gate rather than a broader collection query. | objdump + local disassembly + caller correlation + auxiliary-owner correlation + year-gate correlation |
| 236 | 0x00413df0 | 183 | projected_rect_packed_cell_list_try_append_unique_xy_with_optional_highbit_flag_and_expand_quarter_bounds | map | fastcall | inferred | objdump + caller xrefs + local disassembly + global-field correlation | 3 | Shared packed-cell cache helper beneath the projected-runtime scratch and placement-validator families. The helper treats `ECX` and `EDX` as one world-cell pair, combines them with the caller-supplied boolean or small mode in `EAX` into one packed dword, and then scans the temporary list rooted at `0x0062b318` for an existing entry whose low `31` bits already match the same cell pair. When no duplicate exists it appends the new packed dword, terminates the list with `-1`, and expands the coarse quarter-resolution bounds at `0x0062b7a8..0x0062b7b4` from the same cell pair shifted right by `2`. The top bit is deliberately ignored by the duplicate test, so the third argument is best read as an optional per-cell high-bit mark rather than part of the spatial key. Current grounded callers are the projected-footprint scan inside `0x004174dd..0x00417529`, the projected-runtime scratch builder `0x00416ec0`, and the later placement-validator subtype branch around `0x00419ee4`. | objdump + caller xrefs + local disassembly + projected-runtime correlation + global-field correlation |
| 237 | 0x00413bc0 | 435 | station_place_format_preview_description_block_from_profile_text_and_rule_tables | map | thiscall | inferred | objdump + local disassembly + caller correlation + string-table correlation | 3 | Formats the multiline description block consumed by the StationPlace preview panel. The helper starts by publishing the current placement record's text at `[record+0x40]` through `0x00518de0`, then uses repeated casefolded compares against record text `[record+0x7c]` and several fixed string tables rooted at `0x005f3c80`, `0x005c94c4`, `0x005c94a0`, and `0x005c947c` to decide which explanatory lines still need to be appended through the same text-publish path. One early branch also selects between format roots `0x005c94d4` and `0x005c94ec` based on dword `[record+0x141]`. Current grounded caller is `station_place_format_preview_panel` `0x00508730`, where this helper owns the paired description block for preview control `0x6984`. The safest current read is therefore a preview-description formatter over one placement profile and several fixed rule tables, rather than a generic message-box or region helper. | objdump + local disassembly + caller correlation + string-table correlation + StationPlace preview correlation |
| 238 | 0x00413eb0 | 95 | placed_structure_lookup_projected_rect_profile_record_by_label_at_field_0x123 | map | cdecl | inferred | objdump + local disassembly + caller correlation + table-layout correlation | 3 | Lookup helper beneath the projected-rectangle profile-slot family. It walks the fixed `0x5ef3f0` table in `0xb0`-byte steps, compares each entry's active label pointer against the caller record text rooted at `[arg+0x123]` through `0x005a57cf`, and on the first match returns the enclosing table record base. When no match exists it returns null. Current grounded caller is `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, which uses the returned record to derive companion value `0x0062ba3e` before probing the projected rectangle. This is therefore the safest current read for the fixed projected-rectangle profile-record lookup rather than a broader string-table scan. | objdump + local disassembly + caller correlation + table-layout correlation + projected-rectangle correlation |
| 239 | 0x00412ab0 | 56 | structure_candidate_collection_refresh_stem_overridable_policy_dword_0xbc | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide sweep over the live candidate manager that simply re-enters `structure_candidate_refresh_stem_overridable_policy_dword_0xbc` `0x004128e0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes the per-candidate dword `[candidate+0xbc]` from the current stem table and the current post-import flag state at `[candidate+0x78c]` plus subtype byte `[candidate+0x32]`. Current grounded callers sit in the same load and collection-service strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side owner above that stem policy refresh. | objdump + local disassembly + caller correlation + collection-sweep correlation + post-import-policy correlation |
| 240 | 0x00412d70 | 563 | structure_candidate_collection_rebuild_runtime_records_from_scenario_state | map | thiscall | inferred | objdump + local disassembly + caller xrefs + callsite inspection | 4 | Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062b268`. The helper runs two banked passes keyed by the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]`, and within each bank it steps through the twelve scenario-side recipe books at offsets `0x0fe7 + ordinal*0x4e1`. For each ordinal it scans the live candidate collection twice conceptually: one path remembers the last availability-qualified candidate in the current bank as the template source record, while the parallel reuse path looks for a candidate whose prior ordinal field `[candidate+0x794]` already equals the current ordinal so that same live slot can be reused. When no reusable target exists it allocates one fresh candidate record through collection vtable slot `+0x04` and zeroes its `0x1f2`-dword body; otherwise it resolves the reusable target and clears its dependent pointer fields `[candidate+0x79c]`, `[candidate+0x7a0]`, and `[candidate+0x37]`. When the chosen target differs from the bank template source, it clones the full `0x1f2`-dword template body first. It then seeds the rebuilt candidate from the active scenario state rooted at `0x006cec78`: `[candidate+0x794]` becomes the current ordinal, `[candidate+0xe4]` keeps the live collection id, `[candidate+0x33]` takes the imported recipe-line count from `[state+0x1024]`, `[candidate+0x2a]` takes the shared production-cap float from `[state+0x13d4]`, and `[candidate+0x37]` receives a freshly allocated copy of the packed `0xbc` descriptor array from `[state+0x1028]`. The label side is narrower than earlier notes too: this rebuild owner does not consult the scenario-side recipe-book name at `[state+0x0fe8]`. Instead it formats display stem `[candidate+0x04]` directly from one of the two fixed built-in roots `0x005c93d8` or `0x005c93e8`, chosen by availability bit `[candidate+0xba] & 1`, together with the current ordinal. After that projection it refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and the neighboring mode-flag pass `0x00411ce0`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and the larger collection load path at `0x00412fb0`, so this is the candidate-side bridge that projects editor recipe-book state into live runtime records rather than a generic collection copy loop. | objdump + local disassembly + caller xrefs + callsite inspection + scenario-state correlation + ordinal-reuse correlation + template-clone correlation + display-stem-correction |
| 241 | 0x00412ca0 | 192 | world_region_pick_commercial_profile_label_by_region_rank | map | thiscall | inferred | objdump + strings + callsite inspection | 4 | Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`. | objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings |
| 242 | 0x004133b0 | 132 | placed_structure_collection_refresh_local_runtime_records_and_position_scalars | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b2fc` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep. | objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation |
| 243 | 0x00413f50 | 47 | placed_structure_local_runtime_site_id_queue_pop_next | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt. | objdump + caller inspection + local disassembly + local-runtime-queue correlation |
| 244 | 0x00414230 | 24 | intrusive_slist_push_head_and_increment_count | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Tiny intrusive singly linked list helper over a three-dword owner rooted at `[this+0x00/+0x04/+0x08]`. The caller-supplied node pointer is linked at the head, the previous head becomes the new node's next pointer, tail `[this+0x04]` is seeded when the list was previously empty, and count `[this+0x08]` is incremented. Current grounded callers include the support-family owners around `0x00522933` and `0x005562d1`, so this is the safest current read for the common push-head helper rather than a projected-runtime-specific queue owner. | objdump + caller xrefs + local disassembly + intrusive-list correlation |
| 245 | 0x00414250 | 22 | intrusive_slist_pop_head_and_decrement_count | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Tiny intrusive singly linked list pop helper over the same three-dword owner as `0x00414230`. When the head is nonnull it unlinks the current head, updates tail `[this+0x04]` when the list becomes empty, and decrements count `[this+0x08]`. Current grounded callers include the support-family owners at `0x00556291` and `0x005562b6`, so this is the clearest current read for the common pop-head companion rather than a projected-runtime-specific queue helper. | objdump + caller xrefs + local disassembly + intrusive-list correlation |
| 246 | 0x00414270 | 64 | world_replay_packed_projected_cell_list_into_compact_grid_mode2_with_set_or_clear | map | cdecl | inferred | objdump + caller xrefs + local disassembly + compact-grid correlation | 3 | Iterates one sentinel-terminated packed projected-cell list and replays each entry into compact grid bank `2` through `0x004497a0`. Each packed dword contributes one `(x, y)` pair from its low and high `15`-bit halves; the caller-supplied stack flag decides whether the helper sets or clears the corresponding compact-grid bit, while the desired-state and mode operands are otherwise fixed. Current grounded callers are the paired wrappers `0x004142c0` and `0x004142d0`, and the surrounding placement-validator branch at `0x0040dea9/0x0040def8`, so this is the strongest current read for replaying one projected-cell list into compact-grid mode `2` rather than a generic packed-list walker. | objdump + caller xrefs + local disassembly + compact-grid correlation + placement-validator correlation |
| 247 | 0x004142c0 | 12 | world_clear_packed_projected_cell_list_from_compact_grid_mode2 | map | cdecl | inferred | objdump + caller xrefs + wrapper inspection | 2 | Tiny clear-side wrapper over `world_replay_packed_projected_cell_list_into_compact_grid_mode2_with_set_or_clear` `0x00414270`. It forwards the caller's packed projected-cell list with stack flag `0`, which clears each covered bit from compact-grid bank `2`. Current grounded caller is the placement-validator prepass around `0x0040dea9`. | objdump + caller xrefs + wrapper inspection + compact-grid correlation |
| 248 | 0x004142d0 | 12 | world_set_packed_projected_cell_list_into_compact_grid_mode2 | map | cdecl | inferred | objdump + caller xrefs + wrapper inspection | 2 | Tiny set-side wrapper over `world_replay_packed_projected_cell_list_into_compact_grid_mode2_with_set_or_clear` `0x00414270`. It forwards the caller's packed projected-cell list with stack flag `1`, which sets each covered bit in compact-grid bank `2`. Current grounded caller is the placement-validator cleanup path around `0x0040def8`. | objdump + caller xrefs + wrapper inspection + compact-grid correlation |
| 249 | 0x004142e0 | 102 | packed_projected_cell_list_query_bounds_rect | map | cdecl | inferred | objdump + caller xrefs + local disassembly | 3 | Bounds helper over one sentinel-terminated packed projected-cell list. The helper scans each packed cell dword, extracts the low and high `15`-bit coordinates, tracks inclusive minima and maxima, and writes the finished rectangle into the caller output struct as `(min_x, min_y, max_x, max_y)`. Current grounded callers are `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, the neighboring projected-payload path at `0x0041852c`, the multiplayer callback root `0x0046df75`, and the small rect-copy wrapper `0x00414450`, so this now reads as the shared bounds extractor for projected-cell lists rather than an anonymous geometry helper. | objdump + caller xrefs + local disassembly + projected-cell-list correlation |
| 250 | 0x00414480 | 6 | placed_structure_local_runtime_site_id_queue_count | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tiny count getter over the temporary placed-structure id queue used by the local-runtime refresh family. The helper simply returns the current queue count at `0x0062ba64`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the returned count bounds the queue-drain loop before the later all-sites side refresh. | objdump + caller inspection + local disassembly + local-runtime-queue correlation |
| 251 | 0x0041aae0 | 28 | linked_route_object_temp_record_construct_vtable_5c9748 | simulation | thiscall | inferred | objdump + local disassembly + vtable correlation | 2 | Tiny constructor-side helper for the stack-local temporary linked-route-object record used by the tagged bundle refresh owner `0x0041d3f0`. The helper re-enters the shared base initializer `0x0045c890` and then installs vtable `0x005c9748` before returning. Current grounded caller is the per-entry loop inside `linked_route_object_collection_refresh_records_from_tagged_bundle` `0x0041d3f0`, so this is the safest current read for the temporary `0x5c9748` record constructor rather than a reusable live collection owner. | objdump + local disassembly + vtable correlation + caller correlation |
| 252 | 0x0041ab00 | 14 | linked_route_object_temp_record_reset_to_vtable_5c9748_and_release_base_payload | simulation | thiscall | inferred | objdump + local disassembly + vtable correlation | 2 | Tiny release-side helper paired with `linked_route_object_temp_record_construct_vtable_5c9748` `0x0041aae0`. The helper restores vtable `0x005c9748` on the temporary stack-local record and then tails into the shared base release path `0x0045c460`. Current grounded caller is the per-entry loop inside `linked_route_object_collection_refresh_records_from_tagged_bundle` `0x0041d3f0`, where it tears the temporary record down after the destination entry consumes it through virtual slot `+0x40`. | objdump + local disassembly + vtable correlation + caller correlation |
| 253 | 0x0041d7a0 | 22 | locomotive_era_collection_release_tagged_records_and_collection_storage | simulation | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Release-side wrapper for the locomotive-era collection rooted at `0x0062ba88`. The helper restores vtable `0x005c9824`, re-enters `0x00518600` to release collection-side entry state, and then tails into the shared indexed-collection teardown `0x00518bd0`. Current grounded caller is the world teardown owner `0x00434300`, where the same global root is cleared and freed during runtime shutdown, so this is the safest current read for the release companion to the era-collection load/save family rather than a generic collection destructor. | objdump + local disassembly + caller correlation + collection-teardown correlation |
| 254 | 0x0041d7c0 | 1520 | locomotive_era_collection_stream_load_tagged_records_import_engine_type_content_and_seed_runtime_sidecars | simulation | thiscall | inferred | objdump + local disassembly + caller correlation + tagged-import correlation | 4 | Broader tagged import owner for the locomotive-era collection rooted at `0x0062ba88`, reached directly from constructor `0x0041e170`. The helper runs two outer passes over the repeated tagged source opened through callback trio `0x005c8190/0x005c8194/0x005c819c` around the fixed stem `0x005c993c`, validates one fixed field set against the built-in tag strings `0x005c9934..0x005c9884`, and when the record layout passes it dispatches collection vtable slot `+0x04` into `locomotive_era_collection_allocate_entry_import_tagged_record_and_seed_named_sidecar_handles` `0x0041de60` to allocate or insert one live `0x88`-byte era record. The imported live record keeps its fixed scalar and string bands in-place, owns one nested collection at `[entry+0x196]`, and the import owner seeds that nested collection by matching imported strings against the global named table at `[0x006d4020+0x429b8]` and pushing the resolved rows through `0x0053d110`. Current grounded caller is `locomotive_era_collection_construct_and_stream_load_tagged_records` `0x0041e170`. Current package-save inspection has still found no mirrored early world-bundle serializer for `0x0062ba88`, so the safest current read remains a world-load or content-import owner rather than a save-side collection twin. | objdump + local disassembly + caller correlation + tagged-import correlation + nested-sidecar correlation + era-collection correlation + package-save-order correlation |
| 255 | 0x0041e170 | 49 | locomotive_era_collection_construct_and_stream_load_tagged_records | simulation | thiscall | inferred | objdump + local disassembly + caller correlation + constructor correlation | 3 | Constructor-side world-load owner for the locomotive-era collection rooted at `0x0062ba88`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c9824`, seeds the collection through `0x00518570` with literal tuple `(1, 0x266, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `locomotive_era_collection_stream_load_tagged_records_and_seed_runtime_sidecars` `0x0041d7c0`. Current grounded caller is the world-entry load branch at `0x00438cf7`, which stores the finished object into global `0x0062ba88`, so this is the current safest read for the constructor above the era-collection tagged load seam rather than a generic collection allocator. | objdump + local disassembly + caller correlation + constructor correlation + world-load correlation |
| 256 | 0x0041d3f0 | 197 | linked_route_object_collection_refresh_records_from_tagged_bundle | simulation | thiscall | inferred | objdump + local disassembly + caller correlation + collection-family correlation | 3 | Collection-wide tagged load owner for the linked-route-object family rooted at `0x0062ba84`. The helper opens the `0x4a39/0x4a3a/0x4a3b` bracket through `0x00531360`, refreshes collection-side metadata through `0x00518680`, then walks every live linked-route-object record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. For each live record it seeds one stack-local temporary entry through `0x0041aae0`, copies that temporary vtable into the destination record root, dispatches the destination record through virtual slot `+0x40`, and then tears the temporary record down through `0x0041ab00` before closing tag `0x4a3b`. Current grounded caller is the world-entry bringup branch at `0x0044452b`, where this helper runs directly on `0x0062ba84` between the placed-structure dynamic-side-buffer bundle lane and the live train collection load. This is the safest current read for the linked-route-object tagged load owner rather than another anonymous `0x5c9748`-family collection walk. | objdump + local disassembly + caller correlation + collection-family correlation + tag-family correlation |
| 257 | 0x0041d4c0 | 118 | linked_route_object_collection_serialize_records_into_tagged_bundle | simulation | thiscall | inferred | objdump + local disassembly + caller correlation + collection-family correlation | 3 | Collection-wide tagged save owner for the linked-route-object family rooted at `0x0062ba84`. The helper emits tag family `0x4a39/0x4a3a/0x4a3b` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, then walks every live linked-route-object record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each record through virtual slot `+0x44` with the caller bundle. Current grounded caller is the early package-save prelude at `0x00445433`, where it runs directly on `0x0062ba84` between the placed-structure dynamic-side-buffer tagged save and the live train collection serializer. This is the safest current read for the linked-route-object tagged save owner rather than another anonymous `0x5c9748`-family collection walk. | objdump + local disassembly + caller correlation + collection-family correlation + tag-family correlation |
| 258 | 0x0041ddc0 | 160 | locomotive_era_collection_remove_entry_by_id_release_nested_sidecars_and_erase | simulation | thiscall | inferred | objdump + local disassembly + vtable correlation + caller correlation | 3 | Per-entry release owner for the locomotive-era collection rooted at `0x0062ba88`, reached through vtable `0x005c9824` slot `+0x08`. The helper resolves the current live entry through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, releases the main sidecar handle at `[entry+0x12a]`, drops the nested handle band rooted at `[entry+0x19a]` through repeated `0x0053c000`, destroys the nested collection at `[entry+0x196]`, and then erases the live entry id through `0x00518a30`. Current grounded callers are the collection vtable and the broader release wrapper `0x0041d7a0`, so this is the safest current read for the era-entry remove-and-release owner rather than a generic collection delete leaf. | objdump + local disassembly + vtable correlation + caller correlation + nested-sidecar correlation |
| 259 | 0x0041de60 | 789 | locomotive_era_collection_allocate_entry_import_tagged_record_and_seed_named_sidecar_handles | simulation | thiscall | inferred | objdump + local disassembly + vtable correlation + string correlation | 3 | Per-record import allocator for the locomotive-era collection rooted at `0x0062ba88`, reached through vtable `0x005c9824` slot `+0x04` from `0x0041d7c0`. The helper allocates or inserts one live `0x88`-byte era entry through `0x00518900`, loads the engine-type content payload identified by the fixed stem `Data/EngineTypes/%1.cgo`, seeds one nested collection at `[entry+0x196]`, and resolves imported named rows against the global table at `[0x006d4020+0x429b8]` before committing the live sidecar handles. Current local strings and callers make this a content-import owner for one era record rather than a package-save restore sibling. | objdump + local disassembly + vtable correlation + string correlation + caller correlation + engine-type-content correlation |
| 260 | 0x0041e010 | 234 | locomotive_era_collection_publish_intro_notice_and_service_current_year_type2_entries | simulation | thiscall | inferred | objdump + local disassembly + caller correlation + year-gate correlation | 3 | Immediate world-load follow-on over the locomotive-era collection rooted at `0x0062ba88`. When the early-year gate sees current year `[0x006cec78+0x0d] == 0x770` with start year `[+0x05] < 0x770` and runtime branch `[+0x46c38] == 0`, the helper first publishes the paired introductory text ids `0xcb/0xcc` through `0x00473f80`. It then only continues when the current year is at least `0x726`, scans every live era entry, keeps only records whose threshold year `[entry+0x105]` exactly matches the current year and whose type dword `[entry+0x41]` equals `2`, derives the current company or issue context through `0x004337b0/0x004337a0`, re-enters `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, and on success publishes the linked locomotive or era-side notice through `0x004337c0` with fixed text stem `0x005c87a8`. Current grounded caller is the same world-load and setup-side phase family that services the era collection after import, so this is the safest current read for the early intro-notice plus current-year type-`2` era-record service pass rather than a generic collection walk. | objdump + local disassembly + caller correlation + year-gate correlation + notice-publish correlation |
| 261 | 0x0041e100 | 103 | locomotive_era_collection_find_first_live_entry_matching_type_and_current_year_window | simulation | thiscall | inferred | objdump + local disassembly + caller correlation + year-window correlation | 3 | Small live-entry query over the locomotive-era collection rooted at `0x0062ba88`. The helper walks every live entry through `0x00518380/0x00518140`, keeps only records whose type dword `[entry+0x41]` matches the caller-supplied selector, and then compares the current scenario year `[0x006cec78+0x0d]` against the record window `[entry+0x105..+0x109]`. On the first match it returns the corresponding live entry id through `0x00518380`; otherwise it returns zero. Current grounded callers sit in the neighboring era-collection policy and chooser strip, so this is the safest current read for the first-matching type-and-year-window query rather than a generic collection search helper. | objdump + local disassembly + caller correlation + year-window correlation + entry-type correlation |
| 262 | 0x0041e8e0 | 63 | structure_candidate_collection_refresh_filter_and_year_visible_summary_blocks_from_packed_state | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small packed-state load wrapper over the live structure-candidate collection at `0x0062ba8c`. The helper opens two tagged packed blocks through `0x00531360` with ids `0x6979` and `0x697a`, forwards the caller's packed-state source plus side flag into `0x00518680`, and returns the combined consumed size. Current grounded caller is the later world-entry or restore-side branch at `0x00444375`, immediately after the candidate-count refresh family has run, so this is the safest current read for the candidate-summary packed-state load sibling rather than a direct count recompute helper. | objdump + local disassembly + caller correlation + packed-state correlation |
| 263 | 0x0041e930 | 48 | structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small packed-state save wrapper over the same structure-candidate summary family at `0x0062ba8c`. The helper opens the tagged blocks `0x6979` and `0x697a` through `0x00531340`, forwards the caller's packed-state sink plus side flag into `0x00517d90`, and returns after both writes complete. Current grounded caller is the early package-save prelude `0x00444dd0`, which emits this save-side companion before the later tagged collection serializers, so this is the safest current read for the candidate-summary packed-state save sibling rather than a direct filter refresh helper. | objdump + local disassembly + caller correlation + packed-state correlation |
| 264 | 0x0041ede0 | 1784 | structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands | map | thiscall | inferred | objdump + local disassembly + caller correlation + collection-layout correlation | 4 | Broader tagged import owner for the live structure-candidate collection rooted at `0x0062ba8c`, reached directly from constructor `0x0041f4e0` and the later reset-side sibling `0x0041f530`. The helper first clears the three named candidate id slots `[this+0x88/+0x8a/+0x8c]`, opens the repeated tagged source through callback trio `0x005c8190/0x005c8194/0x005c819c` around the fixed stems `0x005c9a08/0x005c9a10`, and reads up to `0x1f3` fixed `0xc9`-byte source records into one local stack array. It then lexicographically reorders that local array through repeated `0x005a57cf` compares before walking the sorted records and materializing live `0xd0`-byte candidate entries through collection vtable slot `+0x04`. For each live record it stamps the resolved id into `[entry+0x3e]`, derives the float-like policy triplet `[entry+0x4a/+0x4e/+0x52]` from imported scalar lanes and current shell mode, marks the three built-in named candidates through bytes `[entry+0x46..+0x49]` when the imported stem at `[entry+0x04]` matches `0x005c99f0`, `0x005c99d8`, or `0x005c99d0`, and writes the matching ids back into collection slots `[this+0x8a]`, `[this+0x88]`, and `[this+0x8c]`. The same import pass also seeds the fixed display-name catalogs rooted at `0x0061312c`, `0x00613173`, `0x006150f8`, and the twelve-row band rooted at `0x005f7f9f`. When the insertion sweep finishes it clears `[this+0x8e/+0x92/+0x96]` plus the full `[this+0x9a]` class-index band, rescans every live candidate name, stores the ids of the three built-in named candidates into `[this+0x92]`, `[this+0x8e]`, and `[this+0x96]`, writes the corresponding class markers `1/0/2` into `[this+0x9a + id*4]`, and then tails into `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`. Current grounded callers are `0x0041f4e0` and `0x0041f530`, so this is the safest current read for the real structure-candidate tagged load plus fixed-name catalog seed owner rather than a generic collection parser. | objdump + local disassembly + caller correlation + collection-layout correlation + tagged-import correlation + fixed-name-catalog correlation |
| 265 | 0x0041e970 | 121 | structure_candidate_collection_refresh_filter_and_year_visible_counts | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide counter refresh over the live structure-candidate pool at `0x0062ba8c`. The helper clears aggregate counts `[this+0x242]` and `[this+0x31a]`, then walks all `0x35` candidate slots through the collection accessors. For each live slot it stores the cargo-economy or editor-filter flag `[entry+0x56]` into one per-slot band rooted at `[this+0x246]`, increments `[this+0x31a]` when that flag is nonzero, re-enters `structure_candidate_is_enabled_for_current_year` `0x0041e220`, stores that result into the paired per-slot band rooted at `[this+0x16e]`, and increments `[this+0x242]` when the year-visible gate succeeds. Current grounded callers include the periodic boundary-service path at `0x0040a56a`, the post-fast-forward setup tail at `0x00437192`, the cargo-economy filter refresh family at `0x0041eac0/0x0041f584`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring locomotive-side bridge at `0x00464aa8`, so this is the safest current read for the shared candidate-collection filter and year-visible count rebuild rather than a one-off world-entry helper. | objdump + local disassembly + caller correlation + candidate-count correlation + year-visible correlation |
| 266 | 0x0041f4e0 | 77 | structure_candidate_collection_construct_and_stream_load_records_then_refresh_counts | map | thiscall | inferred | objdump + local disassembly + caller correlation + constructor correlation | 3 | Constructor-side world-load owner for the live structure-candidate collection rooted at `0x0062ba8c`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c997c`, clears the three named-candidate id slots `[this+0x88/+0x8a/+0x8c]`, seeds the collection through `0x00518570` with literal tuple `(1, 0xd0, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` `0x0041ede0` plus `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`. Current grounded caller is the world-entry load branch at `0x00438c5c`, which stores the finished object into global `0x0062ba8c`, so this is the safest current read for the constructor above the structure-candidate tagged load seam rather than a generic collection allocator. | objdump + local disassembly + caller correlation + constructor correlation + world-load correlation |
| 267 | 0x0041f530 | 89 | structure_candidate_collection_release_live_entries_reimport_tagged_records_and_refresh_counts | map | thiscall | inferred | objdump + local disassembly + caller correlation + reset-path correlation | 3 | Reset-side sibling over the live structure-candidate collection at `0x0062ba8c`. When the collection currently holds live entries, the helper walks every live id through `0x00518380/0x00518140` and dispatches entry vtable slot `+0x08` to release per-entry state, then clears the three named-candidate id slots `[this+0x88/+0x8a/+0x8c]`, re-enters `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` `0x0041ede0`, and finally reruns `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`. Current grounded callers are the later post-load count-refresh family and nearby world-entry restore branches, so this is the safest current read for the in-place candidate reset or reimport sibling rather than a standalone destructor. | objdump + local disassembly + caller correlation + reset-path correlation + entry-release correlation |
| 268 | 0x0041e9f0 | 87 | cargo_collection_find_entry_id_by_exact_name | map | thiscall | inferred | objdump + local disassembly + collection-correlation | 3 | Exact string matcher over the live cargo collection at `0x0062ba8c`. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the caller-supplied token string against each entry name at `[cargo+0x04]` through `0x005a57cf`, and returns the first matching live cargo entry id from `0x00518380` or `0` on failure. Current grounded callers are the recipe-runtime importer `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and its neighboring collection service branches around `0x0041ea50`, so this now looks like the shared live cargo-name-to-id resolver beneath recipe import and setup-side cargo text matching rather than an anonymous collection walk. | objdump + local disassembly + collection-correlation + caller correlation + return-value correction |
| 269 | 0x0041ea50 | 179 | structure_candidate_collection_run_post_load_local_service_setup_phase | map | cdecl | inferred | objdump + local disassembly + caller context | 3 | Post-load world-generation subphase over the live structure-candidate collection at `0x0062ba8c`. The helper derives one modulo-`6` bucket from current world byte `[0x006cec78+0x0f]`, then walks the full collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. When the caller-supplied phase flag is zero it only dispatches candidates whose loop ordinal falls into that current modulo bucket; otherwise it runs the full pass. Every selected candidate is then forwarded into `structure_candidate_rebuild_local_service_metrics` `0x0041e2b0`. Current grounded callsite is the early candidate sweep inside `world_run_post_load_generation_pipeline` `0x004384d0` immediately before the localized progress update `Setting up Players and Companies...`, so this is a candidate-local post-load setup phase rather than a building-collection owner. | objdump + local disassembly + caller context + collection-correlation + modulo-bucket correlation |
| 270 | 0x0041e220 | 52 | structure_candidate_is_enabled_for_current_year | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper. | objdump + caller xrefs + callsite inspection + cargo-economy filter correlation |
| 271 | 0x0041e650 | 142 | structure_candidate_query_route_style_or_local_availability_metric | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + collection-correlation | 3 | Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader. | objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation |
| 272 | 0x0041e7be | 261 | structure_candidate_accumulate_positive_cargo_summary_channels_scaled_by_link_count | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Broader world-side accumulator above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. For one caller-selected cargo id and mode bank it first queries the four returned summary channels, rejects immediately unless the direct primary-cargo scalar, cap-share primary-cargo scalar, nonzero-mode subrow scalar, and zero-mode cap-scaled subrow scalar are all strictly positive, then queries one linked-instance count through `0x00413940`. When that count is positive it multiplies each of the four channel values by the linked-instance count and accumulates those four scaled results into caller-owned floats before finally copying the finished quartet into candidate dwords `[candidate+0x8e/+0x92/+0x96/+0x9a]`; it also stamps the current scenario tick or year field from `[0x006cec78+0x15]` into `[candidate+0x8a]` after the outer loop completes. Current grounded callers are the broader placed-structure cargo service and world-side rebuild paths above the candidate projection family, so this is now the strongest current read for the first positivity-gated consumer that treats the four cargo-summary banks as one linked-count-scaled quartet rather than as independent query outputs. | objdump + local disassembly + caller inspection + cargo-summary correlation + link-count correlation |
| 273 | 0x00467eb0 | 104 | placed_structure_route_link_attach_site_owner | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Attaches one `0x006ada90` route-link record onto the owner chain of one placed structure. The helper first detaches the current record through `0x00467df0`, stages the caller-supplied placed-structure id into route-link field `+0x0a`, links the record into the placed-structure-owned chain at `[site+0x272]` through route-link field `+0x04`, and then re-enters `0x00467c30` to recompute the route-link flag byte at `+0x12` against neighboring site pairs. When that flag byte keeps bit `0x2` set, the helper also projects one class-indexed signed contribution through `0x0040fa50` and accumulates it into the placed structure through `0x0042b310`. Current grounded caller is the route-link allocator path at `0x00468067`, which makes this the clearest current owner bridge from one freshly allocated `0x006ada90` record into the site-linked chain later scanned by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` and `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650`. | objdump + caller xrefs + chain-layout inspection + route-link-correlation |
| 274 | 0x00467df0 | 183 | placed_structure_route_link_detach_current_owner_chain | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Detaches one `0x006ada90` route-link record from whichever owner chain currently anchors it. The helper first checks route-link field `+0x08`; when nonzero it treats that field as one route-node-like owner id in collection `0x006cfcbc` and unlinks the record through owner field `+0x04` plus route-node link slot `+0x29`. Otherwise it falls back to the placed-structure owner path, using route-link field `+0x0a` as one site id in collection `0x0062b26c`, optionally applying the same class-indexed signed contribution rollback through `0x0040fa50` and `0x0042b310` when flag byte `+0x12` keeps bit `0x2` set, and then unlinking through `[site+0x272]`. Current grounded callers are the site-owner attach path at `0x00467eb0`, the route-node attach path at `0x00467f20`, and the route-link destructor path at `0x004680b0`, so this now looks like the shared detach helper beneath all owner-chain rewrites for the route-link family. | objdump + caller xrefs + chain-layout inspection + owner-slot correlation |
| 275 | 0x00467c30 | 443 | placed_structure_route_link_recompute_endpoint_pair_state | map | thiscall | inferred | objdump + caller xrefs + endpoint-pair inspection | 3 | Recomputes the route-link state byte at `+0x12` from the active site-endpoint pair and updates the linked site contribution when that state flips. The helper only runs on the site-owned branch where route-link field `+0x08` is zero; it resolves the two endpoint site ids from fields `+0x0a` and `+0x0e` through collection `0x0062b26c`, clears the prior bit-`0x2` state, then compares the two endpoint-side route-entry chains through `0x00455f60`, `0x0047de00`, `0x0040c990`, and `0x0047f2d0` until it finds a compatible shared peer. On the first match it restores bit `0x2` in the state byte. If the boolean substate derived from bit `0x1` changes across the recomputation, the helper applies one signed class-indexed contribution through candidate class byte `+0x10`, the class-weight table at `0x0062ba8c+0x8e`, and `0x0042b310` against the first endpoint owner. Current grounded callers are the site-owner attach path `0x00467eb0`, the route-link rebuild sweep around `0x004682e6`, and the route-link allocator path at `0x0046809b`, so this now looks like the endpoint-pair state reconciler beneath the route-link family rather than a generic chain walk. | objdump + caller xrefs + endpoint-pair inspection + shared-peer correlation |
| 276 | 0x00467f20 | 45 | placed_structure_route_link_attach_route_node_owner | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Attaches one `0x006ada90` route-link record onto the owner chain of one route-node-like record in collection `0x006cfcbc`. The helper first detaches the current record through `0x00467df0`, then stages the caller-supplied route-node id into route-link field `+0x08` and links the route-link through owner field `+0x04` plus route-node link slot `+0x29`. Current grounded caller is the route-node-side rewrite path at `0x004680e0`, which keeps this as the route-node owner companion to `placed_structure_route_link_attach_site_owner` rather than another site-chain helper. | objdump + caller xrefs + chain-layout inspection + route-node-owner correlation |
| 277 | 0x00467f50 | 352 | placed_structure_route_link_allocate_site_pair_for_candidate_class | map | cdecl | inferred | objdump + caller xrefs + stack-layout inspection + class-counter correlation | 3 | Allocates and seeds one new `0x006ada90` route-link record for a caller-supplied placed-structure pair and candidate class. The helper builds one `0x19`-byte local template whose current grounded creation-side writes seed route-link fields `+0x0c` and `+0x0e` from the two input site ids, class byte `+0x10` from the supplied candidate-class argument, and one masked initial state template from the class side table at `0x005f2adc[class]`. It then allocates the live record from the route-link collection, attaches it to the first site through `placed_structure_route_link_attach_site_owner` `0x00467eb0`, increments the grouped class counters at `[class_record+0x5a]` and `[class_record+0x5e]` through the candidate-class table at `0x0062ba8c+0x8e`, and finally re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current direct creation-side caller is `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0`, while grounded internal calls land at `0x00468067` and `0x0046809b`; this is therefore the strongest current owner for creation-side site-pair seeding in the route-link family. | objdump + caller xrefs + stack-layout inspection + class-counter correlation + route-link-collection correlation |
| 278 | 0x004680b0 | 96 | placed_structure_route_link_release_and_detach | map | thiscall | inferred | objdump + caller xrefs + class-counter correlation | 3 | Releases one live `0x006ada90` route-link record's class-side counters and then detaches it from its current owner chain. The helper resolves the candidate-class record from route-link byte `+0x10` through `0x0062ba8c+0x8e`, subtracts the fixed creation-side increment from `[class_record+0x5a]`, then chooses one of the two trailing accumulator slots `[class_record+0x62]` or `[class_record+0x66]` by testing state byte `+0x12 & 0x1`. After that class-side rollback it tails into `placed_structure_route_link_detach_current_owner_chain` `0x00467df0`. Current grounded caller is the route-link collection sweep around `0x004681ae`, which keeps this as the clearest release-side companion to `placed_structure_route_link_allocate_site_pair_for_candidate_class` rather than another attach helper. | objdump + caller xrefs + class-counter correlation + detach-tail correlation |
| 279 | 0x00468110 | 39 | placed_structure_route_link_collection_construct | map | thiscall | inferred | objdump + world-bringup correlation + collection-layout inspection | 3 | Constructs the world-side route-link collection later published at `0x006ada90`. The helper seeds the collection vtable at `0x005ce130`, then initializes one indexed collection through `0x00518570` with grounded parameters `(record_size=0x19, initial_slots=0x64, growth=0x64, id_base=1)`. Current grounded caller is the world bring-up path at `0x004488a3`, where the resulting manager is stored into `0x006ada90` beside the placed-structure and candidate collections. This is the strongest current owner name for the record family later scanned by the route-style overlay and availability helpers. | objdump + world-bringup correlation + collection-layout inspection + manager-publication correlation |
| 280 | 0x00468140 | 18 | placed_structure_route_link_collection_destroy | map | thiscall | inferred | objdump + world-shutdown correlation + collection-layout inspection | 3 | Destroys the world-side route-link collection rooted at `0x006ada90`. The helper restores the same collection vtable at `0x005ce130`, releases the indexed-collection payload through `0x00518600`, and then tails into the common collection teardown at `0x00518bd0`. Current grounded callers are the global world-shutdown path at `0x0044931d` and the route-link collection sweep at `0x004681ae`, which keep this as the clear destructor companion to `placed_structure_route_link_collection_construct`. | objdump + world-shutdown correlation + collection-layout inspection + manager-publication correlation |
| 281 | 0x004681f0 | 100 | placed_structure_route_link_collection_remove_links_touching_site_id | map | thiscall | inferred | objdump + caller xrefs + field-match inspection | 3 | Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose grounded site-reference triple matches one caller-supplied placed-structure id. The helper walks the live route-link collection and deletes any record whose `u16` fields at `+0x0a`, `+0x0c`, or `+0x0e` equal the requested id, reusing the collection erase vfunc for each match. Current grounded callers include the placed-structure teardown path at `0x0040e23b`, where the supplied id comes from `[site+0x2a4]`, so this now looks like the site-side cleanup companion for the route-link family rather than a generic collection filter. | objdump + caller xrefs + field-match inspection + site-cleanup correlation |
| 282 | 0x00468260 | 84 | placed_structure_route_link_collection_remove_links_by_route_node_id | map | thiscall | inferred | objdump + caller xrefs + field-match inspection | 3 | Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose route-node owner field at `+0x08` matches one caller-supplied id. The helper walks the live route-link collection, compares each record's `u16` field `+0x08` against the requested route-node id, and erases matching records through the same collection vfunc used by the broader cleanup paths. Current grounded caller is the neighboring runtime teardown at `0x004acf03`, which keeps this as the route-node-side cleanup companion to `placed_structure_route_link_collection_remove_links_touching_site_id` rather than another site sweep. | objdump + caller xrefs + field-match inspection + route-node-cleanup correlation |
| 283 | 0x004682c0 | 58 | placed_structure_route_link_collection_recompute_all_endpoint_pair_state | map | thiscall | inferred | objdump + caller inspection + collection-iteration inspection | 3 | Collection-wide recompute sweep over the live `0x006ada90` route-link family. The helper iterates every live route-link id through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` on each resolved record. This is the clean whole-collection state refresh companion to the per-record recompute helper rather than another allocator or cleanup path. | objdump + caller inspection + collection-iteration inspection + recompute-helper correlation |
| 284 | 0x00468300 | 235 | placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state | map | thiscall | inferred | objdump + caller inspection + world-grid correlation + collection-iteration inspection | 3 | Higher-level rebuild pass above the route-link family that resets the route-style world-grid counters and then recomputes live endpoint state across `0x006ada90`. The helper first reads three candidate-class ids from the structure-candidate side table at `0x0062ba8c+0x88/+0x8a/+0x8c`, walks the active world-grid tables rooted at `[0x0062c120+0x2129]`, and clears the aligned per-cell dword lanes at offset `+0x103` for those three classes. It then iterates every live route-link record in `0x006ada90`, clears state bit `0x2` in each record's flag byte at `+0x12`, and re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current grounded callers include the recurring simulation-maintenance branch at `0x0040a575`, the world bring-up side near `0x00444b2f`, and one later world-side update path at `0x00481157`, which makes this the clearest current owner of the full-family route-style counter-and-state rebuild rather than just another collection walk. | objdump + caller inspection + world-grid correlation + collection-iteration inspection + route-style-class correlation |
| 285 | 0x0041e2b0 | 589 | structure_candidate_rebuild_local_service_metrics | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `structure_candidate_collection_run_post_load_local_service_setup_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate. | objdump + caller xrefs + callsite inspection + world-grid correlation |
| 286 | 0x0042da90 | 129 | scenario_event_prepare_runtime_record_text_bands_for_packed_state_save | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small pre-save sweep over one live runtime event record immediately beneath the `.smp` event-collection serializer `0x00433060`. The helper re-enters `0x0042d820` six times with save-side flag `1` over the fixed text-band families rooted at `[record+0x0e0]`, `[+0x401]`, `[+0x4ca]`, `[+0x593]`, `[+0x65c]`, and `[+0x725]`, using size `0x320` for the first band and `0xc8` for the remaining five. Current grounded caller is the first event-collection sweep inside `0x00433060`, so this is the safest current read for the text-band preparation pass that runs before the packed runtime-record stream is emitted rather than for a standalone serializer. | objdump + local disassembly + caller correlation + fixed-text-band correlation |
| 287 | 0x0042db20 | 1040 | scenario_event_refresh_runtime_record_from_packed_state | scenario | thiscall | inferred | objdump + caller inspection + local disassembly + shell-event-window correlation | 2 | Heavy per-event runtime materializer beneath the live event collection at `0x0062be18`. The helper reads one packed event definition from the caller-supplied state or stream object, conditionally clears and repopulates several fixed text bands on the destination event record at offsets such as `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, then rebuilds two event-runtime row families from caller-supplied counts and packed row payloads. Current shell-side xrefs now tighten that split. The first family allocates `0x1e`-byte rows, fills scalar and byte fields from the packed source, conditionally extends the row on later-format branches, remaps bounded id ranges through the live structure-candidate collection `0x0062ba8c`, and links the resulting rows through one standalone event-side list anchor; the adjacent helper cluster `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is only consumed by `EventConditions.win`, so this first family now reads as the runtime condition-row list. The second family repeats the same materialization pattern with `0x28`-byte rows across four grouped slots on the destination event record, applying version-gated field extension and bounded remap logic against the locomotive collection `0x006ada84`, the live structure-candidate collection `0x0062ba8c`, and the global candidate pool `0x0062b268` before linking each rebuilt row into one of four grouped list anchors; the generic deep-copy helper `0x0042e050` now clones those same grouped lists during event duplication, so this second family still reads as the grouped event-effect row side rather than another condition list. Current grounded caller is the collection-wide wrapper `0x00433130`, so this is now the safest current read for one live event's runtime-record refresh from packed scenario-state data rather than a generic collection helper. | objdump + caller inspection + local disassembly + event-record materialization correlation + candidate-and-locomotive-remap correlation + shell-event-window correlation |
| 288 | 0x0042d700 | 59 | scenario_event_query_standalone_condition_row_list_class_and_modifier_flags | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + local disassembly | 2 | Aggregates the class and modifier bits implied by one live event's standalone `0x1e`-row condition list. The helper first short-circuits to literal `0x7f` when event byte `[event+0x82b]` is set, then otherwise walks the list rooted at `[event+0x00]`, OR-ing the static row-class byte from `0x005f3e04 + id*0x81` for ordinary nonnegative row ids and using the negative-id fallback branch only to preserve special marker value `0x7f`. Current grounded callers are the condition-window summary refreshes `0x004d9970` and the broader control refresh `0x004da0f0`, so this is the safest current read for the standalone condition-list class or modifier aggregate rather than a generic linked-list scan. | objdump + EventConditions.win refresh correlation + local disassembly + condition-row-class-table correlation |
| 289 | 0x0042d740 | 87 | scenario_event_query_grouped_effect_row_list_type_flags | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + local disassembly | 2 | Aggregates one grouped effect-row type bitfield for a live event. The caller supplies the grouped list ordinal on the stack, and the helper walks the selected grouped anchor at `[event + group*4 + 0x04]`, OR-ing one descriptor byte from `0x006103fd + opcode*0x6e` across the linked `0x28`-row family. One caller-controlled boolean also enables a narrower normalization path that remaps a small special opcode subset to shared bit `0x08` before the OR step. Current grounded callers are the conditions-window refresh family `0x004d9d10` and `0x004da0f0`, plus one world-side branch at `0x00431120`, so this is the safest current read for grouped effect-row type flags rather than a standalone condition helper. | objdump + EventConditions.win refresh correlation + local disassembly + grouped-effect-descriptor correlation |
| 290 | 0x0042df30 | 63 | scenario_event_condition_row_list_has_class_bit0_or_flag7f9_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Tiny predicate over the standalone `0x1e`-row event-condition list rebuilt by `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. The helper walks the linked list rooted at the caller-supplied event record, tests each nonnegative row id against class-bit `0x01` in the static per-condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7f9]`. Current grounded callers are the `EventConditions.win` refresh path at `0x004da19a` and `0x004da23c`, so this now reads as the class-bit-0 condition-summary gate rather than a generic list scan. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 291 | 0x0042df70 | 63 | scenario_event_condition_row_list_has_class_bit1_or_flag7fa_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x02` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7fa]`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da1de`, so this now reads as the class-bit-1 condition-summary gate rather than another anonymous list helper. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 292 | 0x0042dfb0 | 62 | scenario_event_condition_row_list_has_class_bit2_or_type63_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to the event-record dword check `[event+0x7f0] == 0x63`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da2be`, so this now reads as the class-bit-2 condition-summary gate rather than another generic scan. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-type correlation |
| 293 | 0x0042dff0 | 82 | scenario_event_condition_row_list_has_any_class_bit012_or_special_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Broad predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as the smaller `0x0042df30/0x0042df70/0x0042dfb0` family, tests each nonnegative row id against any of class bits `0x01|0x02|0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to any of the three special event-record checks `[event+0x7f9]`, `[event+0x7fa]`, or `[event+0x7f0] == 0x63`. Current grounded caller is the early `EventConditions.win` refresh gate at `0x004da17d`, so this now reads as the broad condition-summary eligibility probe rather than a generic linked-list walk. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 294 | 0x0042e050 | 603 | scenario_event_clone_runtime_record_deep_copy | scenario | cdecl | inferred | objdump + caller xrefs + local disassembly + shell-event-window correlation | 2 | Deep-copy helper for one already-materialized live event runtime record. The helper copies the six fixed text bands at destination offsets `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, mirrors the compact event metadata band at `+0x7ee..+0x80e`, then deep-copies the standalone `0x1e`-row linked list and the four grouped `0x28`-row linked lists from one live event-runtime record into the caller-supplied destination record. Current grounded caller is `shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal` `0x004db8b0`, where it clones the currently selected live event into a newly created event record before selector refresh. This is therefore the safest current owner for deep-copy of an already-materialized event runtime record rather than another packed-state loader or an effects-only staging helper. | objdump + caller xrefs + local disassembly + shell-event-window correlation + deep-copy correlation |
| 295 | 0x0042c1b0 | 886 | placed_structure_redistribute_local_service_pressure_from_neighbors | map | thiscall | inferred | objdump + caller xrefs + neighborhood sweep inspection | 3 | Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop. | objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation |
| 296 | 0x0041eac0 | 794 | structure_candidate_collection_refresh_cargo_economy_filter_flags | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + rdata strings | 3 | Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and the live copy of special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]`; when that slot is set the branch at `0x0041ed37` further tests the wartime cargo family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and `Diesel` before writing the resulting enabled-or-filtered state into `[entry+0x56]` and re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule plus the `Use Wartime Cargos` scenario rule into live structure-candidate filtering rather than a purely editor-side helper. | objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation |
| 297 | 0x00421b60 | 180 | world_region_collection_seed_default_regions | map | thiscall | inferred | objdump + strings + callsite inspection | 4 | Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup. | objdump + RT3.lng strings + caller xrefs + callsite inspection |
| 298 | 0x00421ce0 | 55 | world_region_collection_run_class0_secondary_overlay_stamp_pass_for_all_live_regions | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small collection-wide region overlay pass. The helper walks every live region entry through `indexed_collection_get_nth_live_entry_id` `0x00518380` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `world_region_class0_stamp_local_secondary_overlay_and_scored_refinement_pass` `0x0041fb00` on each record. Current grounded caller is the late `.smp` restore tail inside `world_load_saved_runtime_state_bundle` `0x00446d40`, immediately after `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730` and the broader post-close world/tool refresh strip. | objdump + local disassembly + caller correlation + region-overlay-pass correlation |
| 299 | 0x00421c20 | 187 | world_region_collection_run_building_population_pass | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup. | objdump + caller xrefs + callsite inspection |
| 300 | 0x0042b2d0 | 52 | route_entry_list_contains_key | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Boolean membership test over the compact six-byte route-entry list rooted at `[this+0xeb]/[this+0xef]`. The helper linearly scans the current rows and returns true when any leading `u16` key matches the caller-supplied id; otherwise it returns false. Current grounded callers include the linked-site support strip at `0x0040d27f`, the region or profile-side query family at `0x0041f6e7`, `0x0042007c`, `0x0042011a`, `0x0042020c`, `0x004202ba`, `0x004208b6`, and the later placed-structure branch at `0x004adecf`, so this is the safest current read for the shared contains-key helper beneath the same six-byte route-entry list family. | objdump + caller xrefs + local disassembly + six-byte-record correlation |
| 301 | 0x00422320 | 1320 | world_region_normalize_cached_structure_balance_scalars | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Collection-wide region normalization pass over the live region manager `0x0062bae0`. The helper first early-outs in sandbox/editor-side mode through `[0x006cec7c+0x82]` and the active-mode latch `[0x006cec78+0x4aef]`, then runs one per-region prepass through `0x00420d40`, and finally performs two cohort sweeps split by region live byte `[region+0x23e]`. Across those sweeps it accumulates the cached scalar bands `[region+0x2b2/+0x2b6/+0x2ba/+0x2be/+0x2c2/+0x2c6]`, derives bounded normalization ratios, and writes the resulting cached growth-balance band back to `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. The player-facing meaning is tighter now from the editor growth report at `0x004d1d60`: `[region+0x2e2]` is the cached weighted-profit-margin scalar and `[region+0x2ee]` is the cached annual-density-adjust scalar later formatted as a percent, while `[region+0x2e6]` and `[region+0x2ea]` are the intermediate normalized-delta and clamped companion slots beneath that final annual-density adjust. The helper also uses world_region_count_linked_placed_structures_by_category `0x004228b0` as the direct category-count companion during the writeback sweep, and it applies one final live-value adjustment into `[region+0x25e]` when the shell latch `[0x006cec78+0x46c38]` is clear. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a265` inside `simulation_service_periodic_boundary_work` `0x0040a590`, so this is now the safest current read for the region cached growth-balance normalization pass rather than a one-time setup helper. | objdump + local disassembly + caller inspection + recurring-maintenance correlation + editor-growth-report correlation |
| 302 | 0x004228b0 | 68 | world_region_count_linked_placed_structures_by_category | map | thiscall | inferred | objdump + local disassembly | 3 | Counts linked placed-structure records in the current region entry whose category byte matches one caller-supplied value. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and increments one simple match count without applying the heavier cap or availability filters used by `0x00422be0`. The current grounded local caller is the broader region-side worker around `0x00422320`, where this helper is used as the direct category-count companion to the later aggregate and placement passes rather than as a full demand-balancing gate. | objdump + local disassembly + local caller correlation |
| 303 | 0x00422850 | 91 | world_region_count_class0_regions_passing_city_connection_peer_probe_variant | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Counts live class-0 regions in the current region collection that pass one specific `city_connection_bonus_exists_matching_peer_site` variant through `0x00420030`. The helper skips non-class-0 records, calls `0x00420030` with fixed boolean flags `(1,1,1)` plus one caller-supplied trailing dword, and increments a simple count only when that probe returns nonzero. Current grounded callers are the script or query dispatch at `0x0042f856` and the region-stats formatter at `0x004d2088`, so the safest current read is the narrow class-0 count wrapper over that peer-probe variant rather than a broader city-growth metric. | objdump + local disassembly + caller correlation + city-connection-probe correlation |
| 304 | 0x00422900 | 352 | world_region_accumulate_structure_category_totals | map | thiscall | inferred | objdump + callsite inspection | 3 | Aggregates the current structure-category totals for one region entry. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and returns both counts and accumulated weight-like totals across four categories via the caller-provided out-pointers. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the outputs feed the later demand-balancing logic for the region-owned building-population pass. | objdump + callsite inspection |
| 305 | 0x00422a70 | 355 | world_region_validate_and_commit_candidate_placement | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Shared placement-validation and commit gate beneath the region candidate-placement family. The helper takes one region entry in `ECX`, one candidate or profile id on the stack, one candidate world-coordinate pair, one caller-controlled side flag, one direct-versus-staged commit flag, and one optional out-pointer for the created placed-structure id. It first clears the optional out-slot, conditionally snaps the candidate coordinate pair to integers under the preview gate `0x434050 -> 0x46d2b0`, then validates projected placement through `placed_structure_validate_projected_candidate_placement` `0x004197e0`. On the direct-commit lane it additionally resolves the candidate world cell through `0x0044a800` and requires that cell's region id to match `[region+0x23a]`. When placement is allowed and the shell-side latch `[0x006cec78+0x46c3c]` is clear, one branch emits the staged side path through `0x0046d260`; otherwise it commits directly through `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` and stores the resulting placed-structure id in the caller's out-slot. Current grounded callers are `world_region_try_place_candidate_structure` `0x00422ee0` and the world-side randomized batch helper `world_try_place_random_structure_batch_from_compact_record` `0x00430270`, so this is best read as the shared region-side candidate-placement validator and commit gate rather than as one region-worker-private helper. | objdump + local disassembly + caller correlation + placement-validator correlation |
| 306 | 0x00422be0 | 768 | world_region_count_placed_structures_for_category | map | thiscall | inferred | objdump + callsite inspection | 3 | Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen. | objdump + callsite inspection |
| 307 | 0x00422ee0 | 884 | world_region_try_place_candidate_structure | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family. | objdump + caller xrefs + callsite inspection |
| 308 | 0x004235c0 | 1887 | world_region_balance_structure_demand_and_place_candidates | map | thiscall | inferred | objdump + callsite inspection | 4 | Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, queries projected structure-count scalars through `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0`, and then computes target demand for three structure categories by comparing those projected totals against live placed counts plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop. | objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation + projected-demand correlation |
| 309 | 0x004234e0 | 211 | world_region_query_projected_structure_count_scalar_by_category | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Returns one projected structure-count scalar for the requested region and category family. The helper has two materially different branches. On the live-region branch `[region+0x23e] != 0`, it indexes base table `0x005ee1b0` by `(live_region_class, category)`, multiplies by the scenario-difficulty table `0x005f33e0` selected from world difficulty dword `[world+0x2d]`, scales by normalized region-density `[region+0x25e] / 0x005c85d8`, multiplies by the global pre-recipe scalar `[world+0x0bde]`, and then multiplies by cached building-count slot `[region+0x242]` before the final fixed scale at `0x005c8918`. On the fallback branch it instead rounds `[region+0x25e]` through `0x005a10d0`, derives one region bucket via `0x00421490`, combines tables `0x005ee138` and `0x005ee1b0`, applies the alternate scenario-difficulty table `0x005f33cc`, scales by the same normalized region-density and global pre-recipe scalar `[world+0x0bde]`, then applies fixed scale `0x005c8d68` without the `[region+0x242]` multiplier. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator. | objdump + local disassembly + caller correlation + city-count-stats correlation + pre-recipe-scalar correlation + branch-split correlation |
| 310 | 0x00423d30 | 51 | world_region_refresh_cached_category_totals_and_weight_slots | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Refreshes one small cached region summary band rooted at `[this+0x27a]`. The helper forwards three out-pointers `+0x27a/+0x27e/+0x282` plus one return slot `+0x286` into world_region_accumulate_structure_category_totals `0x00422900`, forcing the remaining category outputs and optional aggregate pointers to zero. Current grounded caller is the post-load seeding-burst tail around `0x00437bdc`, which sweeps the live region collection `0x0062bae0` after simulation_run_chunked_fast_forward_burst `0x00437b20`. This is therefore the narrow cached-category-summary refresher beneath that region-side setup and maintenance family rather than a company debt-table helper. | objdump + local disassembly + caller inspection + post-load caller correlation |
| 311 | 0x00423d70 | 176 | company_repay_bond_slot_and_compact_debt_table | simulation | thiscall | inferred | objdump + caller inspection | 4 | Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper. | objdump + caller inspection + finance-field correlation |
| 312 | 0x00423ec0 | 33 | company_adjust_available_track_laying_capacity_with_floor_zero | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter. | objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation |
| 313 | 0x004240a0 | 28 | company_query_available_track_laying_capacity_or_unlimited | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Returns the current company's available track-laying capacity. When scenario byte `[0x006cec78+0x4aaf]` is enabled, the helper returns the live company counter at `[this+0x7680]`; otherwise it returns fixed fallback `29999`, which currently reads as an effectively-unlimited path. Current language-table correlation now ties that scenario byte to RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`, so this helper is best read as the live getter beneath that scenario rule rather than only as an internal company counter accessor. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, and `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`, where the returned value is used as the company-side track-laying-capacity gate for route synthesis and station-attachment placement. | objdump + caller xrefs + callsite inspection + track-laying-capacity correlation + RT3.lng correlation |
| 314 | 0x00424000 | 3 | company_serialize_tagged_runtime_payload_noop | simulation | thiscall | inferred | objdump + local disassembly + company-save correlation | 2 | Tiny current no-op callback beneath the company collection package-save strip. The helper simply returns zero and performs no per-company tagged payload write. Current grounded caller is `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, so this is best read as the present save-side per-company payload stub rather than a standalone company mutation helper. | objdump + local disassembly + company-save correlation + callback-role correlation |
| 315 | 0x00424010 | 29 | company_has_territory_access_rights | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`. | objdump + caller inspection + territory-access table correlation |
| 316 | 0x00423e40 | 112 | company_compute_weighted_average_bond_interest_rate | simulation | thiscall | inferred | objdump + caller xrefs + debt-record inspection | 4 | Computes the company's current weighted average bond interest rate from the live debt table rooted at `[this+0x5f]`. The helper rejects inactive companies and companies with no live bond slots, then walks each 12-byte debt record, accumulates total principal from `[slot+0x00]`, accumulates principal-times-rate from `[slot+0x08]`, and returns the weighted quotient `sum(principal*rate) / sum(principal)`. Current grounded callers are the bond-quote wrapper at `0x00427540`, the CompanyDetail capital summary panel at `0x004c23a0`, and the city-connection bonus ladder at `0x00425320`, so this is the shared average coupon or interest-rate helper rather than a generic finance multiplier. | objdump + caller xrefs + debt-record inspection + finance-summary correlation + bond-quote correlation |
| 317 | 0x00423eb0 | 6 | company_query_cached_share_price_scalar | simulation | thiscall | inferred | objdump + caller xrefs + per-share panel correlation | 3 | Tiny cached-float accessor that returns the company field at `[this+0x0d7b]`. Current grounded shell callers are the CompanyDetail per-share panel at `0x004c2720` and later train-side consumer paths, where this cached scalar is used in the same lane as the `Share Price` readout. The write-side owner is now tighter too: `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` optionally snapshots its final float into the same field when the caller requests a cache refresh, so this remains the narrow cached share-price accessor rather than an arbitrary finance-field read. | objdump + caller xrefs + per-share panel correlation + cached-float-field correlation + stock-price-cache-write correlation |
| 318 | 0x00424030 | 22 | company_set_territory_access_rights_byte | simulation | thiscall | inferred | objdump + caller inspection | 4 | Stores one territory-access byte for the requested company and territory id. The helper writes the supplied byte value into the same per-territory access table rooted at `[this + territory*0x38d + 0x1d9f]`. Current grounded shell caller is the immediate commit path inside `shell_company_detail_buy_territory_access_rights_flow` at `0x004c5fc9`, where the purchase path writes value `1` after the access-rights dialog is accepted. | objdump + caller inspection + territory-access table correlation |
| 319 | 0x004241e0 | 23 | company_sum_control_transfer_offer_policy_fields_raw | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the raw sum of two company-side floating fields at `[this+0x124f]` and `[this+0x12a7]`. Current grounded callers are the merger-offer builder around `0x004eb5a9` and adjacent control-transfer offer-side stat readers, where the returned value is paired with surrounding formatter setup for mode `0x0b` but is not itself passed an issue argument. This now looks like a narrow raw control-transfer offer policy total rather than a generic finance calculation. | objdump + caller inspection + merger-offer dialog correlation |
| 320 | 0x00424200 | 37 | company_sum_control_transfer_offer_policy_fields_scaled_tenths | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the same `[this+0x124f] + [this+0x12a7]` company-side policy total as `company_sum_control_transfer_offer_policy_fields_raw`, but scaled by the `0.1` constant at `0x005c9b50`. Current grounded callers are the merger and chairmanship-takeover offer builders at `0x004eb588` and `0x0050c7cb`, where the scaled result is immediately paired with surrounding formatter setup for mode `0x0b`. The helper itself does not consume an issue id, so this now reads as the scaled control-transfer offer policy total rather than a broader vote-weight function. | objdump + caller inspection + takeover and merger dialog correlation |
| 321 | 0x004248d0 | 759 | company_compute_cached_recent_per_share_performance_subscore | simulation | thiscall | inferred | objdump + caller inspection | 3 | Builds one cached company-side per-share performance subscore from recent yearly stock-data history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it first walks up to five recent years above founding year `[this+0x157]`, weighting yearly `Earnings Per Share` from slot `0x1f` and yearly `Revenue Per Share` from slot `0x1e` through `0x0042a5d0`; the current partial year uses weight `(5 * [world+0x0f]) - 5`, while the prior four full years use `48`, `36`, `24`, and `12`. That yields two normalized history lanes: `EPS * 10` into the first lane and `Revenue Per Share` into the second. It then runs a second trend pass over `Dividend Per Share` slot `0x20`, rewarding adjacent year pairs where the newer dividend does not fall below the previous year's value; that pairwise ladder uses weights `9`, `8`, `7`, and `6` from newest to oldest surviving comparison. The third lane is a dividend-strength score derived from that rewarded ratio, the previous-year dividend, and the constants `0.5`, `0.6`, `30`, and `230`, then floored to `1.13 * min(max(EPS lane, 1.0), revenue lane, current Book Value Per Share slot 0x1d)`. The fourth lane is current `Book Value Per Share` from slot `0x1d`. Negative lanes are clamped to zero. Base lane weights come from `0x005ee208` as `40/10/20/30`, and for company age under five years they are ramped through the four-dword rows at `0x005ee218`: `0/0/0/100`, `25/25/35/100`, `50/50/65/100`, `75/75/85/100`, and `100/100/100/100`. The strongest lane then gets weight `*1.25` while the weakest gets `*0.8`, and the resulting weighted blend ratio is stored as bounded intermediate `[this+0x0d19]` after multiplying by `((difficulty_table[[world+0x2d]] + 1.0) / 2.0)` and flooring at `0.5`. The final cached score recomputes that same base blend, multiplies it by the raw difficulty scalar table at `0x005f33b8` (`0.8/0.9/1.0/1.1/1.2/0.9/0.95/1.0`), applies post-bankruptcy smoothing for companies within ten years of `[this+0x163]` as `score * ((0.025 * years_since_bankruptcy) + 0.5)`, floors the result at `1.0`, and finally caches the float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded caller is `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, where this helper now reads as the recent per-share performance feeder rather than a generic governance-support history walker. | objdump + caller inspection + cache-field correlation + stock-data-family correlation + per-share-panel correlation + weight-ladder correlation + dividend-trend correlation + age-ramp-table correlation + difficulty-table correlation |
| 322 | 0x00425a90 | 194 | company_declare_bankruptcy_and_halve_bond_debt | simulation | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path. | objdump + RT3.lng strings + caller inspection + finance-field correlation |
| 323 | 0x004261b0 | 74 | company_count_unassigned_shares_after_active_chairman_holdings | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the current company share pool at `[this+0x47]` minus the positive holdings found in each active chairman profile record under `0x006ceb9c`. The helper uses the company collection index from `[this+0x00]` to read per-profile holdings from `[profile + company_index*4 + 0x15d]`, sums only positive entries, and subtracts that total from the company share count. Current grounded callers are the takeover and merger vote resolvers, which stage the result into `0x006d1a04` and `0x006d1104` before the lower public-vote support formulas run. | objdump + caller inspection + takeover and merger vote correlation |
| 324 | 0x00426260 | 607 | company_compute_board_approved_dividend_rate_ceiling | simulation | thiscall | inferred | objdump + caller inspection | 4 | Computes one nonnegative per-share dividend ceiling for the selected company. The helper starts from the current support or governance lane `0x2329/0x0d`, normalizes that value by the current outstanding-share band at `[this+0x47]`, then scans a bounded recent-year window relative to the founding year `[this+0x157]` and current scenario year `[0x006cec78+0x0d]`, taking minima from the shareholder-facing slots `0x2b` and `0x2c`. In the early-company path it also folds in `[this+0x57]` and the previous-year slot `0x1c`, applies several scale constants, and clamps the result at zero before returning the final per-share ceiling. Current grounded shell caller is `shell_company_detail_handle_change_dividend_rate_dialog_message` at `0x004c5140`, where this is the direct board-approval limit behind localized id `991` when the player tries to raise the dividend too far. | objdump + caller inspection + dividend-ceiling correlation |
| 325 | 0x004273c0 | 132 | company_repurchase_public_shares_and_reduce_capital | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Repurchases one caller-supplied quantity of public shares and reduces company capital accordingly. The helper converts the share count into one cash-side total through the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` and fixed market-scale constants, posts the resulting negative amount into company stat slots `0x0c` and `0x0d` through `0x0042a080` and `0x0042a040`, and subtracts the same share count from the outstanding-share field `[this+0x47]`. Current grounded callers are the `CompanyDetail.win` stock-buyback flow at `0x004c46d0` and the annual finance-policy helper at `0x00401c50`, where it contributes the RT3.lng `2887` repurchase headline. | objdump + caller xrefs + callsite inspection + stock-buyback correlation + annual-finance correlation |
| 326 | 0x00427450 | 224 | company_issue_public_shares_and_raise_capital | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Issues one caller-supplied quantity of public shares and increases company capital. When the optional pricing flag is clear, the helper derives one implied share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, the current company credit-rating score at `0x00425320`, and fixed underwriting constants; when the flag is set it reuses the caller-supplied scalar instead. It then posts the resulting proceeds into company stat slot `0x0c`, records the issued-share quantity in stat slot `0x0d`, snapshots the prior current-issue packed calendar tuple from `[this+0x16b/+0x16f]` into `[this+0x173/+0x177]`, writes the active world tuple from `[0x006cec78+0x0d/+0x11]` back into `[this+0x16b/+0x16f]` when taking the derived-pricing lane, and increases the outstanding-share field `[this+0x47]` by the issued quantity. Current grounded callers are the `CompanyDetail.win` stock-issue flow at `0x004c3f30` and the annual finance-policy helper at `0x00401c50`, where it contributes the debt-refinance-plus-borrowing and straight new-borrow capital side. | objdump + caller xrefs + callsite inspection + stock-issue correlation + annual-finance correlation + calendar-tuple-stamp correlation |
| 327 | 0x00427540 | 76 | company_compute_bond_interest_rate_quote | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Computes one company-specific bond interest-rate quote from the requested term and current credit or rate state. When the company is active it combines the current company credit-rating score from `0x00425320`, the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, and one term-dependent adjustment from the caller-supplied year span, then returns the resulting float rate; otherwise it falls back to `1.0`. Current grounded caller is `company_issue_bond_and_record_terms` `0x004275c0`, where this helper supplies the quoted rate when the caller does not already provide one. | objdump + caller xrefs + callsite inspection + bond-rate correlation + credit-rating correlation + prime-rate correlation |
| 328 | 0x004275c0 | 255 | company_issue_bond_and_record_terms | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Issues one new bond and appends its term record to the live company debt table. The helper first rejects companies already at the `0x14` bond-slot cap, computes or accepts one quoted interest rate through `company_compute_bond_interest_rate_quote` `0x00427540`, posts the bond proceeds into company stat slot `0x0c`, posts the principal into stat slot `0x12`, posts the coupon rate into stat slot `0x0d`, and then writes one new three-dword bond record into the next 12-byte entry rooted at `[this+0x5f]`: principal, maturity year, and quoted rate. It increments the bond count at `[this+0x5b]` and returns success. Current grounded callers are the `CompanyDetail.win` bond-issue flow at `0x004c3890` and the annual finance-policy helper at `0x00401c50`, where it supplies both straight new borrowing and refinance-plus-borrow follow-ons. | objdump + caller xrefs + callsite inspection + bond-issue correlation + annual-finance correlation |
| 329 | 0x00426890 | 68 | company_find_collection_index_by_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`. | objdump + caller inspection + company collection correlation |
| 330 | 0x004268e0 | 103 | company_refresh_post_load_year_clamp_and_runtime_support_fields | simulation | thiscall | inferred | objdump + local disassembly + company-load correlation | 3 | Per-company load-side follow-on beneath the live company collection bundle refresh. The helper clears runtime support dwords `[this+0x0d3a]` and `[this+0x0d3e]`, then clamps founding-year lane `[this+0x157]` into the active scenario-year band rooted at `[0x006cec78+0x05/+0x0d]`. Current grounded caller is `company_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x00429af0`, so this is the safest current read for the post-load company year clamp and runtime support reset rather than a shell-side finance helper. | objdump + local disassembly + company-load correlation + field-reset correlation |
| 331 | 0x00426be0 | 53 | company_can_purchase_territory_access_rights | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt. | objdump + caller inspection + RT3.lng strings + territory-flag correlation |
| 332 | 0x00426d60 | 393 | company_deactivate_and_clear_chairman_share_links | simulation | thiscall | inferred | objdump + caller inspection + collection-state correlation | 4 | Runs the destructive selected-company clear path currently reached from `CompanyDetail.win`. The helper first rejects inactive companies through `[this+0x3f]`, then zeroes all active-chairman share holdings for this company across `0x006ceb9c`, clears the linked chairman backpointer `[company+0x3b]` and the profile-side owning-company field `[profile+0x1dd]`, clears the selected-company latch when the scenario currently points at this company, marks the company inactive by zeroing `[company+0x3f]`, and walks two live collections to drop or invalidate remaining references that still point back to this company. The tail then rebuilds one local name block from `[company+0x4]` and publishes the change through the scenario-state helper at `0x004360d0`. Current grounded shell caller is the `0x9493` section-0 control under `shell_company_detail_window_handle_message`, so current best meaning is a company deactivation or liquidation-style clear path rather than an ordinary governance vote helper. | objdump + caller inspection + collection-state correlation + CompanyDetail control correlation |
| 333 | 0x00426ef0 | 43 | company_get_linked_chairman_profile_record | simulation | thiscall | inferred | objdump + caller inspection | 4 | Resolves the linked chairman profile record for one company. The helper reads the linked chairman id from `[this+0x3b]`, validates it against the live profile collection at `0x006ceb9c`, and returns the resolved profile record through `0x00518140`; zero or invalid ids return null. Current grounded callers include the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the direct bridge from a selected company to the chairman profile used for ownership and governance text. | objdump + caller inspection + chairman-link correlation |
| 334 | 0x0042a0e0 | 77 | company_query_highest_coupon_bond_slot_index | simulation | thiscall | inferred | objdump + caller inspection + debt-record layout correlation | 3 | Returns the live bond-slot index with the highest coupon rate from the debt table rooted at `[this+0x5f]`. The helper walks the current bond count at `[this+0x5b]`, compares each slot's rate field at `[this+0x67 + slot*0xc]`, and returns the zero-based index of the strongest surviving slot or `-1` when no bond slots are live. Current grounded caller is the annual finance-policy helper at `0x00401c50`, where this picks the reference bond used by the build-`1.03+` stock-issue lane before it checks current cash against that slot's principal plus a small fixed buffer. | objdump + caller inspection + debt-record layout correlation + annual-finance correlation |
| 335 | 0x0042a040 | 55 | company_add_delta_into_stat_series_and_current_slot | simulation | thiscall | inferred | objdump + caller xrefs + field-write correlation | 3 | Adds one caller-supplied float delta into the company stat-family series lane selected by the requested slot id. The helper increments both the year-indexed series rooted at `[this+0x0d7f]` and the current aggregate lane rooted at `[this+0x1c47]`, but does not touch the broader cash-side shadow totals. Current grounded callers include bond repayment `0x00423d70`, bankruptcy `0x00425a90`, stock buyback `0x004273c0`, territory-access purchase `0x004c5fc9`, and several placement or world-service mutations, so this now reads as the shared company stat poster without the optional cash-side follow-on. | objdump + caller xrefs + field-write correlation + finance-mutator correlation |
| 336 | 0x0042a080 | 95 | company_add_delta_into_stat_series_current_slot_and_optional_cash_totals | simulation | thiscall | inferred | objdump + caller xrefs + field-write correlation | 3 | Adds one caller-supplied float delta into the selected company stat-family lane, exactly like `company_add_delta_into_stat_series_and_current_slot` `0x0042a040`, and optionally mirrors the same delta into the broader cash-side shadow totals when the third argument is nonzero. The shared stat writes still land in the year-indexed series rooted at `[this+0x0d7f]` and current aggregate lane `[this+0x1c47]`; the optional follow-on also increments the cash-pair totals at `[this+0x11f7]` and `[this+0x1caf]`. Current grounded callers include stock buyback `0x004273c0`, chairman-salary and dividend policy paths around `0x00427920`, linked world-service updates, and several company-side cash or capital mutators, so this is the stronger shared company stat poster when cash-side shadow totals must stay synchronized. | objdump + caller xrefs + field-write correlation + cash-pair correlation + finance-mutator correlation |
| 337 | 0x0042a2e0 | 645 | company_read_control_transfer_metric_slot | simulation | thiscall | inferred | objdump + caller inspection | 3 | Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader. | objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation |
| 338 | 0x0042a5d0 | 131 | company_read_year_or_control_transfer_metric_value | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula. | objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation |
| 339 | 0x0042c690 | 311 | placed_structure_rebuild_candidate_cargo_service_bitsets | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. The cargo-id sweep is tighter now too: the inner loop starts at cargo id `1` and runs upward through the current live cargo count, so this steady-state bitset owner never intentionally queries cargo id `0`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path. | objdump + caller xrefs + callsite inspection + cargo-summary correlation + cargo-id-loop correlation |
| 340 | 0x0042c8f0 | 112 | placed_structure_refresh_linked_candidate_flag4 | map | thiscall | inferred | objdump + caller xrefs + linked-instance inspection | 3 | Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild with candidate byte `[candidate+0xba]` kept at the raw-flag level. | objdump + caller xrefs + linked-instance inspection + candidate-flag correlation |
| 341 | 0x0042cab0 | 117 | placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link | map | thiscall | inferred | objdump + caller inspection + route-style remap inspection | 3 | Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests. | objdump + caller inspection + route-style remap inspection + peer-link emission correlation |
| 342 | 0x0042cb30 | 124 | placed_structure_clamp_candidate_service_age_table | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper. | objdump + caller xrefs + callsite inspection + route-age correlation |
| 343 | 0x0042cbb0 | 145 | placed_structure_route_supports_candidate_local_service_mode | map | thiscall | inferred | objdump + caller xrefs + route-record inspection | 3 | Boolean route-linked predicate for one candidate-local service branch. The helper walks the route or service record chain owned by the current site through `[this+0x0d4]` and collection `0x006cec20`, reads one candidate-indexed float lane at `[route+0x3e]`, and compares the route-side threshold at `[route+0x112]` against the current local word-table value for that candidate after scaling through `0x00437d20`. It returns `1` on the first matching route record and `0` otherwise. Current grounded caller is `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, where this predicate selects one of the route-backed scoring transforms. | objdump + caller xrefs + route-record inspection + candidate-table correlation |
| 344 | 0x0042cc50 | 402 | placed_structure_apply_route_linked_service_caps | map | thiscall | inferred | objdump + caller xrefs + route-record inspection | 3 | Route-linked cap pass over the aligned local service tables. The helper walks the route or service record chain rooted at `[this+0x0d4]` through `0x006cec20`, then for each live non-remapped candidate that passes `structure_candidate_is_enabled_for_current_year` it compares the route-side candidate float at `[route+0x42]` against the current site float table at `[this+0x107]` and the current primary word-table value at `[this+0x00]`. When the route-linked ratio stays inside the live clamp window it writes a lower capped value back into the primary word table. Current grounded caller is the composite local refresh `0x0042d580`, so this now looks like the first route-backed cap pass that shapes the rebuilt local service tables before the later neighborhood redistribution and recent-service clamp run. | objdump + caller xrefs + route-record inspection + local-table correlation |
| 345 | 0x0042cdf0 | 16 | placed_structure_refresh_candidate_service_state | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Tiny composite refresh for one placed-structure or site record. The helper first rebuilds the candidate cargo-service bitsets through `placed_structure_rebuild_candidate_cargo_service_bitsets` at `0x0042c690`, then tail-calls `placed_structure_refresh_linked_candidate_flag4` at `0x0042c8f0` to refresh the sibling state bit at `[this+0x0e6]`. Current grounded callers include the world-grid sweep at `0x00450003`, so this now looks like the common steady-state placed-structure service-state refresh immediately above the editor-driven cargo runtime tables. | objdump + caller xrefs + wrapper inspection |
| 346 | 0x0042ce00 | 1394 | placed_structure_rebuild_candidate_local_service_tables | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Large per-site rebuild over the live candidate collection at `0x0062ba8c`. The helper walks every candidate with live runtime state at `[collection+0x16e]` and no remap entry at `[collection+0x9a]`, decays positive floats in the aligned per-candidate table rooted at `[this+0x107]`, and commits those float updates back through `0x0041e1b0`. It then combines that float table with two aligned per-candidate word tables rooted at `[this+0x02]` and `[this+0x6c]`, the direct-supply cargo bitset at `[this+0x0df]`, the site-side latch at `[this+0x0d4]`, and the branch predicate `0x0042cbb0` to choose among several normalized scoring transforms before writing the quantized result back into the destination word table. Current grounded callers now put this directly under the local wrapper at `0x0042d580`, so this looks like the first real site-side candidate service-score rebuild above the editor-driven cargo runtime lane rather than another candidate-only helper. | objdump + caller xrefs + callsite inspection + table-layout correlation |
| 347 | 0x0042d580 | 26 | placed_structure_refresh_local_service_score_bundle | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Composite local-service refresh for one placed-structure or site record. The helper first runs `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, then immediately chains into the neighboring local post-passes at `0x0042cc50`, `0x0042c1b0`, and `0x0042cb30` before returning. Current grounded caller is the world-grid sweep at `0x00450110`, which uses this as the stronger per-site local-service refresh after the lighter cargo-service-state pass at `0x00450003`. | objdump + caller xrefs + wrapper inspection |
| 348 | 0x00428a10 | 22 | company_clear_selected_chairman_if_current_profile | simulation | thiscall | inferred | objdump + caller inspection | 4 | Clears the linked chairman for the current company when the supplied profile id matches `[this+0x3b]`. On a match the helper zeroes the incoming profile id and tail-calls `0x00427c70`; otherwise it returns without changing company state. Current grounded shell caller is `shell_company_detail_resign_chairmanship_flow`, which uses this as the commit step behind the localized resignation confirmation. | objdump + caller inspection + chairman-link correlation |
| 349 | 0x00425320 | 607 | company_compute_credit_rating_score | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 4 | Computes the bounded company credit-rating score reused by the debt-side shell and several adjacent company-policy gates. The helper returns a fixed floor when the company-active flag at `[this+0x3f]` is clear; otherwise it starts from a weighted four-year net-profits-minus-fuel ladder over slots `0x2b` and `0x09`, blends in the current debt total from stat-family `0x2329/0x12`, folds in the weighted average bond interest rate through `company_compute_weighted_average_bond_interest_rate` `0x00423e40`, conditionally adds the prime-rate baseline and raw issue-39 total through `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, then derives several debt- or liquidity-side ratios from derived stat slots `0x30` and `0x31` before applying company-age smoothing. The tail then adds the raw issue-38 total through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`, rounds the result, and uses that bounded score both for the CompanyDetail credit row and for bond-offer gating. Current grounded callers are the city-connection news owner `0x00406050`, the bond-interest quote wrapper `0x00427540`, the bond-side boolean gate `0x00427590`, the generic derived-metric reader at `0x0042a2e0` for the credit-rating-style slot, the CompanyDetail debt-credit-rate summary panel `0x004c23a0`, and the CompanyDetail bond-issue flow `0x004c3890`. The surrounding text anchors are explicit: shell localized id `952` is `Credit Rating:`, and localized id `974` says new bonds require a strong enough credit rating. This is therefore the safest current read for the debt-market or creditworthiness score, distinct from the issue-39 prime-rate lane and from the broader issue-37 equity-support lane. | objdump + caller xrefs + callsite inspection + RT3.lng strings + credit-rating correlation + bond-dialog correlation + prime-rate contrast + issue-38 correlation |
| 350 | 0x00424fd0 | 751 | company_compute_public_support_adjusted_share_price_scalar | simulation | thiscall | inferred | objdump + caller inspection | 3 | Computes one bounded investor-support and share-price scalar used by stock-capital policy, cached share-price readouts, and adjacent governance or control-transfer vote lanes. The helper starts from `company_compute_cached_recent_per_share_performance_subscore` at `0x004248d0`. If the older company-side support field `[this+0x57]` is still at least as strong as that fresh score and the company is within five years of founding year `[this+0x157]`, it interpolates the two through a capped startup-progress term derived from the current world calendar counter `[0x006cec78+0x15]`, the company stamp `[this+0x0d07]`, and the founding year, with the progress side capped at `50`; otherwise it keeps the fresh per-share score directly. The first caller argument is then normalized by current outstanding shares `[this+0x47]` and clamped into the narrow pressure band `[-0.2, 0.2]`. When the caller supplies nonzero control arguments, that pressure term can also refresh the mutable support field `[this+0x4f]` by blending the prior field with the staged delta. The later share-price body is tighter now too: it derives a share-count growth term from outstanding shares through the power helper `0x005a1b60` on `(shares / 20000)^0.33`, scales that by `1.4`, folds it back against current shares, and then runs a piecewise compression or clamp ladder over the resulting support scalar at thresholds `0.6`, `0.45`, `0.3`, `1.7`, `2.5`, `4.0`, and `6.0`. After that it multiplies by the scenario issue-opinion multiplier from `scenario_state_compute_issue_opinion_multiplier` `0x00436590` using issue id `0x37`, rounds through `0x005a10d0`, floors the rounded result at `0.0001`, and optionally snapshots it into the cached share-price field `[this+0x0d7b]` when the second control argument is nonzero. Current grounded callers include the cached share-price accessor `0x00423eb0`, the stock buyback and stock issue mutators `0x004273c0` and `0x00427450`, the bankruptcy recompute path `0x00425a90`, the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual creditor-pressure or shareholder-policy lane that surfaces localized ids `300..304`. The surrounding finance split is now tighter too: `company_compute_credit_rating_score` `0x00425320` feeds the explicit `Credit Rating` shell rows and bond-offer rejection flow, while `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds the explicit `Prime Rate` row and cash interest helpers. That leaves issue `0x37` as the broader equity-market or investor-confidence lane behind company or chairman performance. The strongest direct text anchors are still localized ids `300/301` `Shareholders revolt against poor management`, `1217` `Investors are somewhat pleased with the chairman's performance.`, and `3048/3049` `Investors are %1 your performance./the chairman's performance.`. A deeper follow-up now rules out three tempting label shortcuts: the nearby `0x460a90..0x460c53` and `0x473620..0x47366a` registration families are camera-view and related shell-command bindings, not finance issue owners; the editor-side `Stock Prices` label belongs to the separate float-tuning block `[state+0x0bde..0x0bf6]`, not the issue table behind `0x37`; and the extracted `CompanyDetail.win` shell resource from `rt3_2WIN.PK4` does not expose any separate plain-English investor or finance caption for this lane, which matches the owner-side read that section-0 is a dynamic text widget (`0x947f`) fed by `shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a fixed label row. | objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation + stock-buyback correlation + stock-issue correlation + share-price-cache correlation + per-share-performance correlation + pressure-band correlation + startup-interpolation correlation + power-helper correlation + credit-vs-prime-rate correlation + negative-label-owner correlation + shell-resource extraction negative-result |
| 351 | 0x00424580 | 82 | company_compute_prime_rate_from_issue39_scenario_baseline | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Small company-side rate helper that produces the current prime-rate-style baseline from scenario state plus issue `0x39`. It first reads one normalized scenario baseline through `0x00433740` on active scenario state `0x006cec78`, then adds the scaled raw issue-39 total from `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` using the current company id `[this+0x00]`, linked chairman id `[this+0x3b]`, and no territory argument. Current grounded callers now bound the player-facing meaning more tightly: the bond-interest quote wrapper at `0x00427540`, the negative and positive cash interest helpers at `0x00425880` and `0x004258c0`, and the CompanyDetail capital summary row labeled `954` `Prime Rate:` at `0x004c23a0`. This now reads as the shared prime-rate or market-rate helper rather than a generic company-support scalar. | objdump + caller xrefs + callsite inspection + issue-39 correlation + prime-rate correlation + bond-quote correlation |
| 352 | 0x004246b0 | 544 | company_compute_five_year_weighted_shareholder_return | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Computes the stock-data lane surfaced as `5 Year Weighted Return`. Inactive companies fall back to the fixed scalar at `0x005c8598`; otherwise the helper walks up to five recent years above founding year `[this+0x157]`, samples yearly `Share Price` from slot `0x1c`, measures year-over-year price appreciation against the prior sample, blends that with the paired historical shareholder-payout lane from slot `0x23`, and weights recent years more heavily through the same scenario-side year weighting byte at `[0x006cec78+0x0f]`. Current evidence now bounds that paired lane more tightly: slot `0x23` falls back to direct company field `[this+0x53]` on the current-company path and is only consumed here, so the strongest current read is the historical dividend-per-share or shareholder-payout component paired with yearly price appreciation. The tail normalizes the accumulated weighted return by the accumulated weights and returns one bounded annualized-style float. Current grounded caller is `company_read_control_transfer_metric_slot` at `0x0042a2e0` for slot `0x21`, which matches the stock-data label `942` `5 Year Weighted Return:` and tooltip `936`. | objdump + caller inspection + RT3.lng strings + stock-data-label correlation + weighted-return correlation + shareholder-payout-lane correlation |
| 353 | 0x00425880 | 64 | company_compute_negative_cash_balance_interest_rate | shell | thiscall | inferred | objdump + LoadScreen report correlation + localized string correlation | 4 | Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows. | objdump + LoadScreen report correlation + localized string correlation + helper call inspection + prime-rate correlation |
| 354 | 0x004258c0 | 396 | company_compute_positive_cash_balance_interest_rate | shell | thiscall | inferred | objdump + LoadScreen report correlation + localized string correlation | 4 | Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same prime-rate helper at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows. | objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation + prime-rate correlation |
| 355 | 0x00429c70 | 976 | company_read_derived_financial_report_metric_slot | simulation | thiscall | inferred | objdump + caller inspection + shell-label correlation | 3 | Reads one derived company metric from the higher report-style slot family rooted at `0x2b`. The jump-table body now has one safe finance-side core: slot `0x2c` sums raw slots `0x01..0x04` into the broader revenue aggregate, slot `0x2d` combines the neighboring expense-side derived lanes, and slot `0x2b` then combines `0x2c` and `0x2d` into the net-profits-style lane reused by shell labels `1212` `Profits`, `925` `Profits:`, and the annual finance policy. The same helper also owns several later derived ratios and aggregates, including one asset-side pair around `0x30/0x31` and the per-unit revenue lanes that divide the revenue aggregate `0x2c` by count or distance slots such as `0x24`, `0x16`, and `0x17`. Current grounded callers arrive indirectly through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, so this is the shared derived financial-report metric reader beneath CompanyDetail, LoadScreen, and annual finance rather than a shell-only formatter helper. | objdump + caller inspection + shell-label correlation + derived-metric correlation + income-statement correlation |
| 356 | 0x00429950 | 42 | company_collection_construct | simulation | thiscall | inferred | objdump + world-load correlation + local disassembly | 3 | World-load constructor for the live company collection later rooted at `0x0062be10`. The helper seeds the indexed-collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0x7684, initial_slots=5, growth=5, id_base=1)`, installs vtable `0x005c9bf8`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting collection is stored into global `0x0062be10`. | objdump + world-load correlation + local disassembly + constructor-parameter reconstruction |
| 357 | 0x00429980 | 11 | company_collection_release_entries_and_collection_storage | simulation | thiscall | inferred | objdump + world-shutdown correlation + local disassembly | 2 | Release-side companion to `company_collection_construct` `0x00429950`. The helper reinstalls vtable `0x005c9bf8` and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip inside `0x00434300`, which releases global `0x0062be10` with the other typed runtime collections. | objdump + world-shutdown correlation + local disassembly + companion correlation |
| 358 | 0x00429990 | 86 | company_collection_get_nth_active_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows. | objdump + caller inspection + active-company roster correlation |
| 359 | 0x004299f0 | 84 | company_collection_count_active_companies_before_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`. | objdump + caller inspection + active-company roster correlation |
| 360 | 0x00429a50 | 62 | company_collection_count_active_companies | simulation | thiscall | inferred | objdump + caller inspection | 4 | Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math. | objdump + caller inspection + active-company roster correlation |
| 361 | 0x00429af0 | 118 | company_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle | simulation | thiscall | inferred | objdump + world-load correlation + local disassembly + tag correlation | 3 | Bundle-load owner for the live company collection `0x0062be10`. The helper reads tagged sections `0x61a9/0x61aa/0x61ab` through repeated `0x00531360` calls, refreshes the indexed-collection header through `0x00518680`, and then walks every live company entry dispatching each record through `0x004268e0` with the active bundle handle before closing the final tag. Current grounded caller is the world-entry bring-up family, where this helper refreshes the live company records from the tagged bundle after collection construction. | objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation |
| 362 | 0x00429b90 | 92 | company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle | simulation | thiscall | inferred | objdump + package-save correlation + local disassembly + tag correlation | 3 | Package-save sibling for the live company collection `0x0062be10`. The helper opens tagged sections `0x61a9/0x61aa/0x61ab` through repeated `0x00531340` calls, serializes the indexed-collection header through `0x00517d90`, and then walks every live company entry dispatching each record through the current no-op payload callback `0x00424000` before closing the final tag. Current grounded caller is the package-save path that persists the live runtime collections beside the other world roots. | objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation |
| 363 | 0x00430270 | 225 | world_try_place_random_structure_batch_from_compact_record | map | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Shared world-side retry loop that tries to place multiple structures from one compact spawn record. The caller supplies one small record whose fields now read most safely as a structure or profile token at `+0x00`, requested placement count at `+0x11`, center coordinates at `+0x12/+0x14`, and placement radius or extent at `+0x16`. The helper translates the token through the static table at `0x0061039c` into the live structure-profile collection `0x0062b268`, increments the region-manager reentrancy counter at `[0x0062bae0+0x88]`, and then runs up to `200` randomized attempts while placements remain. Each attempt samples a candidate coordinate inside the requested radius, rejects points outside the live world bounds at `[0x0062c120+0x2155/+0x2159]`, resolves the owning region through `0x0044a800` and `0x0062bae0`, adapts the candidate through `0x00412880`, and finally re-enters `world_region_validate_and_commit_candidate_placement` `0x00422a70`. Successful placements decrement the remaining batch count and reset the local retry counter. Current grounded caller is the world-side dispatch branch at `0x00431b43`, where only compact record classes in the `0x1f7..0x265` table range enter this batch placer. This is therefore the strongest current read for the world-side randomized structure-batch placement loop rather than a region-worker-private helper. | objdump + local disassembly + caller correlation + placement-batch correlation |
| 364 | 0x00430b50 | 624 | scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Builds one runtime-effect record in the live scenario event collection from a compact source record plus the caller's currently resolved targets. The helper first allocates a new runtime-effect entry through `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`, then seeds several per-record control bytes and target selectors in the new object, including mode byte `[record+0x7ef]`, optional gating bytes `[record+0x7f4/+0x7f9/+0x7fa]`, a primary selector at `[record+0x7f0]`, and optional comparison ids at `[record+0x82c/+0x830]`. Current grounded callers are the compact runtime-effect dispatcher `0x00431b20`, where fallback branches synthesize follow-on runtime effects from one compact linked record, and the shell-side branch at `0x004d60fd`, where the same builder is reached with a caller-owned output slot. This is therefore the current safest read for the runtime-effect follow-on record builder rather than a generic collection insert wrapper. | objdump + local disassembly + caller correlation + runtime-effect-builder correlation |
| 365 | 0x00430d70 | 990 | scenario_event_serialize_runtime_record_into_packed_state | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Per-record save-side companion to `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` beneath the `.smp` event-collection serializer `0x00433060`. The helper first re-enters `0x0042d820` six times with clear-side flag `0` over the same fixed text bands rooted at `[record+0x0e0]`, `[+0x401]`, `[+0x4ca]`, `[+0x593]`, `[+0x65c]`, and `[+0x725]`, then counts the standalone linked runtime-condition row chain at `[record+0x00]` and the four grouped runtime-effect row chains rooted at `[record+0x04/+0x08/+0x0c/+0x10]`. It writes per-family version marker `0x526f`, serializes each `0x1e` condition row with its scalar and byte fields plus the optional resolved candidate-name side string for bounded candidate-id ranges, emits grouped-row marker `0x4eb8` plus the four per-slot counts, and then serializes each `0x28` grouped row with the same version-gated field extension seen on restore, including the optional linked locomotive-name side string for bounded locomotive-id ranges before the later grouped remap and write-side branches continue. Current grounded caller is `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`, so this is the safest current read for one live event's packed-state serializer rather than a broader collection walk. | objdump + local disassembly + caller correlation + event-record-save correlation + condition-row-and-effect-row correlation |
| 366 | 0x00431b20 | 399 | world_apply_compact_runtime_effect_record_to_resolved_targets | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Dispatches one linked compact runtime-effect record against the caller-resolved target context. The record token at `[*record+0x00]` is translated through the static table at `0x0061039c`; when the translated class lies in the `0x1f7..0x265` range the helper immediately re-enters `world_try_place_random_structure_batch_from_compact_record` `0x00430270`. Otherwise it jumps through the local class table at `0x004320b4/0x004320fc` into a mixed effect family that now includes: shell-state modifier branches over `0x006cec78`, signed scalar adjustments on resolved company/profile/territory targets through the `0x004d6611/0x004d6617` numeric readers, territory-access writes through `company_set_territory_access_rights_byte` `0x00424030`, selected-profile updates through `0x00434890/0x004348c0`, and several collection-side erase or follow-on branches. Current grounded caller is the outer loop at `0x00432317`, which walks linked compact records via `[record+0x24]` and supplies optional resolved company, chairman-profile, and adjacent owner context before each dispatch. This is therefore the current safest read for the wider compact runtime-effect dispatcher above the separate world-side structure-batch placement branch rather than as a placement-only helper. | objdump + local disassembly + caller correlation + effect-dispatch correlation |
| 367 | 0x004323a0 | 842 | scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Per-record service pass over one live runtime-effect record in the scenario event collection. The helper first enforces several activation gates over the record's local control bytes and shell-side preview state, including one one-shot latch at `[this+0x81f]`, mode byte `[this+0x7ef]`, optional preview-policy byte `[this+0x7f4]`, and shell-side state at `0x006cec78/0x006cec74`. Once active it formats the optional status line through shell news helper `0x004554e0`, derives a target-availability bitmask through `0x0042d700`, resolves optional company/chairman/territory target pools, and then walks the linked compact effect chain rooted at `[this+0x00]`. Each linked record is dispatched through `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, while fallback branches synthesize follow-on runtime-effect records through `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50`. When any effect fires it may refresh company share-price caches through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, and records with nonzero `[this+0x7f5]` set the one-shot latch `[this+0x81f]`. Current grounded caller is the collection-wide service loop `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40`. This is therefore the current safest read for the runtime-effect record service and linked-effect dispatcher rather than a low-level target iterator. | objdump + local disassembly + caller correlation + runtime-effect-service correlation |
| 368 | 0x00433060 | 198 | scenario_event_collection_serialize_runtime_records_into_packed_state | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide save-side companion to `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130` for the live event collection at `0x0062be18`. The helper opens chunk `0x4e99`, writes fixed version dword `0x3e9`, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and first re-enters `scenario_event_prepare_runtime_record_text_bands_for_packed_state_save` `0x0042da90` on each record. It then uses `0x00517d90` to emit the collection-side packed metadata, opens chunk `0x4e9a`, walks the same live records again through the same indexed-collection helpers, and re-enters `scenario_event_serialize_runtime_record_into_packed_state` `0x00430d70` on each one before closing with chunk `0x4e9b`. Current grounded caller is the `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240`, so this is the safest current read for the event-side packed-state save owner rather than an anonymous collection walk. | objdump + local disassembly + caller correlation + event-collection-save correlation |
| 369 | 0x00433130 | 169 | scenario_event_collection_refresh_runtime_records_from_packed_state | scenario | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper opens chunk `0x4e99`, reads one fixed header dword from the caller-supplied state or stream object, re-enters the collection-side metadata refresh at `0x00518680`, then opens chunk `0x4e9a`, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record before closing chunk `0x4e9b`. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk. | objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation + chunk-family correlation |
| 370 | 0x004336d0 | 95 | world_runtime_reset_startup_dispatch_state_bands | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Small runtime-object zero-init helper immediately above `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`. The helper clears a bounded startup-owned state band on the caller object, including `[+0x4cae]`, `[+0x4cb2]`, `[+0x46a80..+0x46aa0]`, `[+0x66b2]`, `[+0x66b6]`, `[+0x46c34]`, and `[+0x66ae]`, then returns the same pointer. Current grounded callers are the mode-`4` `LoadScreen.win` lane inside `shell_transition_mode` at `0x004830b6` and the multiplayer preview launch lane at `0x0046b8c9`, both of which then publish the returned object into `0x006cec78` and immediately call `0x00438890`. This is therefore the safest current read for the pre-dispatch runtime reset helper rather than another world-release path. | objdump + caller xrefs + local disassembly + pre-dispatch-state correlation |
| 371 | 0x00433730 | 1 | world_runtime_release_followon_noop_placeholder | map | cdecl | inferred | objdump + local disassembly + caller correlation | 1 | Single-instruction `ret` placeholder immediately beside `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`. Current grounded caller is the old-active-mode teardown branch inside `shell_transition_mode` `0x00482ec0`, where it contributes no observable release work between `world_runtime_release_global_services` `0x00434300` and the common free path `0x0053b080`. This is therefore the safest current read for a no-op followon placeholder rather than a meaningful runtime teardown owner. | objdump + local disassembly + caller correlation |
| 372 | 0x00432ea0 | 103 | scenario_event_collection_allocate_runtime_effect_record_from_compact_payload | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Allocates and initializes one live runtime-effect record in the scenario event collection at `0x0062be18` from a compact payload source. The helper allocates one temporary `0x88f` payload object, inserts a new collection entry through the generic collection allocator path, resolves the inserted live entry, and then initializes that entry from the caller-supplied compact payload through `0x0042d670` before freeing the temporary object. Current grounded callers are `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50` and the shell-side branch at `0x004db9f1`, where the returned live entry id is stored back into the caller object. This is therefore the current safest read for the scenario event collection's runtime-effect allocator rather than a generic collection clone helper. | objdump + local disassembly + caller correlation + runtime-effect-allocation correlation |
| 373 | 0x00432f40 | 267 | scenario_event_collection_service_runtime_effect_records_for_trigger_kind | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide service loop over the live scenario event collection at `0x0062be18` for one caller-selected trigger kind byte. The helper first rejects fast-forward and editor-map gates through `0x006cec78+0x46c38`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x68]` unless the trigger kind is `9`, then walks every live runtime-effect record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Each resolved record is serviced through `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` `0x004323a0` with the selected trigger kind and optional text sink. When any record fires, the helper refreshes every active company's cached share price through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`; when the collection dirty latch at `[this+0x88]` is raised it clears that latch and immediately reruns the whole pass with trigger kind `0x0a`. The caller split is now tighter too: recurring simulation maintenance drives kinds `1`, `0`, `3`, and `2` through `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3`, while the neighboring route-style follow-on at `0x0040a91f` drives kinds `5` and `4` through `0x0040a930` and `0x0040a9ac`; world or startup-side company creation branches at `0x00407682`, `0x0047d293`, `0x0047d42b`, and `0x0047d6de` drive kind `7`; the kind-`6` branch is now tighter too, covering the placed-structure post-create tail at `0x0040f69e`, the build-version-gated company-startup or roster-refresh tail at `0x00428406`, and the route-entry post-change sweep at `0x004a3eae`; the kind-`8` world-entry one-shot gate now sits inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where it fires after the post-load company or route setup passes and then clears shell-profile latch `[0x006cec7c+0x97]`; and the `LoadScreen.win` briefing page at `0x004e520b` drives kind `9`. This is therefore the current safest read for the scenario event collection's collection-wide runtime-effect service loop rather than a generic text-query helper. | objdump + local disassembly + caller correlation + collection-service correlation + trigger-kind callsite decode |
| 374 | 0x00433bd0 | 546 | world_refresh_selected_year_bucket_scalar_band | simulation | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads packed year word `[this+0x0d]`, walks the 21-entry threshold ladder rooted at `0x005f3980`, and chooses either the first bucket baseline at `0x005f3984`, the terminal bucket scalar at `0x005f3a24`, or one interpolated scalar between the paired `(year,value)` table entries at `0x005f3978/0x005f3980`. It then rebuilds the dependent selected-year float band in two layers. First it seeds the direct bucket trio `[this+0x65/+0x69/+0x6d]` from three fixed multipliers of that chosen scalar. It next derives three normalized complement lanes `[this+0x71/+0x75/+0x79]` from that trio after the build-version-sensitive clamp through `0x00482e00(0x006cec74)`, and three additional scaled companion lanes `[this+0x7d/+0x81/+0x85]` from the same direct trio. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on. | objdump + local disassembly + caller inspection + threshold-ladder correlation + year-bucket-table correlation + world-entry correlation + direct-trio correlation + complement-lane correlation |
| 375 | 0x00433f02 | 28 | scenario_state_roll_pending_float_0x4caa_into_accumulator_0x4ca6 | map | thiscall | inferred | objdump + local disassembly + field xrefs | 3 | Tiny scenario-state accumulator rollup over the late world-state float pair `[this+0x4ca6]` and `[this+0x4caa]`. The helper adds the pending lane `[this+0x4caa]` into accumulator `[this+0x4ca6]`, clears `[this+0x4caa]` back to zero, and returns. Current field evidence grounds the relationship too: the periodic support-side branch at `0x0041144f` accumulates live deltas into `[0x006cec78+0x4caa]`, while the shell-side query family at `0x0042f89b/0x0042f8bb` reads both the pending lane alone and the accumulated sum. Current grounded caller is the late world-side scalar rollup strip around `0x00433ec0`. | objdump + local disassembly + field xrefs + accumulator-rollup correlation |
| 376 | 0x00434050 | 11 | shell_has_auxiliary_preview_owner | shell | cdecl | inferred | objdump + caller inspection + side-owner correlation | 4 | Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live. | objdump + caller inspection + side-owner correlation + caller xrefs |
| 377 | 0x00434080 | 80 | scenario_state_query_cached_available_locomotive_rating_clamped_for_shell | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small read-side helper over cached scenario-state float `[this+0x4cbe]`. The helper returns that cached available-locomotive rating in `st(0)` when it stays under the local threshold, and otherwise falls back to one fixed shell-side float constant before returning. Current grounded caller is the shell-side formatter band around `0x004b11c5`, where this cached value is optionally rounded to an integer and then compared against display thresholds `40/50/70/85/100`. This is therefore the safest current read for the query-side companion of the later locomotive-rating refresh rather than a broader world-state getter. | objdump + caller inspection + local disassembly + shell-threshold correlation + display-bucket correlation |
| 378 | 0x00434130 | 196 | scenario_state_refresh_year_gap_scalar_from_current_year_minus_1850_into_0x4ca2 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small year-derived float refresh over active scenario state `0x006cec78`. The helper subtracts literal base year `1850` from current year word `[this+0x0d]`, converts that year gap into one normalized float through fixed constants rooted at `0x005c9680`, `0x005c8770`, `0x005c9ef8`, and `0x005c8d80`, stores the first result into `[this+0x4ca2]`, then immediately reclamps the same field into the closed `1/3..1.0` range by flooring sub-threshold values to literal `0.333333...` and capping larger values at `1.0`. Current grounded callers are the periodic year-step branch at `0x0040a310`, the scenario-state reset or rebuild owner at `0x00436d10`, and the two world-entry load lanes at `0x00443edd` and `0x00444070`, so this is the safest current read for a shared year-gap-derived scenario float refresh rather than a presentation-only helper. | objdump + caller xrefs + local disassembly + year-gap correlation + clamp correction + two-stage-store correlation |
| 379 | 0x00434300 | 881 | world_runtime_release_global_services | map | cdecl | inferred | objdump + local disassembly + caller correlation | 4 | Primary old-world teardown owner for the live runtime object at `0x006cec78`. The helper first increments one local reentrancy band at `[this+0x4c93]`, then destroys and frees the two indexed world collections at `[this+0x66b2]` and `[this+0x66b6]` through `0x00518bd0` plus `0x0053b080`, clears global roots `0x0062b244`, `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, and `0x0062c120` through their typed release siblings `0x0040b720`, `0x004b23b0`, `0x00429980`, `0x00477770`, and `0x00449500`, and then tears down the map-content service roots `0x0062ba8c`, `0x006ada84`, `0x0062ba88`, `0x0062b2fc`, `0x0062b268`, `0x006cea4c`, and `0x006acd34` through `0x0041e8d0`, `0x004619b0`, `0x0041d7a0`, `0x00419680`, `0x00412a90`, `0x00473da0`, and `0x00455350` before freeing each backing object and nulling the global slot. After that typed global strip it releases the eight shell-helper handles at `[this+0x46a80..+0x46aa0]` plus the variable-length owner band rooted at `[this+0x46aa4]` through repeated `0x0053c000`, drains the linked chains at `[this+0x66a6]` and `[this+0x66aa]` through `0x0053afd0`, clears `[this+0x66ae]`, optionally re-enters `0x00516ba0` when shell gate `0x006d3b4c` is live, and finally decrements `[this+0x4c93]` before returning. Current grounded callers are the heavier world-entry branch `0x00443a50`, the sibling `.smp` world-state branch `0x00446d40`, and the old-active-mode teardown branch in `shell_transition_mode` `0x00482ec0`. | objdump + local disassembly + caller correlation + typed-global-release-order correlation |
| 380 | 0x00434d40 | 100 | placed_structure_collection_seed_candidate_subtype2_runtime_latch | map | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Shared post-setup sweep over the live placed-structure collection at `0x0062b26c`. The helper walks every live placed structure through the indexed-collection accessors, resolves each linked candidate or structure descriptor through vtable slot `+0x80`, and when the resolved record's subtype byte `[candidate+0x32]` equals `2` it writes `1` to runtime dword `[candidate+0x7b0]`. Local field evidence is now tight enough to keep the name structural: the same dword is zeroed during candidate runtime materialization around `0x00412112`, read as a one-shot guard in the world-side placement branch around `0x00423c43`, and also written there after the guarded follow-on fires. Current grounded callers are the post-fast-forward setup tail at `0x00437bf9` and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared subtype-`2` candidate-runtime latch seeder rather than a one-off world-entry patch. | objdump + local disassembly + caller correlation + candidate-runtime-latch correlation |
| 381 | 0x004354a0 | 355 | world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Shared shell-facing scalar publisher beneath selected-year changes, shell-state selector updates, and the late world-entry reactivation band. The helper always resolves the current shell presentation object through controller `0x006d4024 -> [controller+0x18]` and writes one clamped `0..255` integer into `[object+0x15]` through `0x00523d60`. Its source split is now bounded enough to name conservatively: when tutorial flag `0x006d3b4c` is live it forces `0`; otherwise it first honors the temporary shell-state selector pair `[0x006cec74+0x1df/+0x1e3]`, then the persisted selector pair `[0x006cec74+0x23b/+0x23f]` when sandbox bit `[0x006cec7c+0x82]` is set, and only when no selector override is active does it derive one interpolated scalar from the current year `[this+0x15]` against the ensured threshold band `[this+0x51/+0x55/+0x59/+0x5d/+0x61]` plus the base value at `[this+0x3a]`, re-entering `scenario_state_ensure_derived_year_threshold_band` `0x00435603` before the year-band path needs it. Current grounded callers are the simulation year-advance path at `0x0040ab39`, the shell-state setter at `0x00482878`, the startup-side branch at `0x005173d3`, and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared shell-controller progress-scalar publisher rather than a world-entry-only helper. | objdump + local disassembly + caller correlation + shell-controller correlation + year-threshold-band correlation |
| 382 | 0x004358d0 | 489 | region_collection_service_pending_connection_bonus_notifications_and_optional_company_credit | map | cdecl | inferred | objdump + local disassembly + caller inspection | 3 | World-side service pass over the live region collection at `0x0062bae0` for the transient city-connection bonus amount stored at `[region+0x276]`. The helper walks every live region, ignores entries whose pending amount is zero, and reuses `city_connection_bonus_exists_matching_peer_site` `0x00420030` with two flag variants plus `city_connection_bonus_select_first_matching_peer_site` `0x00420280` to find one matching peer site and its linked company through `placed_structure_query_linked_company_id` `0x0047efe0`. When a matching peer company exists and the first `0x420030` probe returned nonzero, it formats one localized notice using the region name at `[region+0x356]`, world scalar `[region+0x23a]`, and the current pending amount, publishes that notice through `0x004554e0`, posts the pending amount into company stat slot `4` through `company_add_delta_into_stat_series_current_slot_and_optional_cash_totals` `0x0042a080`, then clears `[region+0x276]` and stamps completion latch `[region+0x302] = 1`. When the peer-company branch is unavailable and byte `[region+0x316]` is still clear, it instead publishes one alternate localized notice built from the same pending amount and region-side world scalar, then sets that byte so the alternate notice only fires once while the pending amount remains live. Current grounded caller is the linked-site refresh tail inside `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where the helper runs beside `0x00420650` as the city-connection bonus sidecar service rather than as a generic region sweep. | objdump + local disassembly + caller inspection + city-connection correlation + company-credit correlation |
| 383 | 0x00435b50 | 1764 | world_service_year_threshold_news_and_structure_milestone_notifications | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | World-side year-threshold and structure-milestone news owner beneath periodic simulation and startup bring-up. The helper reads the current packed year at `[0x006cec78+0x0d]`, suppresses itself when scenario gate `[0x006cec78+0x46c38]` is live or when cached prior-year field `[0x006cec78+0x05]` already matches, and then services several threshold families. Fixed threshold years `0x749/0x767/0x780/0x7a6` (`1865/1895/1920/1958`) publish paired localized ids `0x157..0x15e` through `0x005193f0` and append the resulting fixed records into collection `0x006cea4c` through `0x00473f80`. Years `0x73a/0x76c/0x79e` build three formatted numeric fragments through `0x0051b700`, splice them into localized id `0x15f`, and publish the finished notice through `0x004337c0`. The later milestone branch resolves specific candidate stems through `0x00412af0`, counts matching live placed structures through `0x004138f0`, and for year `0x755` also combines those counts with localized text fragments `0x161..0x165` before queueing one news record through `0x004337c0`; the single-stem branches at `0x7a4/0x789/0x794` instead publish localized ids `0x166/0x167/0x168` directly when at least one matching live structure exists. Current grounded caller is the periodic boundary work branch at `0x0040a6f7`, so this is the safest current read for the shared year-threshold and structure-milestone news owner rather than a generic date-change helper. | objdump + local disassembly + caller correlation + year-threshold correlation + structure-milestone correlation + news-record correlation |
| 384 | 0x0043ad50 | 227 | world_view_query_city_label_alpha_byte_from_normalized_xy_and_view_scalars | shell | thiscall | inferred | objdump + local disassembly + caller xrefs | 3 | Small bounded-byte helper beneath the city-site label formatters at `0x004207d0` and `0x004613d0`. The caller supplies rounded normalized `(x,y)` values, while the helper samples the current world-view state at `0x0062be68`: it first tests the view scalar at `[this+0x14]` against a three-band threshold ladder, returning `0` on the lowest band, `0xff` on the saturated band, and otherwise deriving one provisional byte through scaled subtraction and integer rounding. It then folds in the auxiliary view scalars at `[this+0x1c]` and `[this+0x24]` through the shared x87 rounding helper `0x005a10d0` and finishes by returning one bounded byte-like priority or alpha value in `EAX`. Current grounded callers use any nonzero result to arm a highlighted city-label style and only splice the returned byte into the top color lane when it stays below `0xff`, so the safest current read is a world-view-dependent city-label alpha-byte query rather than a generic camera scalar helper. | objdump + local disassembly + caller xrefs + city-label correlation |
| 385 | 0x00434ea0 | 124 | scenario_state_query_named_candidate_availability_record_value | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Read-side lookup over the scenario-side named candidate-availability collection at `[this+0x66b2]`. The helper normalizes the first byte of the caller-supplied candidate name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x1e]`; otherwise it returns zero. The insert sibling `0x00434f20` shows the exact record shape now too: each collection entry is a zero-initialized `0x22`-byte blob with a fixed zero-terminated name slot at `[entry+0x00..+0x1d]` and one trailing availability dword at `[entry+0x1e]`. Current grounded callers are the runtime refresh pass `0x00412c10`, the editor-side detail and summary formatters at `0x004cc209`, `0x004cdfa3`, `0x004d14b8`, and `0x004d1684`, and the same startup-side candidate filter family that later writes `[candidate+0x7ac]`. This is therefore the current safest read for the candidate-side lookup sibling of the named availability helpers rather than a generic string-table query. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation |
| 386 | 0x00434f20 | 272 | scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437737` and `0x00436a70` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation |
| 387 | 0x00435030 | 124 | scenario_state_query_named_locomotive_availability_record_value | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Read-side lookup over the scenario-side named locomotive-availability collection at `[this+0x66b6]`. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x3d]`; otherwise it returns zero. The insert sibling `0x004350b0` shows the exact record shape now too: each collection entry is a zero-initialized `0x41`-byte blob with a fixed zero-terminated locomotive-name slot at `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`. Current grounded callers are the shell-side `Locomotives` availability page constructor `map_editor_locomotive_availability_panel_construct` `0x004cd680`, the locomotive-side stats and summary branches at `0x004d0e5f` and `0x00461ed5`, and the neighboring startup or restore-side upsert family at `0x00438d6b` and `0x004478ea`. This is therefore the safest current read for the locomotive-side lookup sibling of the named availability helpers rather than a generic string-table query. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-availability correlation + record-layout correlation |
| 388 | 0x004350b0 | 249 | scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Upserts one named locomotive-availability record into the scenario-side collection at `[this+0x66b6]` and then refreshes dependent runtime locomotive usage state. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches existing names through `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the locomotive-availability dword at `[entry+0x3d]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x41`-byte record, copies the supplied zero-terminated locomotive name into `[entry+0x00..+0x3c]`, and seeds that same trailing dword. When the live locomotive pool `0x006ada84` exists it then re-enters `0x00461e00`, where the queried value is later stored into `[loco+0x7b]`. The write-side caller set is now tight enough to close the remaining semantic gap here too: the grounded startup or restore-side seeding lanes at `0x00438d6b`, `0x004478ea`, and `0x00461eab` and the shell-side `Locomotives` availability handler family at `0x004cf178`, `0x004cf1fe`, `0x004cf2f9`, and `0x004cf3fc` all supply only boolean values, so `[entry+0x3d]` now reads safely as a real locomotive-availability override bit rather than a broader policy enum. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-runtime-refresh correlation + record-layout correlation + callsite-argument correlation |
| 389 | 0x004351c0 | 1099 | scenario_state_rebuild_derived_year_threshold_band | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Broader rebuild owner for the compact scenario-side year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. The helper first samples one shell presentation scalar through `0x006d4024 -> [controller+0x18] -> [object+0x15]`, chooses one of three range profiles from that scalar (`<0x28`, `<0x46`, or later), and seeds base lane `[this+0x61]` to `0xff`, `0xc8`, or `0xe6` together with one paired year-span scalar derived from the fixed `0x5a0` multiplier. It then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` on the current year `[this+0x15]`, queries three companion shell integers through `0x00527cc0`, folds those shell-side values into one normalized offset, and writes the rebuilt threshold quartet into `[this+0x51]`, `[this+0x55]`, `[this+0x59]`, and `[this+0x5d]` through the shared x87 rounding helper `0x005a10d0`. The same owner also contains the shell-facing follow-on hidden by the tiny ensure wrapper `0x00435603`: when the caller stack flag is nonzero, or when the current shell progress scalar falls outside the rebuilt band, it computes one interpolated or clamped `0..255` presentation value from current year `[this+0x15]`, base byte `[this+0x3a]`, floor `[this+0x61]`, and the rebuilt threshold quartet, then republishes that value into the current shell presentation object through `0x00523d60`. Current grounded callers are the ensure wrapper `0x00435603`, the shell command `0x004412e0`, the shell-state setter path around `0x00482878`, the compact runtime-effect side branch at `0x00431e03`, and the world-entry late rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the actual year-threshold rebuild owner beneath selected-year restore and shell progress refresh rather than another anonymous math body. | objdump + local disassembly + caller correlation + year-threshold-band correlation + shell-progress-followon correlation |
| 390 | 0x00436a70 | 128 | scenario_state_preseed_named_candidate_availability_overrides_from_editor_map_placed_structures | map | thiscall | inferred | objdump + local disassembly + package-save correlation + caller correlation | 3 | Small editor-map prepass over the live placed-structure collection `0x0062b26c`, reached directly from the early package-save prelude `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0` before the later direct named-availability collection save. The helper walks every live placed-structure through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, keeps only records accepted by the subtype-family predicate `0x0040c990`, resolves each accepted record's linked candidate/runtime owner through virtual slot `+0x80`, filters that owner to subtype byte `[obj+0x32] == 2` with both availability bytes `[obj+0xba]` and `[obj+0xbb]` clear, and then forwards the owner name at `[obj+0x04]` plus boolean `1` into `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20`. Current grounded caller is the editor-map package branch at `0x00444f30`, which makes this the strongest current read for the save-side preseed pass that materializes candidate-availability override records from qualifying placed structures before the direct collection serializer `0x00517d90` persists `[world+0x66b2]` rather than a generic placement scan. | objdump + local disassembly + package-save correlation + caller correlation + placed-structure collection correlation + named-availability correlation |
| 391 | 0x00436c70 | 37 | scenario_state_check_special_tutorial2_signature_gate | map | cdecl | inferred | objdump + local disassembly + string inspection + caller correlation | 2 | Small special-case gate immediately above the broader scenario reset owner `0x00436d10`. The helper returns true only when the caller selector equals `0x10`, the current world root at `0x0062c120` reports map dimensions `0x180 x 0x1c0`, the live city collection `0x0062bae0` reports exactly `0x41` entries, the first live city name at `[entry+0x356]` matches `Italy - North`, the current shell-side file or scenario root at `0x0062be18` passes `0x4331e0 == 0x16`, and its row `7` subtype byte `[row+0x7ef]` equals `6`. The nearby string table points at `Tutorial_2.gmp`, so the safest current read is one hard-coded tutorial-signature predicate rather than a generic map-size or city-count checker. | objdump + local disassembly + string inspection + caller correlation + special-case-signature correlation |
| 392 | 0x00436af0 | 384 | scenario_state_refresh_cached_available_locomotive_rating_from_year_baseline_and_live_availability_gates | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]` with explicit tiers `110.0` through year `2000`, `200.0` after `2000`, and `300.0` after `2010`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, resolves the linked era through `[loco+0x72]`, filters each locomotive through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. The winning rating is forced to at least `1.0`, normalized through the fixed `100.0 / 220.0` scale pair at `0x005c9f40/0x005c85d8`, then floored to `50.0` and capped at `100.0` before storage into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper. | objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation + year-baseline correlation + normalization-tail correlation |
| 393 | 0x004367c0 | 92 | world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text | map | thiscall | inferred | llvm-objdump + local disassembly + caller correlation + RT3.lng strings | 3 | Small world-side outcome-status helper. The caller-supplied mode dword is stored into `[this+0x4a73]`, world flag `[this+0x4d]` is cleared, and the current selected-year snapshot byte `[this+0x15]` is copied into `[this+0x4c88]`. The helper then copies one fixed localized string into status buffer `[this+0x4b47]`: id `2923` `You lose.` when the incoming mode equals `1`, otherwise id `2924` `You win, cheater...`. Current grounded callers are the cheat-modal owner `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and the scenario follow-on command branch around `0x004648e1`, so this is the safest current read for the cheat-owned outcome-mode setter rather than a generic prompt publisher. | llvm-objdump + local disassembly + caller correlation + RT3.lng strings + outcome-buffer correlation |
| 394 | 0x00436d10 | 522 | scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 4 | Broader scenario-state reset or initialization owner over active world state `0x006cec78`. The helper first zeroes one contiguous late-state slab from `[this+0x4cc2]` for `0x9b` dwords plus one trailing byte, then separately clears the much larger late setup-preview/runtime slab rooted at `[this+0x66be]` and immediately reseeds its leading validity byte `[this+0x66be] = 1`. It seeds the same editor-owned scenario start-year trio later refreshed by `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` and clamped by `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0`: minimum `[this+0x66ca] = 0x726` (`1830`), default `[this+0x66d2] = 0x74e` (`1870`), and maximum `[this+0x66ce] = 0x7d0` (`2000`). It also seeds the four neighboring startup dwords `[this+0x6a68/+0x6a6c/+0x6a70/+0x6a74] = 1`, seeds the sixteen 9-byte chairman-slot rows rooted at `[this+0x69d8]` with default tuning `0x186a0`, and explicitly sets the first slot's distinguished occupied-seat byte `[this+0x69db] = 1`, matching the later chairman-slot readers `0x00437220`, `0x004377a0`, and `0x004ca1c0` that treat `[slot+0x03]` as the special occupied-seat marker. The helper clears several now-grounded latch families explicitly: `[this+0x19/+0x21/+0x25/+0x29/+0x31/+0x3d/+0x41/+0x45/+0x49/+0x4d]`, queue or fast-forward latches `[this+0x46c38/+0x46c3c/+0x66a2/+0x66a6/+0x66aa]`, outcome and cheat bands `[this+0x4a73/+0x4a77/+0x4a7b]`, the scenario-rule table `[this+0x4a7f..+0x4b3f]` plus trailing scalar `[this+0x4b43]`, the outcome text root `[this+0x4b47]`, the byte-policy and cached-scalar cluster `[this+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, and the trailing float strip `[this+0xbce..+0xbf6]` before reseeding the same six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `map_editor_economic_cost_slider_dispatch` `0x004ca980`: `+0xbde/+0xbe2 = 1.0f`, `+0xbe6/+0xbea/+0xbee/+0xbf2 = 0x3c75c28f`, and `+0xbf6 = 0x3ba3d70a`. It then zero-fills the twelve scenario recipe books at `[this+0x0fe7]` and only seeds their per-book name lane through the fixed format string `# %1` at `0x005c9f78`, using generated ordinal strings `1..12` via `0x0051b700` and `0x00518de0`; current local disassembly does not show it preloading any default line modes, amounts, or cargo-token strings into the later `+0x3ed/+0x3f1` recipe payload. It also destroys and recreates the two named-availability collections at `[this+0x66b2]` and `[this+0x66b6]` with fixed record sizes `0x22` and `0x41`. The selected-year rebuild tail is explicit now too: when live profile `0x006cec7c` reports campaign/setup byte `[profile+0xc5] != 0` and sandbox byte `[profile+0x82] == 0`, the helper copies profile year word `[profile+0x77]` into scenario default year `[this+0x66d2]`; it then seeds `[this+0x05/+0x09]` from that chosen year through `calendar_pack_year_and_component_bytes_to_packed_tuple_dwords` `0x0051d3f0` with Jan-1-style constants, conditionally decrements the selected year before `calendar_pack_unpacked_components_to_absolute_counter` `0x0051d390` based on shell mode `[0x006cec74+0x68/+0x178]` and tutorial gate `[0x006cec78+0x4af7]`, stores the resulting absolute counter into `[this+0x15]`, clamps `[this+0x1d]` from current year `[this+0x19]`, and only then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, and `scenario_state_ensure_derived_year_threshold_band` `0x00435603`. After that selected-year/calendar chain it re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0` before clearing several shell-controller-side cached state dwords under `0x006d4024+0x11425a..+0x114276`. Current grounded callers are the startup-profile dispatcher `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` and the world-entry coordinator `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared scenario-state reset-and-rebuild owner beneath startup and load paths rather than a smaller recipe-only helper. | objdump + caller xrefs + local disassembly + default-state correlation + economic-tuning-band correlation + named-availability-collection correlation + recipe-book-name-template correlation + selected-year-refresh correlation + runtime-bridge correlation + late-state-reset-cluster correlation + profile-year-import correlation + setup-preview-payload correlation + scenario-metadata-year-trio correlation + chairman-slot-marker correlation + queue-latch correlation |
| 395 | 0x0043cb00 | 295 | world_view_step_heading_quadrant | shell | thiscall | inferred | objdump + caller xrefs | 3 | Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag. | objdump + caller xrefs + callsite inspection |
| 396 | 0x0043cc30 | 437 | world_view_step_zoom_bucket | shell | thiscall | inferred | objdump + caller xrefs | 3 | Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4. | objdump + caller xrefs + callsite inspection |
| 397 | 0x0043d050 | 111 | world_view_set_focus_position_xyz | shell | thiscall | inferred | objdump + caller xrefs | 4 | Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d. | objdump + caller xrefs |
| 398 | 0x0043af60 | 205 | world_view_should_drive_primary_pan_channel | shell | thiscall | inferred | objdump | 3 | Returns whether the world-view owner should drive its primary pan channel on this pass. The predicate first honors the latched override at [this+0xa2] then checks several shell-view gates through 0x00543e00 0x00543e20 and 0x00543e40 on the active controller node plus one optional guard under 0x006d1a8c and the world-mode flag at [0x006cec74+0x120]. When the controller view is active it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as one enabling condition; `shell_input_apply_window_key_transition` grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36 which ties held Shift state back into the same world-view pan family. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and the smaller motion helper at 0x0043e610. | objdump + callsite inspection |
| 399 | 0x0043b030 | 173 | world_view_should_drive_secondary_pan_channel | shell | thiscall | inferred | objdump | 3 | Returns whether the world-view owner should drive its secondary pan channel on this pass. Like the neighboring primary predicate it combines shell controller view gates through 0x00543e00 0x00543e20 and 0x00543e40 optional suppression under 0x006d1a8c and one world-mode check at [0x006cec74+0x120]; when the active controller view is present it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as an enabling condition. Those bits are now grounded as the left and right Shift modifiers from scan codes 0x2a and 0x36 rather than an opaque gameplay-only flag source. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and in the smaller motion helpers at 0x0043e610 and 0x0043f4f0. | objdump + callsite inspection |
| 400 | 0x0043b2c0 | 133 | world_view_store_camera_view_slot_snapshot | shell | thiscall | inferred | objdump + caller inspection + world-view correlation | 4 | Stores one live camera-view snapshot into a fixed slot family rooted inside the world-view owner at `0x0062be68`. The helper expands the caller slot selector into one `0x30`-byte record, sets slot-valid dword `[slot+0x10e]`, copies the current scenario-side focus-kind pair from `[0x006cec78+0x45/+0x49]` into `[slot+0x112/+0x116]`, and then mirrors the live world-view focus and camera fields `[view+0x04/+0x08/+0x0c/+0x18/+0x10/+0x14/+0x1c/+0x20/+0x24]` into `[slot+0x11a..+0x13a]`. Current grounded caller is the shell-side assignment owner `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`, which uses this helper for the ten-slot `Assign Camera View` family. This is therefore the safest current read for the fixed camera-view snapshot writer rather than a generic view-state copier. | objdump + caller inspection + world-view correlation + slot-layout correlation |
| 401 | 0x0043ca20 | 223 | world_view_restore_camera_view_slot_snapshot_if_populated | shell | thiscall | inferred | objdump + caller inspection + world-view correlation | 4 | Restores one previously saved camera-view snapshot from the fixed slot family inside the live world-view owner at `0x0062be68`. The helper expands the caller slot selector into the same `0x30`-byte record used by `world_view_store_camera_view_slot_snapshot` `0x0043b2c0`, rejects immediately when slot-valid dword `[slot+0x10e]` is zero, re-enters `0x004349f0` to clear or normalize scenario-side focus state, restores the saved focus and camera fields back into `[view+0x04/+0x08/+0x0c/+0x18/+0x10/+0x14/+0x1c/+0x20/+0x24]`, clamps the restored heading through `0x005a1390`, optionally replays the saved focus-kind pair `[slot+0x112/+0x116]` through `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`, and finally rebuilds the dependent view state through `0x0043db00` and `0x0043bde0` before returning `1`. Empty slots return `0` without side effects. Current grounded caller is the shell-side selection owner `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`, which uses this helper for the ten-slot `Select Camera View` family. This is therefore the safest current read for the fixed camera-view snapshot restore helper rather than a generic world-view reset. | objdump + caller inspection + world-view correlation + slot-layout correlation + focus-replay correlation |
| 402 | 0x0043d0c0 | 111 | world_view_apply_screen_delta_to_focus_position | shell | thiscall | inferred | objdump + caller xrefs | 4 | Converts one screen-relative drag delta into a new world-view focus position and forwards it through world_view_set_focus_position_xyz. When the auxiliary object at [this+0x6e] is live it samples a derived center or height term through 0x00534490 and scales both incoming deltas by the world-view projection constant at 0x005c8700 before calling the lower focus-position setter. The current grounded caller is the cursor-drag helper at 0x00478d31 inside the larger input loop at 0x00478cb0. | objdump + caller xrefs |
| 403 | 0x0043d130 | 292 | world_view_pan_relative_offset_in_camera_plane | shell | thiscall | inferred | objdump + caller xrefs | 4 | Applies one local X/Z pan offset to the world-view owner at 0x0062be68 in the current camera plane and forwards the result through world_view_set_focus_position_xyz. The helper derives a scale from the active view-height field [this+0x18] rotates the incoming offset by the current heading-like field [this+0x10] through sine and cosine calls at 0x005a13e4 and 0x005a1494 adds the rotated result onto the current world focus position in [this+0x04] and [this+0x0c] preserves the current Y term in [this+0x08] and then calls the lower focus-position setter. Current grounded callers are the GameUppermost hotspot path at 0x004e094b and the keyboard-owned service branch inside world_view_service_keyboard_turn_and_pan_bindings at 0x0043dae4 which together indicate a shared world-view pan action rather than a separate gameplay command dispatcher. | objdump + caller xrefs |
| 404 | 0x0043d740 | 937 | world_view_service_keyboard_turn_pan_and_zoom_bindings | shell | thiscall | inferred | objdump + callsite inspection | 4 | Keyboard-driven world-view interaction helper beneath world_view_service_shell_input_pan_and_hover. It samples elapsed wall-clock time through 0x0051d890 against the previous timestamp at 0x0062be74 clamps the per-pass delta into the 0x08 through 0xc8 range and polls four configurable binding-pair families through the shell input table at 0x006d4018 via 0x0054e7d0. The first two pair families at [this+0x0a6] through [this+0x0b2] and [this+0x0b6] through [this+0x0c2] now ground as the default `Camera Forward` or `Camera Backward` pair and `Camera Left` or `Camera Right` pair. The third family at [this+0x0c6] through [this+0x0d2] produces a signed zoom-step or view-height delta that is returned through the caller-owned out-parameter for later smoothing and grounds as the default `Camera Zoom In` or `Camera Zoom Out` pair, while the fourth family at [this+0x0d6] through [this+0x0e2] applies continuous heading turns through 0x0043c810 and grounds as the default `Camera Rotate Left` or `Camera Rotate Right` pair. When the pan families are active the helper reaches world_view_pan_relative_offset_in_camera_plane at 0x0043d130 after checking the active world-view state. Current grounded caller is world_view_service_shell_input_pan_and_hover at 0x0043db00. | objdump + callsite inspection + caller xrefs + registration xrefs + RT3.lng |
| 405 | 0x0045ea90 | 365 | shell_input_binding_format_display_label_from_registry_entry | shell | cdecl | inferred | objdump + local disassembly + registry correlation | 4 | Formats one user-facing binding label directly from a live registry entry. The helper clears the destination buffer, rejects entries whose primary binding code `[entry+0x0c]` is `0xff`, prepends up to three localized prefix fragments from ids `0xdef`, `0xdf0`, and `0xdf1` according to bits `0x4`, `0x2`, and `0x1` in mode field `[entry+0x94]`, then scans the static binding-descriptor table rooted at `0x005f0a34` for the current action id `[entry+0x0c]`. When the descriptor-side localized caption id at `[row+0x04]` exists and `0x0051c900` accepts it, the helper appends that localized caption through `0x005193f0`; otherwise it appends the fallback literal stem at `[row+0x08]`. Current grounded caller is `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0`, which uses this helper beneath the camera-view modal family and the hotkey report path. This is therefore the safest current read for the lower binding-label formatter rather than a generic string helper. | objdump + local disassembly + registry correlation + descriptor-table correlation + localized-prefix correlation |
| 406 | 0x0045ec00 | 108 | shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments | shell | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Splits one compound binding label into a primary token plus one optional modifier fragment. The helper copies the caller source string into the primary destination unchanged when the string either begins with `+`, does not contain the localized token from id `0xdf2`, or contains no later `+` delimiter. Otherwise it trims the source at the first `+`, copies the suffix after that delimiter into the primary destination, and copies the preserved prefix fragment into the secondary destination buffer. Current grounded caller is the hotkey import worker `0x0045f420`, where it prepares one imported binding label for action lookup and modifier parsing before the rebucket helper `0x0045ef00`. This is therefore the safest current read for the localized plus-split helper rather than a generic string tokenizer. | objdump + caller inspection + local disassembly + hotkey-import correlation |
| 407 | 0x0045ec70 | 88 | shell_input_binding_descriptor_query_action_id_by_localized_label | shell | cdecl | inferred | objdump + local disassembly + descriptor-table correlation | 4 | Resolves one action id from the binding-descriptor table rooted at `0x005f0a34` by matching a user-facing label. The helper rejects empty input with `0xff`, then walks the descriptor rows and compares the caller text against either the localized caption at `[row+0x04]` when `0x0051c900` accepts that id or the fallback literal stem at `[row+0x08]` otherwise. On success it returns the descriptor action id at `[row+0x00]`; failure returns `-1`. Current grounded caller is the hotkey import worker `0x0045f420`, which uses this helper after `shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments` `0x0045ec00` to recover the target action id for one imported binding row. | objdump + local disassembly + descriptor-table correlation + localized-caption correlation + hotkey-import correlation |
| 408 | 0x0045e940 | 216 | placed_structure_build_attached_emitter_variant_list_by_owner_stem | map | cdecl | inferred | objdump + local disassembly + literal inspection + caller inspection | 2 | Builds a repeated attached-emitter list for one owner stem on top of the global emitter table. The helper rejects literal `Stadium` immediately, clears caller flag bit `0x10` when the owner stem matches `ParticleCar`, then iterates `effect_emitter_table_select_next_existing_formatted_3dp_variant` `0x00474860` first with reset mode `1` and then resume mode `0`. For each accepted formatted variant it creates one attached sprite emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, optionally ORs flag `0x10000` when startup latch `[0x006cec78+0x46c3c]` is live, ORs emitter flag `0x02` for literal `Nuclear`, appends the created emitter into the caller output array when that array is present, and terminates the list with a trailing null when at least one output slot was available. Current grounded callers are the heavier placed-structure transient builders around `0x0045b828` and `0x0045e23e`, so this is best read as the owner-stem-driven attached-emitter variant-list builder rather than a one-off specialization stub. | objdump + local disassembly + literal inspection + caller inspection + formatted-variant correlation + transient-family correlation |
| 409 | 0x0045ea20 | 61 | shell_emit_indexed_audio_feedback_nudge_if_live | shell | cdecl | inferred | objdump + caller correlation + local disassembly | 4 | Small indexed audio-feedback helper used by shell command paths and tutorial guidance. When selector `ECX` is in the bounded range `2..0x40` and the two audio override gates at `0x00ccba14` and the service-side `0x00531e10` checks remain clear, the helper looks up one pair of table-driven dwords from `0x005f0828/0x005f082c`, forwards them together with the caller scalar and three zero trailing arguments into the shell audio service at `0x006d402c` through `0x00531e10`, and otherwise returns without side effects. Current grounded callers include the pause-toggle shell command `0x00440880` with selector `0x2c` and the tutorial-step advance path `0x00516be0`, which makes this the reusable indexed feedback-nudge owner rather than a one-off pause-only stub. | objdump + caller correlation + local disassembly + audio-service correlation |
| 410 | 0x0045ecd0 | 155 | shell_input_binding_parse_modifier_fragment_to_compact_mode_code | shell | cdecl | inferred | objdump + local disassembly + caller inspection | 3 | Parses one binding-label modifier fragment into a small compact mode code. The helper normalizes the caller text through `0x005a2abe`, probes it for one localized header token from `0xdf3` and the follow-on localized fragments `0xdf4` and `0xdf5`, and then returns one of four compact codes: default `1` when the header token is absent, `4` when only the middle fragment is absent, `2` when the trailing fragment is absent, and `0` for the fully matched final branch. Current grounded caller is the hotkey import worker `0x0045f420`, which uses this compact code immediately before `shell_input_binding_expand_compact_mode_code_to_registry_mask` `0x0045ed70` and the rebucket helper `0x0045ef00`. This is therefore the safest current read for the localized modifier-fragment parser rather than a stronger semantic mode-name decoder. | objdump + local disassembly + caller inspection + hotkey-import correlation |
| 411 | 0x0045ed70 | 26 | shell_input_binding_expand_compact_mode_code_to_registry_mask | shell | cdecl | inferred | objdump + local disassembly + caller inspection | 3 | Tiny compact-mode projector for the input-binding family. The helper expands the caller compact code in `ECX` into the registry-facing mode mask over bits `0x1`, `0x2`, and `0x4` using the low two bits plus one high nibble bit, then returns that mask in `EAX`. Current grounded caller is the hotkey import path at `0x00500205`, where it immediately feeds the result into `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00`. | objdump + local disassembly + caller inspection + hotkey-import correlation |
| 412 | 0x0045ed90 | 69 | shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular | shell | cdecl | inferred | objdump + local disassembly + descriptor-table correlation | 4 | Descriptor-side bucket-key query for the shell input-binding registry. The helper scans the static descriptor table rooted at `0x005f0a34` for the caller action id in `ECX`, counts the number of set bits in the caller mode mask in `EDX`, and only when that bit count is `0` or `1` returns the descriptor-side bucket key at `[row-0x04]` / `[row+0x30]`; multi-bit masks return `0`. Current grounded callers are `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, the hotkey message path at `0x005001e1`, and the rebucket helper `0x0045ef00`, which all use this helper as the singular-mode bucket discriminator above the live registry buckets. This is therefore the safest current read for the descriptor-side bucket-key query rather than a generic action-table scan. | objdump + local disassembly + descriptor-table correlation + mode-mask correlation + bucket-key correlation |
| 413 | 0x0045f370 | 95 | shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id | shell | cdecl | inferred | objdump + caller inspection + registry correlation | 4 | Lookup helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper scans each linked per-bucket list for a record whose action id at `[entry+0xa0]` matches the caller key in `ECX`; on success it writes the entry's primary binding code `[entry+0x0c]` through the first out-parameter and packs three mode bits from `[entry+0x94]` into a small output mask through the second out-parameter before returning `1`. Failure returns `0`. Current grounded caller is `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`, where this helper resolves the default `Camera Forward/Backward/Left/Right/Zoom/Rotate` action ids before the resulting codes are normalized into the world-view slot-pair band. This is therefore the safest current read for the action-binding query helper rather than a generic shell hash-table scan. | objdump + caller inspection + registry correlation + output-mask correlation |
| 414 | 0x0045ede0 | 88 | shell_input_binding_registry_resolve_entry_by_action_stem | shell | cdecl | inferred | objdump + local disassembly + registry correlation | 4 | Resolves one shell input-binding registry entry by stem text. The helper copies the caller string into a local `0x80`-byte buffer, normalizes it through `0x0053d810`, hashes or canonicalizes that normalized stem, and then scans the linked registry buckets rooted at `0x006acd78..0x006ad960` for an entry whose cached normalized token at `[entry+0x90]` matches the derived value. On success it returns the live registry entry pointer; otherwise it returns null. Current grounded callers are `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0` and `shell_input_binding_registry_query_primary_code_by_action_stem` `0x0045f400`, which use this helper as the shared action-stem lookup beneath the camera-view modal family. This is therefore the safest current read for the stem-to-binding-entry resolver rather than a generic string hash helper. | objdump + local disassembly + registry correlation + normalized-stem correlation |
| 415 | 0x0045ef00 | 568 | shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask | shell | cdecl | inferred | objdump + local disassembly + caller inspection + registry correlation | 4 | Rehomes one existing binding entry into a different action bucket and mode-mask family while preserving its current binding data. The helper first resolves the target descriptor bucket through `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular` `0x0045ed90` unless the requested action id is `0xff`, then resolves the source live entry by stem through `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`, allocates one fresh record from the pool owner at `0x006acd6c`, copies the source entry payload into that fresh record, overwrites the new action id `[entry+0x0c]` and mode mask `[entry+0x94]`, unlinks the old record from its current per-bucket list, optionally moves the old record into the detached `0xff` side list rooted at `0x006ad96c..0x006ad974`, and finally links the new record into the requested target bucket at `0x006acd78..0x006ad960`. Failure at either the descriptor-bucket or source-entry step returns `0`; success returns `1`. Current grounded caller is the hotkey message path at `0x0050020f`, where this helper commits one imported or reassigned binding row after the local label split and modifier decode. This is therefore the safest current read for the binding-entry rebucket helper rather than a generic pool copier. | objdump + local disassembly + caller inspection + registry correlation + pool-allocation correlation + detached-list correlation |
| 416 | 0x0045f250 | 278 | shell_input_binding_report_iterate_next_entry_in_sorted_priority_order | shell | cdecl | inferred | objdump + caller inspection + local disassembly + registry correlation | 4 | Iterates the next live binding entry in one temporary sorted report order. On first use when sentinel `0x005f0fe0 == 1`, the helper allocates a small queue owner at `0x006acd74`, initializes it through `0x0053d740`, walks every live registry bucket at `0x006acd78..0x006ad960`, and pushes each entry into that queue with priority `0x7ffffffe - [entry+0x9c]`. Each call then pops one entry through `0x0053d540`; when one record is available it formats the user-facing label into scratch `0x006ad980` through `shell_input_binding_format_display_label_from_registry_entry` `0x0045ea90`, copies the action stem from `[entry+0x10]` into `0x006ada00`, mirrors the binding code and companion field into `0x006ad978` and `0x006ad97c`, and returns `0x006ad978`. When the queue is exhausted it destroys the temporary owner, resets `0x006acd74` to null, restores sentinel `0x005f0fe0` to `1`, and returns `0`. Current grounded callers are the hotkey-report writer `0x0045f550` and the hotkeys-window refresh path at `0x004fed16/0x004fedb2`, which makes this the current sorted binding-report iterator rather than a generic priority-queue wrapper. | objdump + caller inspection + local disassembly + registry correlation + temporary-queue correlation + report-scratch correlation |
| 417 | 0x0045f3d0 | 33 | shell_input_binding_registry_format_display_label_by_action_stem | shell | cdecl | inferred | objdump + caller inspection + registry correlation | 3 | Small display-label helper above `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`. The helper resolves the caller action stem into one registry entry, then forwards the destination buffer plus that entry into `0x0045ea90` to format the user-facing label string. Success returns `1`; unresolved stems return `0`. Current grounded callers are the camera-view command owners `0x004408f0` and `0x004409c0`, where it formats the optional current focus labels embedded in the assignment and unassigned-view modals. | objdump + caller inspection + registry correlation + modal-text correlation |
| 418 | 0x0045f400 | 18 | shell_input_binding_registry_query_primary_code_by_action_stem | shell | cdecl | inferred | objdump + local disassembly + registry correlation | 3 | Tiny primary-code accessor above `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`. The helper resolves the caller action stem into one registry entry and, on success, returns that entry's primary binding code from `[entry+0x0c]`; unresolved stems return `0`. Current local evidence only grounds the raw field access, not a stronger player-facing meaning beyond the shared binding-registry lane. | objdump + local disassembly + registry correlation + field-access correlation |
| 419 | 0x0045f420 | 296 | shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels | shell | thiscall | inferred | objdump + local disassembly + caller correlation + import-file correlation | 4 | Imports one saved hotkeys file and rehomes matching live binding entries into the requested action or mode buckets. The helper first loads one parsed text resource through the small loader pair `0x00557320 -> 0x00557630`, retrying with the secondary `(0x28,0x29)` selector pair when the primary `(0x21,0x7e)` load fails. On the success path it walks the resulting nested record lists at `[root] -> [group+0x108] -> [entry+0x104]`, splits each imported `foo+bar` label through `shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments` `0x0045ec00`, normalizes both fragments through `0x00557280/0x005572e0`, resolves the target action id from the descriptor table through `shell_input_binding_descriptor_query_action_id_by_localized_label` `0x0045ec70`, decodes the modifier fragment through `shell_input_binding_parse_modifier_fragment_to_compact_mode_code` `0x0045ecd0`, and finally commits the rebucket through `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00` using the preserved stem at `[entry+0x04]`. A fully successful import returns `1`; early parse or load failures return the loader status unchanged. Current grounded caller is the registry constructor `0x00461120`, which tail-jumps here with the fixed path `hotkeys\\hotkeys.txt` when the caller requests saved-hotkey import. This is therefore the safest current read for the hotkeys-file import worker rather than a generic text-resource walker. | objdump + local disassembly + caller correlation + import-file correlation + nested-record-walk correlation + rebucket correlation |
| 420 | 0x0045f550 | 382 | shell_input_write_hotkeys_report_file | shell | cdecl | inferred | objdump + caller inspection + local disassembly + literal correlation | 4 | Writes the current hotkey report to the fixed output path `hotkeys\\hotkeys.txt`. The helper opens that file through mode string `wt`, writes the fixed report header `!Hotkeys~\\n`, appends the localized heading strip from ids `0xdf6` through `0xdfc`, then iterates the current binding set through `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250`. For each returned record it copies the action stem at `[entry+0x08]` into a local `0x20`-byte padded column, falls back to the localized empty-label string `0x0b3e` when the stem is empty, and formats each output line through the fixed template `%s = %s\\n`; rows whose leading dword is zero instead use the alternate template `%s = %s\\n` with the shifted value pointer at `[entry+0x08]`. Current grounded callers are the shell command path at `0x00461082` and the hotkeys-window message path at `0x00500153/0x0050021d`, which makes this the current shared hotkey-report writer rather than a generic file dump helper. | objdump + caller inspection + local disassembly + literal correlation + report-iterator correlation + hotkeys-path correlation |
| 421 | 0x0045f6d0 | 334 | shell_input_register_action_binding_with_mode_specific_defaults | shell | cdecl | inferred | objdump + caller inspection + registry correlation | 4 | Shared registration helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper first selects one mode-specific `(binding_code, companion_value)` pair from the caller's four fallback pairs according to shell mode dword `0x006d3c84`; when the selected binding code is not `0xff`, it re-enters `0x0045ed90` to resolve or create the target registry bucket, optionally updates an existing entry for the same companion discriminator `[entry+0x94]` through `0x0045f8a0`, or allocates and links a fresh entry from the pool owner at `0x006acd6c` and the monotonic id source `0x006acd68`. The new or updated record stores the action id, mode flags, callback pointer, localized label string, and the selected default pair before it is linked back into the per-action bucket family. Current grounded callers include the camera-view command registration block at `0x00460903..0x00460cac` and the world-view keyboard registration block at `0x00460720..0x004608e7`, which makes this the current shared action-binding registration helper rather than a camera-specific leaf. | objdump + caller inspection + registry correlation + allocation-pool correlation + mode-specific-default correlation |
| 422 | 0x0045f8a0 | 315 | shell_input_binding_registry_replace_existing_entry_by_action_bucket_and_mode_mask | shell | cdecl | inferred | objdump + local disassembly + caller inspection + registry correlation | 4 | Updates one existing binding entry for a specific action bucket plus mode-mask discriminator. The helper first scans the requested live bucket at `0x006acd78..0x006ad960` for an entry whose stored mode mask `[entry+0x94]` matches the caller value in `EDX`; when found it copies the full record to a local stack frame, unlinks and releases the live record from both its bucket and the pool owner at `0x006acd6c`, then re-enters `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` with the preserved callback pointer, localized label pointer, default-pair payload, and the copied companion values while forcing the binding-code selector to `0xff`. Current grounded caller is the registration helper `0x0045f6d0`, which uses this path when a same-bucket same-mode entry already exists for the target action. This is therefore the safest current read for the existing-entry replacement helper rather than a generic free-and-realloc wrapper. | objdump + local disassembly + caller inspection + registry correlation + preserved-payload correlation |
| 423 | 0x0045f9e0 | 598 | shell_input_seed_default_binding_registry_entries_from_static_table | shell | cdecl | inferred | objdump + local disassembly + static-table inspection | 4 | Seeds the shell input-binding registry from the static default table rooted at `0x005ecadc`. The helper walks `0x71` eight-byte rows, localizes each row label id at `+0x04`, decodes the packed row policy word at `+0x06` into the mode-specific default tuple expected by `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, and installs each resulting binding into the live registry. After the fixed table pass it appends a smaller manual post-table strip for adjacent shell commands such as the wrappers at `0x00441a00`, `0x00441940`, `0x00441980`, `0x00482b00`, `0x004408b0`, `0x00441ac0`, `0x004408d0`, and `0x00441af0`, using localized ids `0x0d4a` through the neighboring `0x0d53` band. Current grounded caller is the registry initializer `0x00461120`, which runs this helper after rebuilding the pool and queue roots. This is therefore the safest current read for the default binding seeder rather than a generic command-registration batch. | objdump + local disassembly + static-table inspection + post-table registration-strip correlation |
| 424 | 0x00460fe0 | 52 | shell_input_register_localized_binding_command_id_0xdb5_to_action_0x6b | shell | cdecl | inferred | objdump + local disassembly + installer correlation | 2 | Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db5`, then installs one default binding row with action id `0x6b`, callback `0x00441cb0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits immediately beside the paired `0x0db6` half-step registration. The row is therefore carried at the concrete localized-id plus action-id level. | objdump + local disassembly + installer correlation + registration-strip correlation |
| 425 | 0x00461000 | 52 | shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d | shell | cdecl | inferred | objdump + local disassembly + installer correlation | 2 | Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The row is therefore carried at the concrete localized-id plus action-id level. | objdump + local disassembly + installer correlation + registration-strip correlation |
| 426 | 0x00461040 | 40 | shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a | shell | cdecl | inferred | objdump + local disassembly + installer correlation | 2 | Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The row is therefore carried at the concrete localized-id plus action-id level. | objdump + local disassembly + installer correlation + registration-strip correlation |
| 427 | 0x00461070 | 170 | shell_input_binding_registry_destroy_all_roots_and_reset_globals | shell | cdecl | inferred | objdump + local disassembly + global-field correlation | 4 | Destroys the live shell input-binding registry and clears all of its global roots. The helper first re-enters `shell_input_write_hotkeys_report_file` `0x0045f550` when the main pool owner at `0x006acd6c` is present, then releases the main pool owner `0x006acd6c`, the companion owner at `0x006acd70`, zeroes every bucket head/tail/count triple across `0x006acd78..0x006ad974`, and finally releases the temporary report queue owner at `0x006acd74` if it is still live. Current grounded caller is the setup helper `0x00461120`, which uses this as the hard reset before rebuilding the registry state. This is therefore the safest current read for the binding-registry teardown and global reset owner rather than a one-off file export command. | objdump + local disassembly + global-field correlation + teardown correlation + hotkey-report correlation |
| 428 | 0x00461120 | 171 | shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file | shell | thiscall | inferred | objdump + local disassembly + caller correlation | 4 | Constructs the live shell input-binding registry, seeds the default action set, and optionally imports the saved hotkeys file. The helper first hard-resets the old registry through `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070`, zeros the monotonic id source `0x006acd68`, allocates and clears the primary pool owner at `0x006acd6c`, allocates the two companion owners at `0x006acd70` and `0x006acd74`, seeds the default bindings through `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0`, and when the caller flag in `ECX` equals `1` immediately tail-jumps into the hotkey import worker `0x0045f420` using the fixed path literal `hotkeys\\hotkeys.txt`. This is therefore the safest current read for the binding-registry constructor and optional hotkey-import owner rather than a generic allocator batch. | objdump + local disassembly + caller correlation + pool-allocation correlation + default-seed correlation + hotkey-import correlation |
| 429 | 0x00439e40 | 557 | world_view_seed_keyboard_binding_slot_pairs | shell | thiscall | inferred | objdump + callsite inspection | 4 | Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store. | objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng |
| 430 | 0x0043db00 | 1968 | world_view_service_shell_input_pan_and_hover | shell | thiscall | inferred | objdump + callsite inspection | 4 | Recurring world-view service that fuses shell input state into the live world-view owner at 0x0062be68. It begins by delegating keyboard-bound turn pan and zoom work to world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 then samples controller and view state through 0x00543c50 and 0x00543ba0 caches successive shell input coordinates from 0x006d4018 offsets 0xa94 and 0xa98 derives smoothed cursor or hover deltas against [this+0x2f6] [this+0x2fa] and [this+0x2fe] updates one world-under-cursor cache through 0x00448ac0 and 0x00448bd0 and refreshes the GameUppermost overlay through 0x004e0730 when the pan state changes. The helper repeatedly consults world_view_should_drive_primary_pan_channel at 0x0043af60 and world_view_should_drive_secondary_pan_channel at 0x0043b030 drives one of the lower motion branches at 0x0043e610 0x0043f4f0 or 0x0043e2c0 and smooths the keyboard zoom-step channel through the shared accumulator at 0x0062be78 before issuing discrete view-height bucket steps through world_view_step_zoom_bucket at 0x0043cc30. Current grounded callers include the recurring world-frame path at 0x00439730 and two setup or transition loops at 0x00516859 and 0x00516921. This now looks like the shared shell-input coordinator above keyboard turn pan zoom cursor drag and hotspot world-view motion rather than a mouse-only helper. | objdump + callsite inspection + caller xrefs |
| 431 | 0x00420030 | 578 | city_connection_bonus_exists_matching_peer_site | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan. | objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding |
| 432 | 0x00420280 | 204 | city_connection_bonus_select_first_matching_peer_site | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan. | objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation |
| 433 | 0x004207d0 | 1053 | city_site_format_connection_bonus_status_label | map | thiscall | inferred | objdump + local disassembly + RT3.lng strings + caller inspection | 4 | Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. The boundary is tighter now. When preview-global `0x0062be84` is armed the helper returns `0` immediately; when city-side subtype dword `[this+0x23e]` is nonzero it does not run its own status logic at all and instead forwards all five caller parameters into the shared fallback formatter thunk `0x00455860 -> 0x00530820`. On the main branch it rounds the current normalized city coordinates through `0x00455810/0x00455800`, samples one world-view-dependent alpha byte through `world_view_query_city_label_alpha_byte_from_normalized_xy_and_view_scalars` `0x0043ad50`, and then tries to resolve one active linked world object through the live selection path at `0x006d1720` or the scenario fallback at `[0x006cec78+0x66a2]`. When that object passes vtable slot `+0x70`, linked-peer resolution `0x0040d1f0`, station-or-transit gate `0x0047fd50`, and the city-class membership test `0x0042b2d0`, the formatter writes one highlighted color with fixed alpha `0xff` and arms its local connected-style flag. Otherwise it uses the sampled byte from `0x0043ad50` as the top color lane only when that value is nonzero and below `0xff`. The helper always formats the base city label from `[this+0x356]`, optionally appends the numeric pending amount in `[this+0x276]`, and when the connected-style flag is armed appends localized id `207` `(Connected)`. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` `0x00420030` with three grounded filter combinations: the first branch is the connected-station special case keyed by `0x0040c990`, the second is the active-company-only pass using `scenario_state_get_selected_chairman_company_record` `0x004337a0`, and the third is the broader any-company pass. After those note checks it still re-enters `city_connection_bonus_select_first_matching_peer_site` `0x00420280` to recover one representative matching peer site and linked company context for the follow-on company-oriented text lane. The tail also splits cleanly now: when `0x0041fff0` fails it returns style code `1`; otherwise it derives one label-priority scalar from either `[this+0x25e]` or the piecewise-scaled `[this+0x312]` path, clamps that scalar to `0x95`, resolves one color-table entry through `0x0053de00`, stores it through the caller's style pointer, and returns style code `3`. This is therefore the grounded world-label or hover-summary formatter for city connection-bonus state, not a station-detail overlay body. | objdump + local disassembly + RT3.lng strings + caller inspection + connected-style-path correlation + peer-selector correlation + style-code split correlation |
| 434 | 0x0043f610 | 13 | world_clear_station_detail_candidate_service_preview_pair_globals | map | cdecl | inferred | objdump + caller inspection + local disassembly | 1 | Tiny shared reset for the two preview globals at `0x005ee4fc` and `0x005ee500`. The helper writes `-1` into both lanes and returns. Current grounded callers are the shell-side preview clear and teardown paths in `StationDetail.win` at `0x00504a90` and `0x00505bf0`, where those globals hold the active `(station id, candidate id)` pair used by the world-side overlay scanner `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair reset helper. | objdump + caller inspection + local disassembly + preview-pair correlation |
| 435 | 0x0043f620 | 20 | world_store_station_detail_candidate_service_preview_pair_globals | map | cdecl | inferred | objdump + caller inspection + local disassembly | 1 | Tiny shared setter for the same preview globals at `0x005ee4fc` and `0x005ee500`. The helper stores its two caller dwords into those lanes unchanged and returns. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, where the pair is the active `(station id, candidate id)` selection later consumed by `world_render_station_candidate_service_map_overlay` `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair setter. | objdump + caller inspection + local disassembly + preview-pair correlation |
| 436 | 0x0043f640 | 3797 | world_render_station_candidate_service_map_overlay | render | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner. | objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check |
| 437 | 0x00439140 | 1086 | simulation_frame_accumulate_and_step_world | simulation | cdecl | inferred | objdump + analysis-context | 4 | Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup. | objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation |
| 438 | 0x00433a40 | 82 | shell_can_open_company_list_or_detail_panel_or_warn | shell | thiscall | inferred | objdump + caller inspection + shell-detail correlation | 4 | Shared availability gate above the shell-side company-list and selected-company-detail lanes. The helper reads scenario toggle `[0x006cec78+0x4aef]`; when that dword is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`, otherwise it returns `1`. Current grounded callers are the direct shell command branches `0x004405b3` and `0x0044062c`, plus the broader shell-strip and page-side handlers `0x004de2e3` and `0x004de3ae`, all of which open company-list or selected-company-detail panels only on success. This is therefore the safest current read for the company list/detail availability gate rather than a generic scenario-action blocker. | objdump + caller inspection + shell-detail correlation + modal-path correlation |
| 439 | 0x00433aa0 | 95 | shell_can_open_stockbuy_window_or_warn | shell | thiscall | inferred | objdump + caller inspection + stockbuy correlation | 4 | Shared availability gate above the shell-side `StockBuy.win` family. The helper first rejects scenario states where toggle `[0x006cec78+0x4aa7]` is nonzero, surfacing the same shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0`. When the scenario toggle allows the action, it still requires a nonzero selected-company id at `[scenario+0x21]`; if no company is currently selected it raises the sibling shell modal rooted at localized id `335` and returns `0`. Only the success path returns `1` to the callers at `0x00440673` and `0x004de50f`, both of which immediately open detail-panel mode `0x0c` that later refreshes through the `StockBuy.win` family. This is therefore the safest current read for the stock-buy availability gate rather than a generic company-selection check. | objdump + caller inspection + stockbuy correlation + modal-path correlation |
| 440 | 0x00433b00 | 117 | shell_can_open_trainbuy_window_or_warn | shell | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Shared availability gate above the shell-side `Trainbuy.win` family. The helper first rejects scenario states where the train-buy action is globally disabled through `[0x006cec78+0x4aa3]`, surfacing localized id `334` `That action is not allowed in this scenario.` through the shared shell modal path when blocked. It then checks whether the active company or world object state supplied by the caller allows train purchase; if no company is active it raises id `337` `You can't buy a train without starting a company first!`, and if no track has been placed it raises id `338` `You can't buy a locomotive until some track has been placed!`. Only the success path returns nonzero to the callers at `0x004406d3` and `0x004de7d9`, both of which immediately enter `shell_open_or_focus_trainbuy_window` at `0x00512c50`. | objdump + caller inspection + RT3.lng strings + train-buy gate correlation |
| 441 | 0x00434db0 | 91 | shell_can_open_detail_panel_mode_0x0b_or_warn | shell | thiscall | inferred | objdump + caller inspection + shell-detail correlation | 3 | Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the current bounded read for the mode-`0x0b` availability gate. | objdump + caller inspection + shell-detail correlation + modal-path correlation |
| 442 | 0x00434e20 | 128 | shell_can_open_detail_panel_mode_0x06_or_warn | shell | thiscall | inferred | objdump + caller inspection + shell-detail correlation | 3 | Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the current bounded read for the mode-`0x06` availability gate. | objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation |
| 443 | 0x00433b80 | 69 | scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Runs a small dispatcher of optional collection-side refresh hooks, but only when global mutation depth `0x0062be40` has fallen back to zero. On the active path it conditionally refreshes four live collection families through shell-state-controlled gates: the placed-structure collection at `0x006cec20` through `0x00481430`, the sibling placed-structure helper family at `0x0062b26c` through `0x00413860`, the train-side collection at `0x006cfcbc` through `0x004b2a90`, and the route-entry collection at `0x006cfca8` through `0x004931e0`. Current grounded callers include the periodic maintenance branch at `0x0040a914`, the placed-structure finalize path at `0x0040f6b4` after it decrements `0x0062be40`, and several shell or editor mutation branches around `0x0049d3a8` and `0x00508f97/0x0050900a`. This is therefore the safest current read for the zero-depth optional collection-refresh dispatcher rather than a single collection owner. | objdump + local disassembly + caller correlation + zero-depth-dispatch correlation + collection-refresh correlation |
| 444 | 0x00433da0 | 367 | shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay | shell | cdecl | inferred | objdump + caller inspection + overlay-control correlation | 3 | Shared owner beneath the paired shell commands `0x00441260` and `0x004412a0` for the mode-`0x19` overlay family. The helper takes one caller-supplied presenter-state boolean and one variant selector, restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across the detail-panel control band `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and then forwards the same variant into world helper `0x0043a0a0`. Current grounded callers are the two registered shell commands that derive the presenter-state boolean from `[0x006d4024+0x114216] == 1` and pass variant `0` or `1`, which makes this the safest current read for the shared mode-`0x19` variant-open and overlay-refresh owner rather than another anonymous control restyler. | objdump + caller inspection + overlay-control correlation + mode-0x19 correlation + detail-panel transition correlation |
| 445 | 0x00439820 | 91 | world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet | shell | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Shared world-view helper beneath the local controller strip. The function samples five nearby heights through `0x00534490` at the current eye X/Z pair `[this+0x1c/+0x24]` and four axis-offset probes, keeps the highest sampled clearance, rounds and expands that limit through `0x0052d0c0` plus fixed scalar margins, and then compares the result against current eye height `[this+0x20]`. When the smoothed or clamped target exceeds the current eye height it republishes the eye triplet through `0x0052d1e0`; when local smoothing latch `[this+0x60]` is live it also uses gain `[this+0x34e]` and cached scalar `[this+0x34a]` before that republish. Current grounded callers are the shell-input controller path `0x0043a1d4`, the camera-restore and step buckets at `0x0043c967`, `0x0043cdd4`, `0x0043d0a6`, and the neighboring motion branches `0x0043e4d5` and `0x0043f427`, so this is the safest current read for the local clearance-ring clamp and republish helper rather than a generic terrain-height query. | objdump + caller inspection + local disassembly + world-view correlation + local-clearance correlation + eye-triplet correlation |
| 446 | 0x0043a0a0 | 76 | world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty | shell | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small world-view owner reached directly from the mode-`0x19` shell strip. The helper stores the inverse of its caller-supplied variant selector into presenter dword `[0x006d4024+0x114216]`, seeds four controller scalars through `0x0052d140` on the live world-view root `0x0062be68`, calls that same object's vtable slot `+0x00`, and then sets dirty byte `[world_view+0x65] = 1`. The seeded scalar quadruple is either `(1.0, 1.0, 0.0, 0.0)` or `(0.7, 1.0, 0.0, 0.0)` depending on the selected mode-`0x19` variant. Current grounded caller is `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`, so this is the safest current read for the world-view-side variant latch plus controller-blend seed owner rather than a generic shell flag setter. | objdump + caller inspection + local disassembly + world-view correlation + mode-0x19 correlation + controller-band correlation |
| 447 | 0x0043a1a0 | 61 | world_view_store_two_scaled_controller_inputs_and_mark_projection_dirty | shell | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small world-view helper over the same local controller strip. The helper scales its two caller floats by `100.0`, forwards them together with current controller dword `[this+0x0c]` into `0x0052d180`, forces controller scalar `[this+0x34e] = 1.0`, and then re-enters `0x00439820` to refresh the dependent view-projection state. Current grounded caller is `shell_world_view_apply_one_normalized_input_pair_from_shell_frame` `0x00516837`, which makes this the safest current read for the two-input controller setter plus projection-dirty publish rather than a higher-level camera mode owner. | objdump + caller inspection + local disassembly + world-view correlation + controller-input correlation + projection-refresh correlation |
| 448 | 0x0043a1e0 | 890 | world_view_service_controller_transient_offsets_and_selection_handle | shell | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Broader world-view-side service owner above the same controller strip. When activation dword `[this+0x38e]` is nonzero, the helper derives time-varying transient offsets into `[this+0x3a6/+0x3aa/+0x3ae]` from the current timer fields `[+0x392/+0x396]` and several fixed scalar thresholds, updates or clears one selection-like handle at `[this+0x3b2]` through `0x00531790` and `0x005317b0`, and can drop the activation dword plus all three offsets back to zero when the transient expires. On the live path it also republishes the accumulated offset-adjusted controller position through `0x0052d180` and restores controller gain `[this+0x34e] = 1.0`. Current grounded callers are the recurring simulation-frame path `0x0043916c`, the selection-side refresh strip at `0x0043bd1a`, and the neighboring motion branch at `0x0043e2a4`, so this is the safest current read for the controller transient-offset and selection-handle service owner rather than a static constructor or one-shot callback. | objdump + caller inspection + local disassembly + world-view correlation + transient-offset correlation + selection-handle correlation |
| 449 | 0x0043a560 | 64 | world_view_release_controller_selection_handle_and_reset_embedded_controller_base | shell | thiscall | inferred | objdump + local disassembly + caller inspection | 2 | Teardown-side sibling for the same world-view controller family. The helper temporarily restores one local vtable root at `[this]`, releases selection-like handle `[this+0x3b2]` through `0x005317b0(0)` when it is still live, clears the matching presenter-side owner slot through `0x0052d3e0`, and then tail-jumps into the embedded controller-base reset at `0x0052d570`. This is the safest current read for the controller-family release and base-reset helper rather than a generic shell singleton destructor. | objdump + local disassembly + caller inspection + world-view correlation + controller-reset correlation + selection-handle correlation |
| 450 | 0x0043a5a0 | 421 | world_view_construct_reset_controller_state_and_seed_keyboard_bindings | shell | thiscall | inferred | objdump + local disassembly + caller inspection | 2 | Broader world-view constructor or reset owner above the same controller strip. The helper first resets the embedded controller base through `0x0052d5a0`, clears a large local scalar and handle band rooted at `[this+0x8a..+0x38e]`, seeds a few fixed defaults such as `[this+0x38a] = -999.0f` and `[this+0x34e] = 1.0f`, and then tail-jumps into `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`. The resulting boundary is strong enough to treat this as the real world-view reset and keyboard-binding seed owner rather than a small camera-only helper. | objdump + local disassembly + caller inspection + world-view correlation + reset-owner correlation + keyboard-binding correlation |
| 451 | 0x0043ac30 | 235 | world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars | shell | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Load-side world-view owner above the embedded controller snapshot loader. The helper first releases any pending helper handle from `[this+0x3b2]` through `0x005317b0`, clears presenter owner slot through `0x0052d3e0`, and resets the local controller strip through `0x0043a5a0`. It then loads one stored camera-view snapshot from the caller stream through `0x0052d750`, conditionally reads either `8` or `10` extra `0x30`-byte rows into `[this+0x10e]` according to startup-side scalar `[0x006cec78+0x46c34]`, consumes one trailing `0x14`-byte block, reseeds the four controller blend scalars through `0x0052d140(0, 0, 1.0, 0.7)`, calls vtable slot `+0x10`, and finally normalizes the heading lane `[this+0x10]`. Current evidence is strongest for a camera-snapshot load owner with one optional extra-row band rather than a generic stream-reader wrapper. | objdump + caller inspection + local disassembly + world-view correlation + stream-load correlation + controller-base correlation |
| 452 | 0x0043bde0 | 2037 | world_view_refresh_dependent_projection_visibility_and_presentation_scalars | shell | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Broader dependent-refresh owner beneath the same world-view family. After re-entering `0x00439be0`, the helper derives one large band of projection, visibility, and presentation-side scalars from the current focus and eye triplets `[this+0x04..+0x24]`, current controller defaults `[+0x38/+0x3c/+0x40/+0x44/+0x4c]`, world-side mode gates, and several fixed threshold tables. Along that path it calls `0x0052cec0`, `0x00484af0`, `0x00533100`, `0x0043a940`, and repeated world-cell validity checks through `0x00534e50`, and can set dirty byte `[this+0x65]` when the resulting bounds or visibility envelopes move outside tolerated ranges. Current grounded callers are the camera-restore path `0x0043caee`, the heading and zoom-step paths `0x0043cb1d/0x0043cddb`, the shell-input controller service `0x00516842`, and several neighboring motion branches, so this is the safest current read for the world-view dependent projection and presentation refresh owner rather than a smaller math helper. | objdump + caller inspection + local disassembly + world-view correlation + projection-refresh correlation + presentation-scalar correlation |
