| 1 | address | size | name | subsystem | calling_convention | prototype_status | source_tool | confidence | notes | verified_against |
|---|
| 2 | 0x004010f0 | 521 | city_compute_connection_bonus_candidate_weight | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Computes one city-side weight for the connection-bonus news and placement lanes. The helper rejects early when the city subtype field `[this+0x23e]` is nonzero, then builds a base float from the city-side scalar fields `[this+0x306]`, `[this+0x30a]`, and `[this+0x30e]`. When the optional stack company id is nonzero it also resolves the city's derived coordinates through `0x00455800` and `0x00455810`, probes the live world root at `0x0062c120` through `0x0044e270`, and rejects the city unless the selected company passes the follow-on world-side ownership or access check through `0x00424010`. The helper then scans the live placed-structure collection at `0x006cec20`, filters peers through `0x0041f6e0` plus the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, counts qualifying linked sites in the city, and detects whether one rival company already has an eligible linked site there. The final weight is scaled down by the inverse of `(qualifying_site_count + 1)` and then further damped when rival ownership is present, so the current grounded meaning is a city connection-bonus opportunity weight rather than a simple population or size score. Current grounded callers are the company-side news sweep at `0x00406050` and one neighboring setup-side branch at `0x00404d90`. | objdump + caller xrefs + callsite inspection + city-bonus correlation |
| 3 | 0x004014b0 | 1194 | company_try_buy_unowned_industry_near_city_and_publish_news | simulation | thiscall | inferred | objdump + callsite inspection + RT3.lng strings | 2 | Company-side acquisition and headline helper beneath the broader periodic company service pass at `0x004019e0`. The function requires at least two linked transit sites through `company_count_linked_transit_sites` `0x00426590`, rejects when scenario finance toggle `[0x006cec78+0x4abf]` is set, and then scans the live building or structure collection at `0x0062b26c` for the best current acquisition target. Current grounded candidate filters are: the record must not already have an owner in `[site+0x276]`, its linked candidate subtype gate through `0x0040d360` must identify subtype `4`, the company-specific price or affordability metric from `0x0040d540` must stay below the current company metric window, and the record must be at least three years old from `[site+0x3d5]`. Surviving candidates are scored through local profitability or demand helpers around `0x0040cac0`, `0x0042c820`, `0x00455f60`, and the current company support scalar, and the best surviving site id is then committed through `0x004269b0`. On success the helper localizes the acquired structure type through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`, resolves the nearby city or region entry through `0x004220b0`, and emits RT3.lng `2880` `%1 has bought a %2 near %3` through the shell news helper at `0x004554e0`. This is now the strongest current match for the acquisition-side sibling beneath the broader company periodic pass, though some lower structure-side helper semantics remain open. | objdump + callsite inspection + RT3.lng strings + acquisition-news correlation + structure-scan correlation |
| 4 | 0x00401860 | 221 | company_query_cached_linked_transit_route_anchor_entry_id | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Returns one cached route-entry anchor id used by the linked-transit company cache family. The helper first validates the cached id at `[this+0x0d35]` against the live route-entry collection `0x006cfca8`, requiring the resolved record to carry this company id in word `[entry+0x22e]` and byte value `2` in `[entry+0x216]`; otherwise it clears the cache to `-1`. When the cache is empty but the three company-side count lanes `[this+0x7664]`, `[this+0x7668]`, and `[this+0x766c]` still sum positive, it scans the route-entry collection for the first record that satisfies those same owner and class predicates and then caches the record's linked anchor id from `[entry+0x202]`. Current grounded caller is `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`, where the returned route-entry id is used as the company-side anchor for the narrower linked-transit reachability gate. | objdump + caller xrefs + callsite inspection + route-entry-anchor correlation |
| 5 | 0x00401940 | 152 | company_reset_linked_transit_caches_and_reseed_empty_train_routes | simulation | thiscall | inferred | objdump + callsite inspection + linked-transit correlation | 2 | Small linked-transit reset helper beneath the broader company service family. The function clears the two company-side linked-transit cache timestamps at `[this+0x0d3e]` and `[this+0x0d3a]`, immediately re-enters `company_service_linked_transit_site_caches` `0x00409720`, and then walks the live train collection `0x006cfcbc` for company-owned trains. For owned trains in operating modes `0x0a` or `0x13` it removes every existing route-list entry through `train_route_list_remove_entry_and_compact` `0x004b3000`; when the route list is empty it then re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770`. Current grounded meaning is a local linked-transit cache reset plus empty-route reseed pass rather than a broader train-service sweep. | objdump + callsite inspection + linked-transit correlation + train-route-reset correlation |
| 6 | 0x004019e0 | 611 | company_service_periodic_city_connection_finance_and_linked_transit_lanes | simulation | thiscall | inferred | objdump + callsite inspection + caller correlation + RT3.lng strings | 2 | Broader periodic company-side service pass above the currently grounded city-connection, finance, and linked-transit lanes. The helper first rejects inactive or special-case companies through `[this+0x3f]` and `0x00425b90`, clears the transient company-side latches at `[this+0x0d17]`, `[this+0x0d18]`, and `[this+0x0d56]`, and temporarily mirrors one locomotive-derived byte from `[this+0x0d17]` into scenario field `[0x006cec78+0x4c74]` while the earlier route-building side of the body runs, restoring the original scenario value on exit. Current evidence now bounds those byte latches more narrowly: `[this+0x0d17]` is this transient route-search preference override, currently seeded only when `company_select_preferred_available_locomotive_id` `0x004078a0` resolves one locomotive whose engine-type dword `[record+0x10]` equals `2`; wider engine-type evidence now makes that best-read as the electric lane, since the linked approval helper around `0x0041d550` dispatches the same `0/1/2` field across three scenario opinion slots while the local language family `706..709` and help text `3848` bound the player-facing triplet as `Steam`, `Diesel`, and `Electric`. The route-search side is tighter now too: this mirrored byte is not just reusing a display preference slot abstractly, it feeds the same initial path-sweep branch in `route_entry_collection_run_initial_candidate_path_sweep` `0x0049bd40` that explicit route-policy byte `4` uses, selecting the larger `1.8` quality multiplier instead of `1.4` before the later acceptance checks. `[this+0x0d18]` is the city-connection announcement-side latch reused by `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; and `[this+0x0d56]` is the linked-transit train-service latch later set by the train-add, train-upgrade, and route-builder-side cache-refresh family around `0x00409830`, `0x00409300`, and `0x0040457e -> 0x004093d0`. The ordering matters too: this owner clears those latches up front, runs the city-connection and linked-transit branches first, and only later enters `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, so the finance helper is reading same-cycle side-channel state rather than stale long-lived flags. It then gates and schedules several narrower service families: the city-connection announcement side through `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` and `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; the acquisition-side sibling through `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`; the linked-transit train side through `company_balance_linked_transit_train_roster` `0x00409950`; the broader annual finance and governance helper through `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`; and the linked-transit cache refresh tail through either `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` or `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` depending on current scenario mode byte `[0x006cec78+0x0f]`. This name stays intentionally conservative: it is the broader periodic owner above those lanes, not a fully split policy map yet. | objdump + callsite inspection + caller correlation + RT3.lng strings + linked-transit correlation + city-connection correlation + acquisition correlation + latch correlation + sequencing correlation + temporary-route-preference correlation + locomotive-choice correlation + engine-type correlation + route-search-threshold correlation |
| 7 | 0x004078a0 | 815 | company_select_preferred_available_locomotive_id | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Selects one preferred locomotive id for the current company from the live locomotive collection at `0x006ada84`. The helper iterates the live locomotive records, applies company-and-chairman availability gating through the linked approval family around `0x0041d550`, accumulates one weighted preference score from locomotive fields `[record+0x20]`, `[+0x28]`, `[+0x18]`, `[+0x1c]`, `[+0x0c]`, and the linked class or era record at `[record+0x72]`, and keeps the strongest surviving locomotive id, falling back to `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0` when no scored candidate survives. Current grounded callers are the periodic company service pass `0x004019e0`, the temporary route-side mode chooser around `0x00402d5f`, the linked-transit train-upgrade news helper `0x00409300`, and the linked-transit train-add helper `0x00409830`. Current evidence now also bounds one route-policy side effect above it: `0x004019e0` only arms its temporary `[company+0x0d17] -> [0x006cec78+0x4c74]` override when the chosen locomotive record carries engine-type value `2` in `[record+0x10]`, which now best aligns with the electric lane rather than an unnamed class slot. | objdump + caller xrefs + callsite inspection + locomotive-collection correlation + preferred-choice correlation + engine-type correlation |
| 8 | 0x00401c50 | 3016 | company_evaluate_annual_finance_policy_and_publish_news | simulation | thiscall | inferred | objdump + callsite inspection + RT3.lng strings | 2 | Large annual company finance-policy helper beneath the broader periodic service pass at `0x004019e0`. The earliest creditor-pressure or bankruptcy lane is now bounded more tightly: it requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since the last bankruptcy stamp at `[this+0x163]`, and at least `4` years since founding year `[this+0x157]`. It then scans the last three years of derived finance lanes through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, accumulating the net-profits lane `0x2b`, counting one three-year failure condition from the revenue aggregate `0x2c`, selecting one negative cash-and-debt stress ladder `-600000 / -1100000 / -1600000 / -2000000` from the current slot-`0x2c` band split at roughly `120000 / 230000 / 340000`, requiring the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` to be at least `15` or `20` depending on whether all three years failed, checking the current fuel-cost lane in slot `0x09` against `0.08` times that ladder, and requiring both `edi >= 2` plus the three-year slot-`0x2b` accumulator to clear one final `-60000` threshold before it commits bankruptcy through `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90` and formats RT3.lng `2881` `%1 has declared bankruptcy!`. The helper also has one later deep-distress fallback bankruptcy lane on the no-action fallthrough before the build-`1.03+` stock-issue branch: with the same bankruptcy toggle clear, current cash below `-300000`, at least `3` years since founding, no recent automatic finance action already chosen, the first three recent net-profits lanes each at or below `-20000`, and at least `5` years since the last bankruptcy stamp, it commits the same bankruptcy path and news family again. The later debt-capital restructuring family mutates the live company through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, `company_issue_bond_and_record_terms` `0x004275c0`, `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and `company_issue_public_shares_and_raise_capital` `0x00427450`, then formats the RT3.lng `2882..2886` headlines `%1 has refinanced %2 of debt.`, `%1 has refinanced %2 of debt and borrowed %3 on top of that.`, `%1 has refinanced %2 and paid off a further %3 of debt.`, `%1 has paid off %2 of its debt.`, and `%1 has borrowed %2 in debt.` The message-side tail is tighter now too: it accumulates total retired principal in one counter and total newly issued principal in another, then chooses the debt headline family by comparing those two totals directly: equal -> `2882` refinance only, issued greater -> `2883` refinance plus extra borrowing, retired greater -> `2884` refinance plus additional payoff, issued zero -> `2885` debt payoff only, and retired zero with issued positive -> `2886` straight new borrowing. The middle annual bond lane is tighter now too: when the bond toggle `[+0x4a8b]` is clear, it first simulates full bond repayment through repeated `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, then uses the resulting cash-side window with the fixed `-250000` and `-30000` thresholds plus the broader linked-transit train-service latch `[this+0x0d56]` to decide whether to stage one or more `500000` principal, `30`-year bond issues through `company_issue_bond_and_record_terms` `0x004275c0`. The repurchase lane is distinct from the later share-issue path: when the city-connection announcement-side latch `[this+0x0d18]` is set, editor growth setting `2` does not suppress it, and the stock toggle `[+0x4a87]` is clear, it starts from one `1000`-share batch and one default factor `1.0`, can replace that with a linked-chairman personality scalar `([table byte * 39] + 300) / 400`, scales that factor by `1.6` when growth setting `[0x006cec78+0x4c7c] == 1`, uses the resulting factor in one `800000` stock-value gate and one support-adjusted share-price scalar times factor times `1000` times `1.2` affordability gate, requires enough unassigned shares through `company_count_unassigned_shares_after_active_chairman_holdings` `0x004261b0`, and then commits repeated `1000`-share repurchases through `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`; this is the current strongest threshold owner behind RT3.lng `2887`. The repurchase tail also now reads cleanly: it accumulates the total repurchased public-share count in a dedicated counter and publishes `2887` from that total after the debt headline branch. The sequencing above this helper now bounds those two latch reads more clearly: `0x004019e0` clears them first, then the city-connection and linked-transit branches may set them earlier in the same periodic pass, so the bond and repurchase lanes are currently best read as same-cycle reaction policy rather than long-term company-state policy. The later stock-issue lane is now tighter in exact order, not just broad shape: it only opens on build `1.03+`, only after the earlier bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since founding. It derives one prospective equity tranche from roughly one-tenth of the current outstanding-share count, rounded down to `1000`-share lots with floor `2000`, trims that tranche downward until the pressured support-adjusted share-price scalar times tranche no longer exceeds the `55000` proceeds cap, recomputes the same share-price scalar under the negative tranche pressure term, clamps `Book Value Per Share` from stat-family `0x2329/0x1d` to a minimum `1.0`, and forms the normalized price-to-book ratio before any approval tests. The tested gates then run in a fixed order: share-price floor `>= 22`, pressured proceeds floor `>= 55000`, current cash from `0x2329/0x0d` against the highest-coupon live bond principal plus the fixed `5000` buffer, one later issue-cooldown or last-issue timestamp gate from `[this+0x16b..]`, and only then the piecewise coupon-versus-price-to-book ladder `0.07/1.3`, `0.08/1.2`, `0.09/1.1`, `0.10/0.95`, `0.11/0.8`, `0.12/0.62`, `0.13/0.5`, and `0.14/0.35`. On success it issues two same-sized public-share tranches through repeated `company_issue_public_shares_and_raise_capital` `0x00427450` calls and formats a separate equity-offering news family rooted at localized id `4053`, not the earlier `2882..2887` debt-or-buyback headlines. The dividend-side branch is now bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be clear, scenario mode `0x0c`, at least `1` year since `[this+0x0d2d]`, and at least `2` years since founding; it then converts a weighted `3/2/1` blend of the last three net-profits lanes `0x2b` into one tentative dividend-per-share target, supplements that target with current cash only on the tiny-unassigned-share branch below `1000`, and still folds in the map-editor building-density growth setting `[0x006cec78+0x4c7c]`. Current grounded postblend behavior is: growth setting `1` scales the existing dividend by `0.66`, growth setting `2` zeros it, computed deltas at or below `0.1` collapse to zero, larger deltas are quantized in tenths, and the final value is clamped against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. The tail also refreshes `CompanyDetail.win` when the selected company matches `[0x006cfe4c]`. This now grounds the main finance verbs and first-layer threshold ordering under the annual policy pass, though some lower helper semantics still remain open. | objdump + callsite inspection + RT3.lng strings + finance-policy correlation + bankruptcy/debt-news correlation + repurchase-news correlation + equity-offering-news correlation + finance-mutator correlation + threshold correlation + latch correlation + sequencing correlation + stock-data-label correlation + highest-coupon-bond correlation + income-statement-row correlation + derived-report-metric correlation + valuation-vs-borrowing correlation + weighted-dividend-target correlation + deep-distress-bankruptcy correlation + debt-headline-tail correlation + repurchase-headline-tail correlation + stock-issue-ordering correlation |
| 9 | 0x00402c90 | 19 | placed_structure_resolve_linked_candidate_record | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Tiny placed-structure-to-candidate resolver over the global candidate collection at `0x0062b268`. The helper reads one candidate id from `[this+0x173]`, re-enters the shared indexed-collection record resolver at `0x00518140`, and returns the resulting candidate record pointer. Current grounded caller is the BuildingDetail-side branch at `0x00506441`, where it is used immediately after resolving one placed-structure record from `0x0062b2fc`. This now looks like the direct placed-structure linked-candidate accessor rather than another anonymous local helper. | objdump + caller xrefs + callsite inspection + collection-resolver correlation |
| 10 | 0x00402cb0 | 3457 | city_connection_try_build_route_with_optional_direct_site_placement | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Shared heavy route-builder and optional direct-placement helper beneath the city-connection route and news family. The function starts at a clean prologue at `0x00402cb0`, seeds one builder-state latch band at `[this+0xf5]`, `[this+0xf6]`, `[this+0xf8]`, `[this+0xfa]`, `[this+0xfc]`, and `[this+0x10a]`, and then splits into three grounded internal lanes. The first is an early route-entry search or synthesis lane through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` over the global route-entry store `0x006cfca8`, which can seed the builder-state block and succeed without placing a new site. The second is a single-endpoint direct-placement lane around `0x00403d92..0x00403ef3`: it scans the live placed-structure collection `0x0062b2fc` for `Maintenance` and `ServiceTower` stems, projects one candidate placement through `0x00417840`, validates it through `0x004197e0`, and then commits through the first direct placement branch `0x00403ed5 -> placed_structure_collection_allocate_and_construct_entry` `0x004134d0` -> `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`. The third is a later paired-endpoint fallback lane around `0x00403f41..0x00404489`: it seeds two endpoint candidates from the same `Maintenance` and `ServiceTower` stem scan, builds one temporary route-entry candidate list, iterates that list against span and year-scaled step terms, projects trial placements through `0x00417840`, and on success commits through the second direct placement branch `0x0040446b -> 0x004134d0 -> 0x0040ef10` before clearing a small exclusion window in the temporary list. Outside those lanes it also re-enters geometry, region, and route-store helpers around `0x004423a0`, `0x00482e00`, `0x004931e0`, `0x00494310`, and the global route-entry stores `0x006cfcb4` / `0x006cfca8`, and it can still unwind through route-state cleanup without committing new placed structures. Current grounded external callers are still entirely in the city-connection family: the compact region-entry wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` `0x00404640`, the peer-route candidate builder `city_connection_bonus_build_peer_route_candidate` `0x004046a0`, the direct region-entry pair wrapper `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`. This now bounds the old unresolved `0x00403xxx..0x00404631` placement chooser as one shared city-connection route or placement helper with a cleaner internal policy split, even though some lower helper semantics remain open. | objdump + caller xrefs + callsite inspection + placement-correlation + route-builder correlation + Maintenance/ServiceTower scan correlation + route-entry search correlation |
| 11 | 0x004046a0 | 1388 | city_connection_bonus_build_peer_route_candidate | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Reusable candidate builder beneath the city-connection bonus news and status family. The helper starts from one region or city entry in the collection at `0x0062bae0`, samples that entry's two derived coordinate terms through `0x00455800` and `0x00455810`, then re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` with both selector flags forced on so it can recover one representative connected peer site. When a peer is found it samples the peer's derived coordinates through `0x0047df30` and `0x0047df50`; when an explicit caller-owned route anchor is present it first tries the heavier route builder at `0x00402cb0`, otherwise it falls back to the smaller helper at `0x00404640`. If neither early path succeeds the function collects one local candidate band from the two global route-entry stores at `0x006cfcb4` and `0x006cfca8`, filters those entries against the current city id and several route-state predicates, computes one compact bounding window around each surviving candidate, and then chooses the best remaining candidate by smallest span before retrying `0x00402cb0`. Current grounded callers are the wider company-side city-connection bonus sweep at `0x00406050` and one neighboring branch at `0x00406b73`, which together make this look like the shared peer-route candidate builder above the city bonus peer-selector family rather than a direct UI formatter. | objdump + caller xrefs + callsite inspection + peer-selector correlation + route-builder correlation |
| 12 | 0x00404640 | 82 | city_connection_bonus_try_compact_route_builder_from_region_entry | map | thiscall | inferred | objdump + caller inspection + route-builder correlation | 3 | Small route-builder helper beneath `city_connection_bonus_build_peer_route_candidate` `0x004046a0`. The helper resolves one caller-supplied region or city entry id through collection `0x0062bae0`, derives that entry's compact coordinate pair through `0x00401000`, reads one explicit route-anchor or peer-site id from `[this+0x00]`, and then re-enters the heavier route builder at `0x00402cb0` with that resolved coordinate pair plus default wildcard arguments `-1/0/-1` in the remaining route slots. Current grounded caller is the city-connection bonus candidate builder at `0x004047bf`, where this helper is used as the smaller fallback path when the earlier explicit-anchor route attempt does not apply. This now looks like the compact region-entry wrapper around the shared route builder rather than a generic coordinate helper. | objdump + caller inspection + route-builder correlation + city-bonus fallback correlation |
| 13 | 0x00404c60 | 124 | city_connection_try_build_route_between_region_entry_pair | map | fastcall | inferred | objdump + caller inspection + route-builder correlation | 3 | Compact fastcall route-builder above the shared route store at `0x006cfca8`. The helper resolves the two caller-supplied region or city entry ids through collection `0x0062bae0`, derives both endpoint coordinate pairs through `0x00401000`, and then re-enters the heavier route builder at `0x00402cb0` with those two endpoints plus the caller's remaining stack-side policy tuple. Current grounded callers are the pair-selection sweeps inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`, where it is used both for the early dense score matrix and the later selected-pair retry. This now looks like the direct region-entry pair wrapper around the shared route builder rather than another anonymous internal callsite. | objdump + caller inspection + route-builder correlation + pair-selection correlation |
| 14 | 0x00404ce0 | 3124 | simulation_try_select_and_publish_company_start_or_city_connection_news | simulation | fastcall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Broad fastcall city-pair chooser and news publisher above `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`. When the stack company-id argument is zero the helper sweeps up to `0xa0` region-or-city entries from `0x0062bae0`; when it is nonzero it first validates that company through collection `0x0062be10`, stat family `0x2329` mode `0x0d` via `0x0042a5d0`, and the territory-access gate `0x00424010`. Eligible city entries are filtered through `city_connection_bonus_exists_matching_peer_site` `0x00420030`, weighted through `city_compute_connection_bonus_candidate_weight` `0x004010f0`, damped by map-size terms, territory access, and current region flags, and stored into temporary score bands. The helper then builds one dense pair matrix, repeatedly re-enters `0x00404c60` to validate candidate city pairs, can update one company-side selected endpoint pair through `0x00426f20`, and finally publishes shell news through `0x004554e0`. Current grounded publication ids are `2889` `%1 has started a new company - the %2` and `2890` `%1 has connected %2 to %3.`. Current grounded callers are `0x00401455`, which temporarily clears region-state dwords `[0x006cfc9c+0x2d]` before a global pass, and `0x00401b36`, which re-enters the same chooser with the active company and linked chairman after the smaller company-side city-connection bonus lane falls through. This now looks like the broader company-start-or-city-connection headline chooser above the smaller city-connection bonus sweep at `0x00406050` rather than another anonymous route-builder. | objdump + caller inspection + RT3.lng strings + route-builder correlation + pair-selection correlation + publication-path correlation |
| 15 | 0x00405920 | 189 | company_query_min_linked_site_distance_to_xy | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Queries the minimum distance from one company to an input X or Y point pair. The helper walks the live placed-structure collection at `0x006cec20`, keeps only sites whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, samples each surviving site's derived coordinates through `0x0047ded0` and `0x0047df00`, and then computes one scalar distance against the caller-supplied coordinate pair through `0x0051dbe0`. It returns the minimum observed distance across all linked sites, clamped to a floor of `1.0` when a closer or degenerate result would go lower. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where this helper provides the distance term later blended into each city candidate score. | objdump + caller xrefs + callsite inspection + distance-term correlation |
| 16 | 0x00406050 | 2966 | company_evaluate_and_publish_city_connection_bonus_news | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Broader company-side city-connection bonus sweep above `city_connection_bonus_build_peer_route_candidate` at `0x004046a0`. The function starts by building one announcement-value floor from several company-side support or governance helpers: the generic metric readers at `0x0042a5d0` and `0x00426ef0`, the linked transit-site counter `company_count_linked_transit_sites` at `0x00426590`, the small bonus-lane gate at `0x00427590`, and the longer company value ladder at `0x00425320`. Once that floor is high enough it walks the region-or-city collection at `0x0062bae0` and computes one per-city opportunity score from three terms: the city-side opportunity weight from `city_compute_connection_bonus_candidate_weight` at `0x004010f0`, the minimum linked-site distance from `company_query_min_linked_site_distance_to_xy` at `0x00405920`, and one city-side coordinate or spacing term around `0x00455800` and `0x00455810`. Those city scores are then adjusted by rival-company presence, chairman-profile scaling, the map-editor building-density setting at `0x006cec78+0x4c78`, and a linked-transit-site-count cap before the function keeps up to ten city ids in the persistent band at `[this+0x0d42]`. It repeatedly re-enters `city_connection_bonus_build_peer_route_candidate` to validate the best remaining entry, and when one validated winner survives it formats company and city names into the localized news strings `2888` `%1 has connected to %2.`, `2890` `%1 has connected %2 to %3.`, or `2921` `%1 has put a station in %2, but to win the %3 connection bonus, this station must be connected to ANOTHER city.` before publishing the result through the shell news helper at `0x004554e0`. When no winner survives it sets the byte latch at `[this+0x0d18]` instead. This is now the first grounded announcement owner above the city-connection bonus status formatter and peer-selector pair rather than just an anonymous caller around `0x004064c0`. | objdump + caller inspection + RT3.lng strings + peer-route candidate correlation + publication-path correlation + score-component correlation |
| 17 | 0x00407bd0 | 1697 | company_rebuild_linked_transit_autoroute_site_score_cache | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Slower per-company follow-on above the fast linked-transit peer cache. The helper stamps the current scenario tick into `[this+0x0d3a]`, then walks the live placed-structure collection and keeps only sites whose company-side cache cell at `[site+0x5bd][company_id]` is present and eligible. For each such site it refreshes the cache-cell tick at `+0x0a`, zeroes the three accumulated float lanes at `+0x0e`, `+0x12`, and `+0x16`, and then rebuilds those lanes from two phases. First it uses `placed_structure_count_candidates_with_local_service_metrics` `0x0047e330`, `0x0047e620`, and the issue-opinion helper `0x00437d20` to populate bounded candidate-local amount bands at stack `0x1a0..` and normalized scaling bands at `0x350..`. Then it re-enters the per-site peer buffer at cache `+0x06`, resolves each peer site's live service words through `0x0047de20`, and only keeps candidate lanes whose local amount still exceeds the peer baseline. The surviving excess amount accumulates raw into cache float `+0x12`, while the continuity share at peer float `+0x09` and route-step count at peer dword `+0x05` feed a second step-biased weighted accumulator in cache float `+0x0e` through the local `+0x28` denominator bias. A later grouped promotion pass chooses the strongest adjacent candidate bands and folds their weighted contribution into cache float `+0x16`, which is the final site-ranking lane consumed by the downstream site selector. That split now matters for the tracker compatibility question too: the pre-`1.03` versus `1.03+` pair-metric dispatcher at `0x004a65b0` can perturb peer step counts and continuity share, but on current evidence that only flows into the weighted `+0x0e` and promoted `+0x16` lanes, not the raw `+0x12` amount total. Current grounded callers are the company-side mode gate at `0x00401c2a`, the timed wrapper at `0x00409766`, and the fast-cache tail path at `0x004093cd`. This now reads as the slower autoroute-site score rebuild over the linked-transit peer cache family rather than an unnamed tail call. | objdump + caller xrefs + callsite inspection + linked-transit score-cache correlation + linked-transit consumer correlation + version-compatibility impact correlation |
| 18 | 0x00408280 | 255 | company_select_best_owned_linked_transit_site_by_autoroute_score | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Selects one owned linked transit site from the company-side autoroute cache family. The helper walks the live placed-structure collection, keeps only sites whose company cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the station-or-transit gate `0x0047fd50`. It then ranks the surviving sites by cache float `[cell+0x16]`, applying a small bonus when the placed-structure-side lanes `[site+0x5c1]` and `[site+0x5c5]` are both clear, and returns the winning site id or `-1` when no candidate survives. Current grounded caller is `company_build_linked_transit_autoroute_entry` `0x00408380`, where this helper provides the fallback start site when the caller does not already supply one. | objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation |
| 19 | 0x00408380 | 3215 | company_build_linked_transit_autoroute_entry | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. The downstream effect boundary is tighter now too: because this builder ranks peer-site candidates from the weighted peer-derived bands rather than the raw site totals, the pre-`1.03` versus `1.03+` tracker metric split is now best read as perturbing autoroute peer choice and seeded route-entry selection here, not the later company-wide train-pressure target at `0x00408f70`. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query. | objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation + version-compatibility impact correlation |
| 20 | 0x00408f70 | 864 | company_compute_owned_linked_transit_site_score_total | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Aggregates one company-side linked-transit train-pressure target from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the raw site score float at cache offset `+0x12` across the surviving sites while also retaining the first two representative site pointers and the eligible-site count. It then converts that raw total into the returned roster target through a year-dependent divisor ladder, later year-side multipliers, and site-count bands. On build `1.03+`, when exactly two eligible sites survive, it also measures the inter-site distance between those retained sites and applies an extra distance-side scaling branch before the final train-balance comparison. The compatibility boundary is now tighter too: because this helper sums cache `+0x12` rather than the weighted `+0x0e` or promoted `+0x16` lanes, current evidence says the pre-`1.03` versus `1.03+` tracker metric split does not directly change this company-wide roster target except through any earlier coarse candidate-survival effects, not through the step-count or continuity-weighting lanes themselves. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run. | objdump + caller xrefs + callsite inspection + linked-transit score-total correlation + linked-transit consumer correlation + version-compatibility impact correlation |
| 21 | 0x00409300 | 200 | company_publish_train_upgrade_news | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 3 | Formats and publishes the linked-transit train-upgrade news item. After one scenario gate through `[0x006cec78+0x4a97]`, the helper chooses one preferred locomotive id through `0x004078a0`, resolves the caller-supplied train id through the live train collection `0x006cfcbc`, formats the old and new locomotive names through the locomotive collection `0x006ada84` and the name helper at `0x00461ca0`, and then emits RT3.lng id `2897` `%1 has just upgraded a %2 to a %3.` through the shell news helper at `0x004554e0`. It finally sets the byte latch at `[company+0x0d56]`. Current grounded callers are the train-roster balancer at `0x00409950` and one neighboring branch at `0x00409b52`, so this now reads as the shared company-side train-upgrade headline helper rather than an anonymous news formatter. | objdump + caller xrefs + callsite inspection + RT3.lng strings + train-upgrade news correlation |
| 22 | 0x004093d0 | 837 | company_rebuild_linked_transit_site_peer_cache | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step count from `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` `0x004a6630`, and float `+0x09` stores the normalized continuity share computed from that step count and the companion mismatch-count output of the same helper. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`. | objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation + route-step-count correlation + continuity-ratio correlation |
| 23 | 0x00409720 | 80 | company_service_linked_transit_site_caches | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Timed service wrapper above the two company-side linked-transit cache lanes. The helper refreshes the fast peer cache through `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` when `[this+0x0d3e]` is zero or older than `0x7ff80` ticks, and otherwise refreshes the slower follow-on lane at `0x00407bd0` when `[this+0x0d3a]` is zero or older than `0x31380` ticks. Current grounded direct callers are `0x004097b8`, which re-enters it after one larger local mode change, and several neighboring company-side service paths. This now looks like the bounded timed owner for the company-side linked-transit cache family rather than another anonymous small wrapper. | objdump + caller xrefs + callsite inspection + timed-service correlation |
| 24 | 0x00409770 | 88 | train_try_append_linked_transit_autoroute_entry | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Attempts to append one linked-transit autoroute entry onto a live train route list. After validating the train-side state and one current route-kind gate through `0x004a8840`, the helper clears one local staging byte, re-enters `company_service_linked_transit_site_caches` `0x00409720` on the owning company, and then asks `company_build_linked_transit_autoroute_entry` `0x00408380` for a single staged `0x33`-byte route-list record using the current anchor site id at `[this+0x0a0]`. On success it either appends that record through `train_route_list_insert_staged_entry_at_index` `0x004b3160` and refreshes the new trailing selection through `train_route_list_select_entry_and_refresh_linked_site_state` `0x004b2f00`, or when the list is already at the local two-entry cap it rotates the target slot via `[this+0x08] mod [this+0x04]` and overwrites that `0x33`-byte entry in place. The weighted linked-transit cache lanes stay indirect here too: this helper inherits ranked site and peer choice only through `0x00408380`, not by reading cache `+0x0e/+0x16` itself. Current grounded caller is the company-side service sweep at `0x004019cc`, so this now reads as the single-entry train-side autoroute append helper rather than a two-entry seeding pass. | objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation + train-route-list correlation + weighted-consumer-boundary correlation |
| 25 | 0x00409830 | 274 | company_try_add_linked_transit_train_and_publish_news | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 3 | Local add-train branch beneath the linked-transit company train-roster balancer. The helper first respects scenario gate `[0x006cec78+0x4aa3]`, clears and seeds one staged route-entry buffer through `0x004b2ba0`, services the owning company's linked-transit caches, asks `company_build_linked_transit_autoroute_entry` `0x00408380` for two route-list entries, inserts those entries through `train_route_list_insert_staged_entry_at_index` `0x004b3160`, chooses one preferred locomotive id through `0x004078a0`, and then hands the staged route plus locomotive choice into the train-construction helper at `0x004b2140`. On success it emits RT3.lng id `2896` `%1 has added a new train (%2) at %3` through `0x004554e0` and sets the byte latch at `[company+0x0d56]`. The weighted linked-transit cache lanes stay indirect here too: this add-train path inherits ranked site and peer choice only through the two `0x00408380` builder calls, while the separate roster-pressure decision above it still comes from raw cache `+0x12` through `0x00408f70`. Current grounded callers are the local add branches inside `company_balance_linked_transit_train_roster` `0x00409950`, while multiplayer callers package opcode `0x75` instead. | objdump + caller xrefs + callsite inspection + RT3.lng strings + linked-transit train-add correlation + weighted-consumer-boundary correlation |
| 26 | 0x00409950 | 923 | company_balance_linked_transit_train_roster | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Balances one company's linked-transit train roster against the linked-site cache family. The helper first requires at least one linked transit site through `company_count_linked_transit_sites` `0x00426590`, then computes one aggregate train-pressure target through `company_compute_owned_linked_transit_site_score_total` `0x00408f70` and counts currently owned trains through `company_count_owned_trains` `0x004264c0`. It walks the live train collection `0x006cfcbc`, keeps only trains owned by the current company, derives one year-dependent age scalar from current scenario year `[0x006cec78+0x0d]`, and applies that scaled age against two thresholds. Very old trains above the upper band are either removed outright through the train collection vtable when the roster already exceeds target, or upgraded in place through `company_publish_train_upgrade_news` `0x00409300` when the target still needs capacity. Mid-age trains above the lower band can trigger one narrower upgrade branch when the roster is still below target. After pruning, it computes the remaining deficit between the aggregate target and the owned-train count, then repeatedly either packages multiplayer opcode `0x75` through `0x00469d30` or locally re-enters `company_try_add_linked_transit_train_and_publish_news` `0x00409830` until that deficit collapses, with one later add-train retry branch when the residual target is still high enough. Current grounded callers are the company-side service sweep at `0x00401b9d` and a neighboring company wrapper at `0x004097b8`, so this now looks like the live train-balance owner above the linked-transit autoroute and news helpers rather than an unnamed local maintenance pass. | objdump + caller xrefs + callsite inspection + linked-transit train-balance correlation + linked-transit consumer correlation |
| 27 | 0x004264c0 | 96 | company_count_owned_trains | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Counts the live trains owned by the current company. The helper walks the train collection at `0x006cfcbc`, compares each record's owning company byte at `[train+0x51]` against `[this+0x00]`, and returns the number of matches. Current grounded callers are the linked-transit train-roster balancer at `0x00409950` and the `LoadScreen.win` company train-list page at `0x004e7670`, where the count gates the no-trains fallback before the detailed roster rows are built. | objdump + caller xrefs + callsite inspection + company-owned train count correlation |
| 28 | 0x00426590 | 135 | company_count_linked_transit_sites | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Counts the live linked placed structures for this company that also pass the station-or-transit gate. The helper walks the placed-structure collection at `0x006cec20`, keeps only peers whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, requires the linked-instance class byte through `0x0047de00 -> 0x0040c990 == 1`, and optionally enforces the narrower station-or-transit predicate through `0x0047fd50` when the caller passes a nonzero stack flag. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where the helper contributes the current linked transit-site count used in the bonus-value ladder and later building-density caps. | objdump + caller xrefs + callsite inspection + connection-bonus count correlation |
| 29 | 0x00427590 | 47 | company_credit_rating_score_meets_threshold_5 | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Small boolean gate over the bounded company credit-rating score at `0x00425320`. The helper rejects immediately when scenario-state flag `0x006cec78+0x4a8b` is set or when the company-side count or age-like field `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument credit-rating score and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the neighboring branch around `0x004064a9`, so this is currently safest as a small reusable threshold gate over the same debt-market or company-strength score rather than a dedicated shell-only bond predicate. | objdump + caller xrefs + callsite inspection + credit-rating correlation + threshold-gate correlation |
| 30 | 0x00409e80 | 192 | world_set_selected_year_and_refresh_calendar_presentation_state | simulation | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small world-side year setter beneath the periodic step family and the later world-entry staged-profile rehydrate band. The helper stores the caller-supplied selected absolute calendar counter at `[this+0x15]`, resolves the paired mixed-radix calendar-point tuple through `0x0051d460` into `[this+0x0d/+0x11]`, recomputes several derived year-fraction or presentation scalars rooted at `[this+0x0bfa]`, refreshes the live shell controller at `0x006d4024` through `0x0051f070`, `0x00527c70`, and `0x00527c20`, and updates the controller's cached doubled-year field at `[controller+0x2c]`. When the unpacked year field at `[this+0x0d]` actually changes it also re-enters `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`. Current grounded callers are the smaller periodic-step wrapper at `0x0040a150`, the larger simulation-advance family through `0x0040a590/0x0040ab50`, and the late staged-profile rehydrate lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared selected-year/calendar refresh helper rather than a one-off world-entry setter. | objdump + caller inspection + local disassembly + periodic-step correlation + world-entry rehydrate correlation + year-bucket-companion correlation + calendar-counter model correlation |
| 31 | 0x0040a590 | 892 | simulation_service_periodic_boundary_work | simulation | cdecl | inferred | objdump + analysis-context | 3 | Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. Its scenario-runtime handoff is now explicit too: the grounded calls at `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3` re-enter `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kinds `1`, `0`, `3`, and `2` respectively. The route-style lane is tighter here now too: the neighboring recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, then later drives the same runtime-effect collection loop with trigger kinds `5` and `4` at `0x0040a930` and `0x0040a9ac`. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence. | objdump + analysis-context + caller xrefs + runtime-effect trigger-kind correlation |
| 32 | 0x0040ab50 | 339 | simulation_advance_to_target_calendar_point | simulation | cdecl | inferred | objdump + analysis-context | 3 | Advances the active world state toward one caller-selected mixed-radix calendar target while guarded by the recursion counter at `0x0062b240`. The helper compares the current local calendar-point tuple fields `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and `[this+0x14]` against a target resolved through `0x0051d550` and `0x0051d5f0`, then either recurses in larger `0x168`-sized chunks or advances through the smaller periodic step family rooted at `0x00409e80` and `0x0040a9c0`. Current tuple evidence now bounds this as the same mixed-radix counter family used by `0x0051d3c0/0x0051d460`: a packed year-plus-subfield calendar point rather than a plain year or month-only target. Each successful step notifies the live world root at `0x0062c120` through `0x00450030`. Grounded callers include the frame-time accumulator at `0x00439140`, the larger fast-forward helper at `0x00437b20`, and one shell UI command path. | objdump + analysis-context + caller xrefs + calendar-counter model correlation |
| 33 | 0x0040c950 | 18 | placed_structure_construct_concrete_specialization_vtable_5c8c50 | map | thiscall | inferred | objdump + allocator caller correlation + constructor chain inspection | 2 | Small constructor thunk used by the shared placed-structure allocator `0x004134d0`. The helper first re-enters `0x0045b680`, which seeds the common placed-structure base table `0x005cb4c0`, clears the derived field band `[this+0x23a..+0x26a]`, and re-enters the older base initializer `0x00455610`; it then installs the concrete placed-structure specialization table `0x005c8c50` and returns `this`. Current grounded callers are the live allocator path at `0x004134d0` and the temporary stack-object path at `0x00413363`, so this is the safest current read for the concrete placed-structure constructor thunk beneath the shared placement family rather than a standalone helper object constructor. | objdump + allocator caller correlation + constructor chain inspection + vtable install correlation |
| 34 | 0x0040c970 | 11 | placed_structure_reset_concrete_specialization_to_base_vtable_5cb4c0 | map | thiscall | inferred | objdump + allocator caller correlation + destructor chain inspection | 2 | Small cleanup or destructor-style thunk paired with `0x0040c950`. The helper briefly reinstalls the concrete specialization table `0x005c8c50`, then immediately tails into `0x0045b040`, which demotes the record back to the common base table `0x005cb4c0` and re-enters the base cleanup path `0x00455650`. Current grounded callers are the stack-object teardown sites at `0x00413363` and `0x0041353a`, both immediately before freeing or unwinding the temporary placed-structure object, so this is the safest current read for the specialization-to-base cleanup thunk rather than another constructor. | objdump + allocator caller correlation + destructor chain inspection + vtable demotion correlation |
| 35 | 0x0040c980 | 5 | placed_structure_serialize_concrete_specialization_payload_via_0x45b560 | map | thiscall | inferred | objdump + vtable scan + serializer chain inspection | 2 | Tiny serializer thunk in the concrete placed-structure specialization table `0x005c8c50`. The helper simply tails into `0x0045b560`, which first re-enters the common base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1/0x5dc2` over fields `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`. This is the safest current read for the specialization-side serializer entry rather than an independent data-writer. | objdump + vtable scan + serializer chain inspection |
| 36 | 0x0040cbc0 | 4 | placed_structure_clear_shared_byte42_state_flag | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `0`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct clear accessor over that shared site-state byte rather than a standalone semantic owner. | objdump + local disassembly + neighboring accessor correlation |
| 37 | 0x0040cbd0 | 4 | placed_structure_set_shared_byte42_state_flag | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `1`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct set accessor over that shared site-state byte rather than a standalone semantic owner. | objdump + local disassembly + neighboring accessor correlation |
| 38 | 0x0040cbe0 | 3 | runtime_object_false_stub_vtable_5cfd00_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 39 | 0x0040cbf0 | 5 | placed_structure_query_shared_byte42_state_flag | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny raw getter over shared placed-structure byte `[this+0x42]`, zero-extending that byte into `EAX`. Current local evidence keeps this on the same byte-lane as the direct setters `0x0040cbc0/0x0040cbd0` and the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0`, so this is the safest current read for the direct query accessor over that shared site-state byte. | objdump + local disassembly + neighboring accessor correlation |
| 40 | 0x0040cc00 | 6 | runtime_object_true_stub_vtable_5cfd00_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-true virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 41 | 0x0040cc10 | 3 | placed_structure_specialization_false_stub_vtable_5c8c50_slot0 | map | thiscall | inferred | objdump + vtable scan | 1 | Tiny pure-false stub in the concrete placed-structure specialization table `0x005c8c50`. The helper clears `EAX` and returns immediately, with no field access or side effects. Current evidence only grounds it as one literal-false virtual slot beneath the specialization, so the note stays structural rather than semantic. | objdump + vtable scan |
| 42 | 0x0040cc20 | 3 | placed_structure_specialization_false_stub_vtable_5c8c50_slot1 | map | thiscall | inferred | objdump + vtable scan | 1 | Second tiny pure-false stub in specialization table `0x005c8c50`. Like the neighboring false slots, it simply clears `EAX` and returns. Current evidence grounds this only as a literal-false virtual slot rather than a named predicate. | objdump + vtable scan |
| 43 | 0x0040cc30 | 3 | placed_structure_specialization_false_stub_vtable_5c8c50_slot2 | map | thiscall | inferred | objdump + vtable scan | 1 | Third tiny pure-false stub in specialization table `0x005c8c50`. The helper only returns `0`, with no field reads or writes. Current evidence does not yet justify a semantic predicate name beyond that structural role. | objdump + vtable scan |
| 44 | 0x0040cc40 | 32 | placed_structure_subject_candidate_is_subtype1 | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small shared candidate-profile predicate adjacent to the `0x005c8c50` specialization cluster. The helper follows candidate or profile id `[this+0x173]` through collection `0x0062b268`, reads candidate subtype byte `[candidate+0x32]`, and returns `1` only when that subtype equals `1`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the returned boolean becomes one of the two mode inputs for `0x00415020`. This is the safest current read for a subtype-`1` predicate over the linked candidate/profile chain rather than a specialization-vtable slot. | objdump + caller inspection + local disassembly + candidate-subtype correlation |
| 45 | 0x0040cc60 | 26 | placed_structure_subject_candidate_query_flag_byte_ba | map | thiscall | inferred | objdump + caller inspection + local disassembly | 1 | Tiny shared candidate-profile accessor adjacent to the specialization cluster. The helper follows id `[this+0x173]` through candidate collection `0x0062b268` and returns byte `[candidate+0xba]`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the byte is only used as a boolean mode input. Current evidence grounds the field access but not the higher semantic name of candidate byte `0xba`, so the note stays deliberately raw. | objdump + caller inspection + local disassembly + candidate-byte-field correlation |
| 46 | 0x0040cc80 | 42 | placed_structure_subject_candidate_is_subtype1_class3 | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Shared candidate-profile predicate over the same `[this+0x173] -> 0x0062b268` chain as `0x0040cc40`. The helper returns `1` only when candidate subtype byte `[candidate+0x32]` equals `1` and candidate class byte `[candidate+0x8c]` equals `3`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where this branch helps select the flagged-region float-stat mode beneath `0x00415020`. This is the safest current read for the combined subtype-`1` plus class-`3` predicate rather than a direct specialization method. | objdump + caller inspection + local disassembly + candidate-subtype correlation + candidate-class correlation |
| 47 | 0x0040ccb0 | 14 | placed_structure_has_cached_linked_site_id | map | thiscall | inferred | objdump + vtable scan + local disassembly | 2 | Small specialization-side predicate over cached linked-site id `[this+0x2a8]`. The helper returns `1` when that dword is nonzero and `0` otherwise. Because it sits directly in the `0x005c8c50` vtable beside the linked-peer UI and route-anchor family, this is the safest current read for the specialization's cached-linked-site-id presence predicate rather than a broader linked-site resolver. | objdump + vtable scan + local disassembly + linked-site-field correlation |
| 48 | 0x0040ccc0 | 6 | placed_structure_specialization_true_stub_vtable_5c8c50_slot | map | thiscall | inferred | objdump + vtable scan | 1 | Tiny pure-true stub in specialization table `0x005c8c50`. The helper loads literal `1` into `EAX` and returns immediately. Current evidence grounds it only as a literal-true virtual slot beneath the specialization, not yet as a named capability predicate. | objdump + vtable scan |
| 49 | 0x0040ccd0 | 30 | world_grid_resolve_cell_pointer_by_xy_indices | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small world-grid address calculator over the live world root at `0x0062c120`. The helper multiplies the caller-supplied Y-like index by world width `[this+0x2145]`, adds the X-like index, scales the resulting linear slot by fixed cell stride `0x1d7`, and returns the corresponding cell pointer under base `[this+0x2129]`. Current grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386`, several world-grid or overlay-side passes at `0x004525bc..0x00452bb2`, and one later shell-side caller at `0x004df4d4`, so this is the safest current read for the shared `(x,y) -> world-cell*` resolver rather than an object-specific helper. | objdump + caller inspection + local disassembly + world-grid correlation + cell-stride correlation |
| 50 | 0x0040ccf0 | 23 | placed_structure_query_linked_instance_candidate_class_byte | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small linked-instance candidate-class reader adjacent to the specialization cluster. The helper first resolves one linked instance through `0x0047de00`, then follows that instance's vtable `+0x80` owner chain, and finally returns candidate class byte `[candidate+0x8c]`. Current grounded callers include later world or UI-side branches at `0x00480fb5` and `0x004b03ce`, where the returned class is compared against `3` and `4`. This is the safest current read for a linked-instance candidate-class accessor rather than a general placed-structure vtable slot. | objdump + caller inspection + local disassembly + candidate-class correlation |
| 51 | 0x0040cd10 | 88 | placed_structure_scan_center_cell_site_roster_when_shell_gate_enabled | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Gated center-cell site-roster sweep adjacent to the specialization cluster. The helper first requires shell or modal latch `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current subject's center world-grid cell through `0x00455f60`, reads the local roster count and packed site-id list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through collection `0x006cec20`. Current grounded caller is the broader collection walk at `0x00413860`, so this is the safest current read for a gated center-cell linked-site roster scan rather than another candidate predicate or direct vtable override. | objdump + caller inspection + local disassembly + center-cell roster correlation |
| 52 | 0x0040cd70 | 228 | placed_structure_resolve_cached_source_and_candidate_ids_from_current_stem_or_warn | map | thiscall | inferred | objdump + local disassembly + string correlation + collection correlation | 3 | Common specialization-side stem refresh helper beneath `0x0040ce60`. The helper clears cached ids `[this+0x3cc]` and `[this+0x3d0]`, scans source collection `0x0062b2fc` for a case-sensitive stem match against `[this+0x3ae]`, and on the first match stores the matched source id into `[this+0x3cc]` plus the corresponding candidate or profile id from `[source+0x173]` into `[this+0x3d0]`. When no source stem matches, it formats localized id `0x00ad` with the current stem buffer and publishes that warning through `0x0051e980`. Current local callers are the radio-stem canonicalizer `0x0040ce60` and the broader placed-structure constructor or geometry refresh family, so this is the safest current read for the cached source/candidate resolver beneath the `0x005c8c50` specialization rather than a generic geometry helper. | objdump + local disassembly + string correlation + collection correlation + cached-id-field correlation |
| 53 | 0x0040ce60 | 83 | placed_structure_canonicalize_radio_station_stem_and_refresh_specialization_state | map | thiscall | inferred | objdump + local disassembly + string correlation | 2 | Small specialization-side stem normalizer. The helper compares the site stem at `[this+0x3ae]` against the literal `Radio Station`, and when that compare matches it rewrites the same stem buffer to the compact form `RadioStation`. It then re-enters the common stem or geometry refresh helper `0x0040cd70` and the neighboring specialization-side follow-on `0x0045c150` with the caller-supplied stack argument. Current local evidence is strong enough to ground the `Radio Station -> RadioStation` normalization, but not the broader semantic role of the owning specialization table `0x005c8c50`, so this note stays narrow. | objdump + local disassembly + string correlation + neighboring specialization-method correlation |
| 54 | 0x0040cec0 | 18 | placed_structure_resolve_cached_source_record_from_id3cc | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny cached-record resolver over source id `[this+0x3cc]`. The helper resolves and returns the corresponding entry through source collection `0x0062b2fc`. Current local callers sit on the `0x005c8c50` specialization side beside the stem refresh family, so this is the safest current read for the direct cached source-record resolver rather than another generic collection helper. | objdump + local disassembly + cached-id-field correlation |
| 55 | 0x0040cee0 | 18 | placed_structure_resolve_cached_candidate_record_from_id3d0 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 2 | Tiny cached-record resolver over candidate or profile id `[this+0x3d0]`. The helper resolves and returns the corresponding entry through collection `0x0062b268`. Because this function is itself a `0x005c8c50` vtable slot and directly follows the stem-refresh family, this is the safest current read for the specialization's cached candidate-record resolver rather than an unrelated collection bridge. | objdump + vtable scan + local disassembly + cached-id-field correlation |
| 56 | 0x0040cf00 | 527 | placed_structure_build_secondary_specialization_transient_handle_with_four_slot_offsets | map | thiscall | inferred | objdump + local disassembly + transient-family correlation | 2 | Heavier specialization-side transient build branch beneath the `0x005c8c50` table. The helper first requires creation-mode byte `[this+0x3d4] == 1` and live transient seed `[this+0x24e]`, then re-enters the neighboring cleanup gate `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, `[this+0x21]`, `[this+0x3a]`, and the constant at `0x005c8cf4`, and allocates one new handle through `0x00475ed0` into `[this+0x25a]`. It then resolves a current world-position tuple through `0x00414450` and `0x0052e720`, publishes several local offset triplets through `0x00475010`, and configures four numbered channels on the new handle through `0x00475030` with selector ids `1..4`. Current evidence grounds this as a second transient-handle builder in the same specialization-side payload family as `0x0045c310/0x0045b210`, but not yet the user-facing subtype semantics of the handle itself. | objdump + local disassembly + transient-family correlation + geometry-derived offset correlation |
| 57 | 0x0040d170 | 56 | placed_structure_build_primary_specialization_transient_when_candidate_flag4b_enabled | map | thiscall | inferred | objdump + local disassembly + candidate-flag correlation | 2 | Small specialization-side hook that conditionally builds the primary transient handle through `0x0045c310`. The helper resolves the current candidate from cached stem id `[this+0x3cc]`, follows that candidate's profile or source id through `[entry+0x173]`, and reads dword flag `[candidate+0x4b]`. When that flag is nonzero it tail-calls `placed_structure_specialization_build_primary_transient_handle_from_payload_strings` `0x0045c310`; otherwise it returns immediately. This is the strongest current owner for the candidate-flag-gated primary transient build hook in the `0x005c8c50` specialization family. | objdump + local disassembly + candidate-flag correlation + transient-build correlation |
| 58 | 0x0040d1b0 | 56 | placed_structure_release_primary_specialization_transient_when_candidate_flag4b_enabled | map | thiscall | inferred | objdump + local disassembly + candidate-flag correlation | 2 | Release-side companion to `0x0040d170`. The helper resolves the same candidate chain from cached stem id `[this+0x3cc]`, reads dword flag `[candidate+0x4b]`, and when that flag is nonzero tail-calls `placed_structure_specialization_release_primary_transient_handle_and_siblings` `0x0045c3c0`; otherwise it returns immediately. Current evidence grounds this as the candidate-flag-gated release hook for the primary specialization transient rather than a generic cleanup entry. | objdump + local disassembly + candidate-flag correlation + transient-release correlation |
| 59 | 0x0040d1f0 | 23 | placed_structure_resolve_linked_peer_record_from_cached_site_id | map | thiscall | inferred | objdump + local disassembly | 3 | Tiny cached-record resolver over linked site id `[this+0x2a8]`. When that id is nonzero the helper resolves and returns the linked placed-structure record through collection `0x006cec20`; otherwise it returns null. Current grounded callers include the contextual status publisher `0x0040e4e0` and the linked-anchor service family, so this is the safest current read for the direct linked-peer resolver rather than another boolean gate. | objdump + local disassembly + linked-peer resolver correlation |
| 60 | 0x0040d210 | 26 | placed_structure_resolve_owner_record_from_cached_owner_id | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny cached-record resolver over owner id `[this+0x276]`. When that id is nonzero the helper resolves and returns the corresponding record through collection `0x0062be10`; otherwise it returns null. Current local callers sit on the UI-facing specialization side near `0x0040e9d0`, so the safest current read is one direct owner-record resolver rather than a wider ownership test. | objdump + local disassembly + owner-resolver correlation |
| 61 | 0x0040d230 | 60 | placed_structure_has_linked_station_or_transit_peer | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Boolean linked-peer gate over one placed structure. The helper first requires the placed-structure vtable `+0x70` latch, then resolves optional linked site id `[this+0x2a8]` through the live placed-structure collection `0x006cec20`, and finally re-enters `placed_structure_is_station_or_transit_site_class` `0x0047fd50` on that linked peer. Current local callers include the broader `cargo id 0` bypass family and several neighboring linked-site maintenance branches, so this is the safest current read for the narrower linked-peer station-or-transit gate rather than a cargo-reference helper. | objdump + caller xrefs + local disassembly + linked-peer gate correlation |
| 62 | 0x0040d2d0 | 128 | placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Linked-peer visual or state refresh beneath the broader placed-structure rebuild family. The helper first re-enters placed-structure vtable `+0x54` with stack argument `0`, then requires scenario latch `[0x006cec78+0x4ae7]`, the placed-structure vtable `+0x70` linked-site-capable latch, and the narrower linked-peer class gate `0x0047fd50` over optional linked site id `[this+0x2a8]`. When the resolved linked peer carries nonzero byte `[peer+0x5bc]`, it re-enters placed-structure vtable `+0x58` on the current site with literal arguments `(0x5f, 0x5f, 0xff)`. Current grounded caller is `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, so this is the safest current read for a linked-peer-dependent overlay or status refresh rather than a cargo-side helper. | objdump + caller xrefs + local disassembly + linked-peer flag correlation |
| 63 | 0x0040dba0 | 66 | placed_structure_clear_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle | map | thiscall | inferred | objdump + caller xrefs + local disassembly + rdata method-table scan | 2 | Small linked-site route-entry state helper. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, then resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `1` into `0x0047dda0`, and finally clears local byte `[this+0x42]` to `0`. Current local callers are neighboring placed-structure maintenance branches, and the paired companion at `0x0040dbf0` performs the same route-entry dispatch with the opposite literal and byte writeback. A local `.rdata` scan now tightens the owner split too: `0x0040dba0` and `0x0040dbf0` each appear exactly once, together with getter `0x0040cbf0`, in one concrete placed-structure specialization table rooted at `0x005c8c50`, so this is now the safest current read for one half of a specialization-specific linked-site route-entry state toggle pair rather than a generic family-wide setter. | objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation |
| 64 | 0x0040dbf0 | 65 | placed_structure_set_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle | map | thiscall | inferred | objdump + caller xrefs + local disassembly + rdata method-table scan | 2 | Companion linked-site route-entry state helper paired with `0x0040dba0`. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `0` into `0x0047dda0`, and finally sets local byte `[this+0x42]` to `1`. Current local callers are neighboring placed-structure maintenance branches. A local `.rdata` scan now shows that this paired override appears only in the same concrete placed-structure specialization table at `0x005c8c50` as `0x0040dba0` and `0x0040cbf0`, which keeps this on the specialization-specific linked-site route-entry side rather than on one generic shared-byte setter lane. | objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation |
| 65 | 0x0040e360 | 235 | placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Subtype-specific local-runtime follow-on beneath `0x0040eba0` and `0x0040ee10`. The helper resolves the current placed structure's candidate from `[this+0x3cc]` through `0x0062b2fc` and `0x0062b268`, requires subtype byte `[candidate+0x32] == 1` plus candidate class byte `[candidate+0x8c] == 3`, then requires a linked site id at `[this+0x2a8]`. When the linked peer exists and its route-entry anchor at `[peer+0x08]` is live in collection `0x006cfca8`, the helper samples one anchor-side float through `0x0048aab0`, subtracts the fixed offset at `0x005c8738`, combines that result with the current placed structure's coordinate pair through `0x00455810` and `0x00455800`, and publishes the resulting triplet through the shared position setter `0x00530720`. Current grounded caller is the broader local side helper `0x0040ee10`, plus the heavier subtype-driven refresh path at `0x0040eba0`, so this is now the safest current read for the linked-site anchor position-triplet refresh beneath the placed-structure local-runtime family rather than a generic route query. | objdump + caller inspection + local disassembly + linked-site-anchor correlation + local-runtime correlation |
| 66 | 0x0040e450 | 131 | placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small wrapper that rebuilds one placed structure's cloned local-runtime record from its current candidate stem and cached profile slot. The helper copies the current stem string from the candidate referenced by `[this+0x3cc]`, resolves the matching live candidate id through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, seeds the projected-rectangle profile-slot cache from `[this+0x252]` through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470`, and then re-enters `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` `0x00418a60` with the current placed-structure pointer. It stores the returned cloned record into `[this+0x24e]`, refreshes the local cached profile slot from `[record+0x732]` into `[this+0x252]`, and ties the clone back to the owning placed structure through `[record+0x73a] = this`. Current grounded caller is the collection-wide wrapper `0x004133b0`, so this now reads as the cloned local-runtime rebuild helper for one live placed structure rather than an unowned stem lookup. | objdump + caller inspection + local disassembly + local-runtime-clone correlation + projected-rect-profile correlation |
| 67 | 0x0040e4e0 | 921 | placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state | map | thiscall | inferred | objdump + local disassembly + localization-call correlation | 2 | Large contextual status-text publisher in the same concrete placed-structure specialization family rooted at `0x005c8c50`. The helper first requires creation-mode byte `[this+0x3d4] == 1`, the specialization's linked-site-capable vtable `+0x70` latch, and several shell or modal gates under `0x006d1a8c` and `0x006d12f0`; it then branches across linked-peer checks through `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current owner checks through `0x004337a0`, and candidate or linked-peer display-name lookups through `0x0051c920`. The resulting text is localized through ids such as `0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd`, assembled through `0x00518de0`, and finally pushed into the shell presenter `0x00538c70` with mode `3`. Several branches also trigger world-side follow-ons through `0x00452db0` and `0x00452fa0`, so this is best read as a contextual linked-peer or selection-status publisher with mode-specific side effects rather than a pure formatter. | objdump + local disassembly + localization-call correlation + linked-peer gate correlation + shell-presenter correlation |
| 68 | 0x0040e880 | 329 | placed_structure_dispatch_primary_context_action_and_reset_status_presenter | map | thiscall | inferred | objdump + local disassembly + linked-peer gate correlation | 2 | Primary context-action dispatcher paired with `placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state` `0x0040e4e0`. The helper first resets the active shell presenter through `0x00538c70` using the fixed token rooted at `0x005c87a8`, then reuses the same linked-site-capable vtable `+0x70` latch, creation-mode byte `[this+0x3d4] == 1`, linked-peer path `0x0040d230 -> 0x0047f310 -> 0x0048b660`, and world-mode gates `[0x0062c120+0x2175/+0x2179/+0x2181]` to dispatch one of several follow-ons including `0x00413620`, `0x00453510`, `0x00452db0`, and `0x00452fa0`. Current evidence grounds this as the specialization-side primary action or activation dispatcher that accompanies the contextual status publisher, not as another local-runtime refresh helper. | objdump + local disassembly + linked-peer gate correlation + shell-presenter correlation + world-mode branch correlation |
| 69 | 0x0040e9d0 | 464 | placed_structure_format_context_label_or_owner_name_for_ui_query | map | thiscall | inferred | objdump + local disassembly + string correlation | 2 | Query-style label formatter in the same specialization table `0x005c8c50`. The helper first short-circuits when vtable slot `+0x14` says the current object should not answer, then chooses between three outcomes: when shell branch `[0x006cec74+0x74]` is live it formats one localized label through id `0x00b4`, appends the fixed suffix `\\nAbsIndex %d`, copies that text into the caller buffer through `0x0051d8a0`, and returns `1`; under a narrower owner or company-state path gated by `[this+0x276]`, shell mode `[0x006cec74+0x253]`, the linked-site latch, and the active modal state at `0x006d12f0`, it resolves one company-side display label through `0x00426b10`, stores it through the caller out-pointer, and returns `2`; otherwise it falls back to `0x00455860`. This is therefore the safest current read for a specialization-side UI label or owner-name query wrapper rather than another action dispatcher. | objdump + local disassembly + string correlation + ui-query correlation |
| 70 | 0x0040eba0 | 620 | placed_structure_set_world_coords_and_refresh_local_runtime_side_state | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavier placed-structure world-coordinate mutation helper above the local-runtime side refresh family. The function updates the current record's world position through `0x00455860`, recomputes cached grid coordinates `[this+0x388]` and `[this+0x38c]`, and rewrites the world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`. On the candidate subtype-`4` branch it also removes and then re-appends the current site to the nearby-transit proximity bucket family through `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0` and `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480`. After that it rebuilds the same local position or scalar triplet family later serviced by `0x0040ee10`, caches the accepted scalar pair in `[this+0x392]` and `[this+0x396]`, publishes the chosen triplet through the shared setter `0x00530720`, optionally refreshes the linked peer route-entry anchor through `0x00480710`, and finally tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers include the broader rebuild paths `0x0040ef10` and `0x0040f6d0`, later site-mutation branches `0x00419110`, `0x0046ef40`, `0x004707da`, and `0x00473bf0`, plus shell-side subject updates around `0x00507cf0` and `0x00508bb0`, so this is now the safest current owner for world-coordinate updates plus local-runtime side-state refresh rather than a generic movement helper. | objdump + caller inspection + local disassembly + world-coordinate mutation correlation + local-runtime correlation + proximity-bucket correlation |
| 71 | 0x0040ee10 | 248 | placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small placed-structure local-runtime side refresh over one live record. The helper samples the current structure coordinate pair through `0x00455800` and `0x00455810`, converts that pair through the basis at `0x006d4024`, `0x0051f090`, and `0x00534490` into one base scalar, and then conditionally adjusts that scalar when the linked candidate-side structure record keeps nonzero byte `[candidate+0xba]` via the rounded world-grid sampler `0x0044ae40` and the fixed subtractive offset at `0x005c8840`. When the auxiliary preview owner gate `shell_has_auxiliary_preview_owner` `0x00434050` is active, it rounds that scalar to an integer float. It then publishes the resulting position triplet through the shared setter `0x00530720` and tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers are the collection-wide local-runtime refresh wrapper `0x004133b0` and the connected-component recursion tail `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`, so this is now the strongest current owner for the per-site local-runtime position-triplet refresh rather than a generic coordinate helper. | objdump + caller inspection + local disassembly + local-runtime correlation + connected-component correlation |
| 72 | 0x0040ef10 | 1984 | placed_structure_finalize_creation_or_rebuild_local_runtime_state | map | thiscall | inferred | objdump + caller inspection + placement and mutation correlation | 3 | Broad placed-structure post-create or post-edit rebuild above the narrower route-style lane. The helper validates several linked-site and world-state preconditions before keeping the current site live, increments the global live-site count at `0x0062be40`, seeds runtime mode and year fields at `[this+0x390]`, `[this+0x3d4]`, and `[this+0x3d5]`, refreshes the adjacent site-status or overlay family through `0x0040d2d0`, and rebuilds one larger local owner or service bundle through `0x00418be0`, `0x0040eba0`, and the scalar-staging family `0x00475ed0` / `0x00474fe0` / `0x00475010` / `0x00475030` into fields such as `[this+0x24e]`, `[this+0x252]`, `[this+0x25a]`, and `[this+0x25e]`. Later in the same body it re-enters `0x0040db30`, and when the local latch at `[this+0x29e]` is still zero it also re-enters `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `1`. The tail is tighter now too: when creation-mode byte `[this+0x3d4]` equals `1`, the branch at `0x0040f692` triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6` just before the local live-site follow-on at `0x433b80`. Current grounded callers include the placement-side builders at `0x00403ef3` and `0x00404489`, later site-mutation paths at `0x0046f073` and `0x004707ff`, and one train-side site operation at `0x005098eb`, so this now looks like the broad post-create or post-edit runtime rebuild above route-style scoring and peer-link emission rather than a route-style-only helper. | objdump + caller inspection + placement and mutation correlation + route-style rebuild correlation + runtime-effect trigger-kind correlation |
| 73 | 0x0040f6d0 | 891 | placed_structure_construct_entry_from_candidate_and_world_args | map | thiscall | inferred | objdump + constructor inspection + caller correlation | 3 | Lower constructor beneath the shared placed-structure allocator at `0x004134d0`. The helper writes the new placed-structure id into `[this+0x2a4]`, clears a large band of local runtime fields, copies the candidate stem or label payload from the caller-supplied construction scratch record, initializes local world geometry through `0x0040cd70`, `0x0045b9b0`, `0x00455750`, and `0x00455720`, quantizes the input coordinates into the cached grid terms at `[this+0x388]` and `[this+0x38c]`, seeds the current scenario year into `[this+0x3d5]`, and initializes the class-weight lanes near `[this+0x28a]` from the linked candidate vtable owner. It then zeroes the local route-style and service-score bands, conditionally builds the first local owner or service record through `0x00418be0` and `0x0040eba0`, resolves the initial linked site id at `[this+0x2a8]` through `0x00481390` when the backing candidate subtype byte `[candidate+0x32]` is `1`, seeds region linkage through `0x0044a800` and `0x0041f7e0`, optionally re-enters `0x0040db30` for subtype `4`, and finally seeds the trailing random-like dwords at `[this+0x3d9]` and `[this+0x3dd]` from `0x518d70`. Current grounded caller is `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, so this is now the concrete placed-structure constructor rather than an anonymous lower helper beneath the placement-side builders. | objdump + constructor inspection + caller correlation + placed-structure runtime-state correlation |
| 74 | 0x0040fbe0 | 224 | placed_structure_endpoint_pair_has_shared_route_entry_key | map | thiscall | inferred | objdump + caller inspection + world-grid chain comparison | 3 | Boolean peer-test between one placed structure and one caller-supplied peer site id. The helper converts the current site and the peer site into their derived world-grid owner records through `0x00455800`, `0x00455810`, the world-grid tables rooted at `[0x0062c120+0x2129]`, and the placed-structure resolver `0x0040fa50`. It then compares the two route-entry chains rooted at `[cell+0x0ef]`, using the chain lengths at `[cell+0x0eb]`, and returns `1` on the first shared leading `u16` route-entry key; otherwise it returns `0`. Current grounded callers are the route-link emitter at `0x0040fef0`, where it blocks duplicate endpoint pairing before `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50`, and the neighboring cleanup sweep at `0x0040d2aa`, where it decides whether an existing site-owned route-link should be erased. This now looks like the shared duplicate-or-overlap test for the route-link family rather than a generic proximity check. | objdump + caller inspection + world-grid chain comparison + route-link duplicate-check correlation |
| 75 | 0x0040fef0 | 752 | placed_structure_try_emit_best_route_style_peer_link_for_candidate_class | map | thiscall | inferred | objdump + caller inspection + placed-structure sweep inspection | 3 | Scans the live placed-structure collection for one best peer site and emits a missing route-link for one caller-selected candidate class when a qualifying endpoint pair survives. The helper first derives one distance cap from the current placed-structure population size at `0x0062b26c`, scales that cap by the caller-supplied float, and then walks the live placed-structure ids in a wrapped pseudo-random order. Candidate peers must have a positive class-specific weight in the placed-structure lane `[peer+class*4+0x27e]`, differ from the source site, pass the linked-instance class gate `0x0040c990 == 1`, and lie inside the chosen distance window after the coordinate and span checks built from `0x00455800`, `0x00455810`, `0x00455f60`, and nearby math helpers. The strongest surviving peer is kept through a weighted comparison, and if one remains the helper re-enters `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0`; only when that duplicate check fails does it call `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` with the source site id from `[this+0x2a4]`, the chosen peer id, and the same candidate-class argument. Current grounded callers are the larger per-site world pass around `0x00410665` and the route-style grid contribution branch at `0x0042cafe`, so this now looks like the current peer-selection emitter for site-owned route-style links rather than a low-level allocator wrapper. | objdump + caller inspection + placed-structure sweep inspection + route-link emission correlation |
| 76 | 0x004101e0 | 6843 | placed_structure_rebuild_route_style_candidate_scores_and_peer_links | map | thiscall | inferred | objdump + caller inspection + route-style emission correlation | 3 | Large per-site rebuild pass above the route-style link emitter. The helper first requires the current placed structure to pass the linked-instance class gate `0x0040c990 == 1` and several scenario-state gates rooted at `0x006cec78` and `0x006cec7c`, then derives one set of per-class route-style score scalars from the current site's local state, scenario opinion multipliers through `0x00436590`, year-dependent dampers, and the placed-structure class-weight lanes near `[this+0x28a]`. The early compatibility side is tighter now too: it probes the current placed-structure stem against `Nuclear Power Plant`, `Electric Plant`, and `Recycling Plant`, stages three local boolean latches from those matches, and then clears the `Recycling Plant` latch again when the shared build-version query `0x00482e00` reports below `0x68` (`1.04`), so that stem-specific branch is now bounded as a post-`1.04` compatibility lane rather than one timeless route-style rule. For the first three route-style classes it conditionally re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the caller-supplied mode flag and one computed float score. The function then continues into a larger descriptor-driven scoring phase over the current candidate's runtime descriptor array at `[candidate+0x37]`, building temporary score bands and normalizing them against the same local totals before later write-back. That later phase has another bounded version gate: on one descriptor-accumulation subbranch the helper consults `0x00482e00` again at `0x41109f`, and build `1.05+` (`>= 0x69`) skips one older fallback attenuation path that earlier builds still apply through the local multiplier tables. Current grounded callers are the local per-site branch at `0x0040f640`, which reaches it with stack flag `1`, and the broader placed-structure sweep at `0x004135e3`, which reaches it with stack flag `0`; this is therefore the strongest current owner for route-style candidate scoring and peer-link emission on one live placed structure rather than a narrow one-off helper. | objdump + caller inspection + route-style emission correlation + descriptor-loop inspection + version-gate correlation + stem-probe correlation |
| 77 | 0x004134d0 | 112 | placed_structure_collection_allocate_and_construct_entry | map | thiscall | inferred | objdump + caller xrefs + constructor inspection | 3 | Shared direct placement helper above the broader placed-structure runtime rebuild. The helper first obtains one temporary `0x3e1`-sized construction scratch object through `0x53b070` and `0x0040c950`, then allocates one live placed-structure entry from the current collection through `0x518900`, resolves the new record through `0x518140`, and finally re-enters the lower constructor at `0x0040f6d0` with the new entry id plus the caller-supplied coordinate and candidate payload tuple. Current grounded callers include the candidate-placement branches at `0x00403ed5`, `0x0040446b`, and `world_region_try_place_candidate_structure` `0x00422ee0`, plus later mutation or editor-side branches at `0x0046efbf`, `0x0047074b`, `0x00472bef`, `0x00472d03`, and `0x00508fd1`. This now looks like the shared placed-structure allocator and constructor entrypoint beneath the placement-side builders rather than a route-style-specific helper. | objdump + caller xrefs + constructor inspection + placement correlation |
| 78 | 0x0041d550 | 574 | locomotive_era_and_engine_type_pass_company_policy_gate | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + engine-type correlation | 2 | Policy gate beneath the preferred-locomotive chooser and its non-electric fallback. The helper operates on one locomotive-era or availability record whose linked locomotive id sits at `[this+0x126]`. On the fuller policy path, reached when record field `[this+0x41]` is `2` or `3`, it first respects several scenario-state locks rooted at `[0x006cec74+0x180]`, `[0x006cec78+0x4c8c]`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x247]`, then resolves the linked locomotive record from `0x006ada84` and dispatches its engine-type dword `[locomotive+0x10]` across three scenario opinion slots through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`: `0x1c6`, `0x1c7`, and `0x1c8`, which current evidence now best aligns with the steam, diesel, and electric lanes. It also special-cases the locomotive stem at `[locomotive+0x34]` against the local string `WhaleL`; current data-file correlation now ties that stem to the `Orca NX462` locomotive family and its `WhaleL_NE` asset set, and when that compare hits the helper explicitly zeros the accumulated issue-opinion result before the later availability checks, so that family loses the positive-opinion shortcut rather than taking a bonus branch. It then consults one neighboring locomotive-derived issue or policy id through `0x00442a85`, and applies a late scenario availability triplet from `[0x006cec78+0x4c97..0x4c99]` against three per-record bytes `[this+0x30..0x32]` plus record field `[this+0x7b]`. That triplet now has a stronger player-facing read: the same three scenario bytes are the live editor-policy fields owned by `map_editor_locomotive_availability_panel_construct` `0x004cd680` and `map_editor_locomotive_availability_panel_handle_message` `0x004cf0d0`, and their localized labels `2863..2865` are `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All Electric Locos Avail.`. The current gate is narrower than a plain override: when the issue-opinion result stays positive and none of those three editor bytes are enabled, that positive result alone seeds the local availability flag; but once any of the editor family bytes is nonzero, the helper instead requires one matching intersection between the per-record family bytes `[this+0x30..0x32]` and the corresponding scenario bytes `0x4c97..0x4c99`. Independent of that family check, record field `[this+0x7b]` can still carry the path into the later year-window gate. On the simpler path it falls straight to an era-window gate using the current scenario year with floor `0x726` against `[this+0x105]` and `[this+0x109]`, plus one current-month-like check from `[0x006cec78+0x0f]`. The helper returns `1` when the era and engine family pass those combined scenario, opinion, availability, and year gates; otherwise `0`. Current grounded callers are `company_select_preferred_available_locomotive_id` `0x004078a0` and `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0`. | objdump + caller xrefs + callsite inspection + engine-type correlation + year-window correlation + scenario-gate correlation + editor-locomotive-availability correlation + WhaleL carveout correlation + engine-data correlation |
| 79 | 0x00417790 | 160 | map_angle_rotate_grid_offset_pair_into_world_offset_pair | map | cdecl | inferred | objdump + callsite inspection + math-table correlation | 2 | Small angle-table rotation helper beneath the placement projection family. The helper normalizes the caller-supplied heading float into the engine's cyclic angle domain, indexes one sine or cosine-like basis table under `0x006d4024`, and then applies that basis pair to the caller-supplied X or Y grid offsets before writing the rotated world-space offset pair through the two out-pointers. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, so this now looks like the low-level offset-rotation helper rather than a generic trig wrapper. | objdump + callsite inspection + math-table correlation |
| 80 | 0x00417840 | 205 | placed_structure_project_candidate_grid_extent_offset_by_rotation | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Projects one candidate-sized local grid extent into rotated world-space X or Y offsets for placement and mutation previews. The helper resolves the caller-supplied placed-structure id through the current collection, pulls one local grid basis pair through `0x00413d80`, reads the linked candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, converts those grid extents into local offset terms, and then re-enters `map_angle_rotate_grid_offset_pair_into_world_offset_pair` `0x00417790` with the caller-supplied heading float to produce the rotated output pair. Current grounded callers include the city-connection placement chooser `0x00402cb0`, the placed-structure local rebuild lane at `0x0040de78`, subtype-`1` placement validation inside `0x004197e0`, and later world-side update branches at `0x00417b6f`, `0x00417e27`, `0x0041a250`, `0x0041a615`, `0x004802c6`, `0x00480875`, and `0x00480d50`. This now looks like the shared projected-footprint offset helper beneath placement validation rather than an unnamed geometry routine. | objdump + caller xrefs + callsite inspection + placement-correlation |
| 81 | 0x00417b40 | 986 | route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading | map | thiscall | inferred | objdump + caller xrefs + local disassembly + callsite inspection | 3 | Tries to reuse one already-existing route entry from the global route-entry collection `0x006cfca8` for a caller-supplied site id, world-space point, and heading instead of synthesizing a new endpoint entry. The helper first projects the current candidate footprint through `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, probes the route-entry collection through `0x00494cb0`, and then subjects the returned entry plus its linked neighbors at `[entry+0x206/+0x20a/+0x20e]` to a tighter compatibility screen: `[entry+0x226]` must be clear, `[entry+0x222]` must be unset or already owned by the same site id, `[entry+0x20e]` must be `-1`, and the neighboring entries cannot already point back through the same side-link pattern selected by byte `[entry+0x201]`. When a candidate survives, the helper computes one accepted local heading and anchor offset through `0x0048bb40`, `0x005a1390`, `0x005a152e`, `0x0048a1a0`, `0x0048a1c0`, and `0x0051db80`, writes the accepted world-space pair and heading back through the caller out-pointers, optionally stores the reused route-entry id through stack arg `+0x2c`, and returns `1`; otherwise it returns `0`. Current grounded callers are the linked-site constructor `0x00480210`, the linked-site runtime refresh owner `0x00480710`, the broader route-anchor chooser around `0x0041a137`, and the StationPlace orientation-search helper `0x00508040`, so this is the safest current read for the reusable covering-route-entry search path rather than another route-synthesis owner. | objdump + caller xrefs + local disassembly + route-entry reuse correlation + linked-site correlation + station-place correlation |
| 82 | 0x004185a0 | 100 | world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Small world-grid mask helper beneath the neighboring projected-rectangle raster family. The helper walks one caller-supplied rectangle from the four dwords rooted at stack arg `+0x04`, reads the aligned float sample band from the caller buffer at stack arg `+0x08`, skips cells whose sample is still the sentinel `0x497423f0`, and otherwise toggles bit `0x01` in the grid-byte mask rooted at `[0x0062c120+0x2135]` by XORing it with the low bit of the caller-supplied byte flag at stack arg `+0x0c`. Current grounded callers are the higher projected-rectangle workers at `0x00418610`, `0x00418a60`, and `0x00418d40`, so this is now bounded as a non-sentinel mask-toggle helper rather than another generic grid writer. | objdump + caller inspection + local disassembly + grid-mask correlation |
| 83 | 0x00418610 | 584 | world_grid_refresh_projected_rect_sample_band_and_flag_mask | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan. | objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation |
| 84 | 0x00419110 | 234 | placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map | map | cdecl | inferred | objdump + caller xrefs + local disassembly + bucket-map correlation | 3 | Rectangular placed-structure refresh wrapper over a hashed per-cell bucket map. The helper clamps the caller rectangle against live world dimensions `[0x0062c120+0x2155/+0x2159]`, packs each cell key as `(row << 16) | col`, resolves one bucket head through the caller-supplied map root at `[arg0+0x88]` and the shared hash lookup `0x0053dae0`, and then walks the returned linked chain. For every resolved bucket entry it forwards the stored coordinate pair from `[entry+0x04/+0x08]` plus two zero stack flags into `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` on the current placed-structure owner carried by that entry, so the current effect is a local-runtime side-state refresh across every bucketed site in the rectangle rather than a generic collection iterator. Current grounded caller is the edit-side branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations, so this is the safest current read for the bucket-map-driven rect refresh wrapper rather than another world-grid brush helper. | objdump + caller xrefs + local disassembly + bucket-map correlation + local-runtime-side-state correlation |
| 85 | 0x00419200 | 41 | world_grid_query_projected_rect_scratch_cell_dword_if_present | map | cdecl | inferred | objdump + caller xrefs + local disassembly + projected-rect correlation | 3 | Tiny projected-rectangle scratch-bank getter over the temporary dword cell-value bank rooted at `0x0062b300`. When that bank exists, the helper flattens the caller-supplied cell coordinates through live world width `[0x0062c120+0x2155]` and returns the corresponding dword from the bank; otherwise it returns `0`. Current grounded caller is the later world-side branch at `0x0048af99`, which uses the returned nonzero test as one score or gating input, so this is the safest current read for the projected-rect scratch-cell dword getter rather than another permanent world-grid query. | objdump + caller xrefs + local disassembly + projected-rect correlation + scratch-bank correlation |
| 86 | 0x0041ab50 | 6 | city_database_entry_constant_38_stub_vtable_5c9750_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `38` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value. | objdump + vtable scan + local disassembly |
| 87 | 0x0041ab60 | 6 | city_database_entry_constant_34_stub_vtable_5c9750_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `34` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value. | objdump + vtable scan + local disassembly |
| 88 | 0x0041ab70 | 5 | city_database_entry_load_tagged_payload_via_0x45c6f0 | map | thiscall | inferred | objdump + vtable correlation + local disassembly | 2 | Tiny city-database-entry-family loader thunk in the sibling vtable rooted at `0x005c9750`. The helper simply jumps into `0x0045c6f0`, which stages tag family `0x61a9/0x61aa/0x61ab`, restores two strings into `[this+0x32e]` and `[this+0x332]`, and iterates the child runtime band rooted at `[this+0x316]`. The table-family alignment is now direct: `map_load_city_database` `0x00474610` iterates its loaded records and dispatches vtable slot `+0x44`, which in `0x005c9750` resolves into the same record family immediately adjacent to this loader slot. | objdump + vtable correlation + local disassembly + city-database loader correlation |
| 89 | 0x0041ab80 | 127 | city_database_entry_refresh_named_handle_and_return_scaled_primary_float | map | thiscall | inferred | objdump + caller inspection + local disassembly + city-database family correlation | 2 | City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantic of the handle is still open, but the owning family now aligns structurally with the city-database collection loaded by `0x00474610`. | objdump + caller inspection + local disassembly + city-database family correlation |
| 90 | 0x0041ac00 | 3 | city_database_entry_false_stub_vtable_5c9750_slot0 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 91 | 0x0041ac10 | 3 | city_database_entry_false_stub_vtable_5c9750_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Second tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 92 | 0x0041ac20 | 3 | city_database_entry_false_stub_vtable_5c9750_slot2 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Third tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 93 | 0x0041ac30 | 6 | city_database_entry_constant_10_stub_vtable_5c9750_slot | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny constant-return virtual slot in the city-database-entry table `0x005c9750`. The helper returns literal `10` in `EAX` and exits. Current evidence does not yet justify a higher semantic name beyond that fixed return value. | objdump + vtable scan + local disassembly |
| 94 | 0x0041ac40 | 6 | city_database_entry_true_stub_vtable_5c9750_slot0 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 95 | 0x0041ac50 | 6 | city_database_entry_true_stub_vtable_5c9750_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Second tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 96 | 0x0041f5c0 | 134 | runtime_object_vtable_5c9a60_load_tagged_payload_and_build_dynamic_helper_field_0x37f | map | thiscall | inferred | objdump + vtable scan + local disassembly + sibling-table correlation | 2 | Payload-side virtual slot in the sibling runtime-object table rooted at `0x005c9a60`. The helper clamps scalar `[this+0x31b]` to at least `1.0`, clears `[this+0x317]` when that clamp fires, reloads the shared tagged string-triplet payload through `0x00455fc0`, allocates one `0x88`-byte helper through `0x0053b070`, constructs that helper through `0x00518b90`, stores it into `[this+0x37f]`, and then forwards the caller-supplied bundle or stream context into that helper through `0x00518680`. The function returns the accumulated size from the payload reload plus helper load. Current evidence keeps the subtype name open, but the ownership of dynamic helper field `[this+0x37f]` is now grounded. | objdump + vtable scan + local disassembly + sibling-table correlation + dynamic-helper correlation |
| 97 | 0x0041f650 | 31 | runtime_object_vtable_5c9a60_serialize_tagged_string_triplet_and_forward_stream_to_dynamic_helper_0x37f | map | thiscall | inferred | objdump + vtable scan + local disassembly + sibling-table correlation | 2 | Small stream-side virtual slot in the same sibling runtime-object table `0x005c9a60`. The helper first emits the tagged string-triplet payload through `0x004559d0`, then forwards the same caller-supplied bundle or stream context into helper `[this+0x37f]` through `0x00517d90`. Current evidence now only grounds it as a tagged string-triplet serializer plus dynamic-helper wrapper over field `[this+0x37f]`, not as a broader collection rebuild. | objdump + vtable scan + local disassembly + sibling-table correlation + dynamic-helper correlation |
| 98 | 0x0041f680 | 25 | runtime_object_vtable_5c9a60_refresh_global_preview_helper_and_dispatch_mode1_with_field_0x23a | map | thiscall | inferred | objdump + vtable scan + local disassembly + sibling-table correlation | 2 | Small virtual slot in the sibling runtime-object table `0x005c9a60`. The helper first re-enters `0x00455de0`, which refreshes the current global preview or helper owner from the runtime object's normalized coordinates and anchor triplet. It then loads owner handle `[this+0x23a]`, sets `ECX = 1`, and tails into `0x004cf830`, which allocates or refreshes one `0xa0`-byte helper object before forwarding both values into `0x004cf550`. The exact user-facing subtype remains open, so the current note stays structural around the global-preview refresh plus mode-1 dispatch using field `[this+0x23a]`. | objdump + vtable scan + local disassembly + sibling-table correlation + global-preview-helper correlation |
| 99 | 0x0041f6a0 | 11 | runtime_object_query_dynamic_helper_slot_count_field_0x37f | map | thiscall | inferred | objdump + local disassembly + sibling-table correlation | 2 | Tiny sibling-family helper that treats field `[this+0x37f]` as one indexed collection and returns its current slot count through `indexed_collection_slot_count` `0x00517cf0`. Current grounded caller is `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, where it bounds one region-local profile or structure-count loop. | objdump + local disassembly + sibling-table correlation + slot-count correlation |
| 100 | 0x0041f6b0 | 40 | runtime_object_query_world_scalar_at_rounded_normalized_coords | map | thiscall | inferred | objdump + local disassembly + shared-coordinate-helper correlation | 2 | Small shared helper over the broader `0x23a` runtime-object family. It queries the normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, rounds both through `0x005a10d0`, then forwards the resulting integer pair plus the active world root `0x0062c120` into `0x0044afa0`. Current evidence is strong enough only for the rounded-coordinate world-scalar query shape, not for a more semantic name for the returned scalar. | objdump + local disassembly + shared-coordinate-helper correlation + world-scalar-query correlation |
| 101 | 0x0041f6e0 | 12 | runtime_object_center_world_grid_cell_has_packed_u16_token | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small helper that resolves the current object's center world-grid cell through `world_region_resolve_center_world_grid_cell` `0x00455f60` and then tails into `world_grid_cell_has_packed_u16_token_in_6byte_roster` `0x0042b2d0` with the caller-supplied `u16` token. Current grounded callers include the city-connection bonus sweep `0x004010f0`, where it acts as a center-cell token probe rather than a broader route or ownership query. | objdump + local disassembly + caller correlation + packed-roster correlation |
| 102 | 0x0041f6f0 | 5 | runtime_object_query_flag_byte_0x42 | map | thiscall | inferred | objdump + local disassembly + field inspection | 1 | Tiny raw byte getter over field `[this+0x42]`. The helper zero-extends that byte into `EAX` and returns immediately, with no side effect. Current evidence does not yet justify a tighter semantic name for the flag itself. | objdump + local disassembly + field inspection |
| 103 | 0x0041f700 | 3 | runtime_object_false_stub_vtable_5cfd00_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 104 | 0x0041f710 | 6 | runtime_object_true_stub_vtable_5cfd00_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Tiny literal-true virtual slot immediately after `0x0041f700` in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot. | objdump + vtable scan + local disassembly |
| 105 | 0x0041f720 | 136 | runtime_object_vtable_5c9a60_format_name_and_conditionally_dispatch_action_0x12 | map | thiscall | inferred | objdump + vtable scan + local disassembly + caller correlation | 2 | Virtual slot in the sibling runtime-object table rooted at `0x005c9a60`. The helper formats the current name lane `[this+0x356]` into one stack-local shell text buffer through `0x005193f0` and `0x00518de0`, publishes that buffer through `0x00538c70`, and then checks world state `[0x0062c120+0x2175]`. When that state is `0` or `0x15`, it dispatches `0x00452fa0` with current helper handle `[this+0x23a]`, literal action `0x12`, and the paired sentinel dwords `0x1869f/0x1869f`. The subtype name behind `0x005c9a60` is still open, so the current note stays structural around the formatted-name publish plus conditional action dispatch. | objdump + vtable scan + local disassembly + caller correlation + sibling-table correlation |
| 106 | 0x0041f7b0 | 42 | runtime_object_vtable_5c9a60_publish_fixed_shell_payload_and_jump_0x453510_when_world_state_0x12 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Small virtual slot in the same sibling runtime-object table `0x005c9a60`. The helper publishes the fixed payload at `0x005c87a8` through `0x00538c70`, then checks world state `[0x0062c120+0x2175]`; when that state equals `0x12`, it tails into `0x00453510`. Current evidence is strong enough for the publish-plus-conditional-dispatch shape but not yet for a user-facing subtype name. | objdump + vtable scan + local disassembly + sibling-table correlation |
| 107 | 0x0041f7e0 | 35 | placed_structure_prepend_peer_id_into_cached_u16_chain_head_field_0x383 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small chain-link helper beneath the placed-structure constructor family. The current record supplies cached head word `[this+0x383]`; the caller-supplied peer record receives that old head in `[peer+0x270]`, and the current record then replaces `[this+0x383]` with the peer's own placed-structure id `[peer+0x2a4]`. Current grounded caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, which reaches this helper immediately after seeding `[site+0x26e]` and `[site+0x270]`, so the safest read is a prepend into one cached `u16` link chain rather than a broader region or ownership transfer. | objdump + caller xrefs + local disassembly + link-chain correlation |
| 108 | 0x0041f810 | 51 | placed_structure_resolve_live_record_from_cached_u16_chain_head_field_0x383 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small resolver over cached head word `[this+0x383]`. The helper first asks collection `0x0062b26c` whether that `u16` id is still live through `0x00517d40`; when present it resolves and returns the corresponding record through `0x00518140`, otherwise it returns null. Current grounded caller is the higher route-style or transient branch at `0x0043bd62`, which uses the returned record before re-entering `0x0040cf00`. | objdump + caller xrefs + local disassembly + link-chain correlation |
| 109 | 0x0041f850 | 126 | placed_structure_remove_peer_from_cached_u16_chain_and_clear_peer_link_words_0x26e_0x270 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Removal-side companion to `0x0041f7e0` beneath the placed-structure rebuild family. The current record owns cached head word `[this+0x383]`, while the caller-supplied peer contributes its placed-structure id `[peer+0x2a4]` and next-link word `[peer+0x270]`. When the head equals the peer id, the helper replaces `[this+0x383]` with the peer's next link; otherwise it walks the current linked `u16` chain through collection `0x0062b26c` and each record's own `[record+0x270]` until it finds the predecessor, then patches that predecessor's `[record+0x270]` to the peer's next link. Before returning it clears both peer link words `[peer+0x26e]` and `[peer+0x270]`. Current grounded caller is the placed-structure rebuild branch at `0x0040e25e`. | objdump + caller xrefs + local disassembly + link-chain correlation |
| 110 | 0x0041f8d0 | 55 | placed_structure_clear_cached_u16_chain_from_head_field_0x383 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small chain-clear helper over cached head word `[this+0x383]`. Starting from that `u16` head id, the helper repeatedly resolves each live record through collection `0x0062b26c`, follows link word `[record+0x270]`, and clears both `[record+0x26e]` and `[record+0x270]` on every traversed record until the chain reaches zero. Current grounded caller is the release-side helper `0x00420670`, which uses this pass immediately before tailing into base cleanup `0x00455d20`. | objdump + caller xrefs + local disassembly + link-chain correlation |
| 111 | 0x0041f910 | 46 | runtime_object_query_mode_gate_or_flag_byte_0x42_when_class0 | map | thiscall | inferred | objdump + local disassembly + mode-gate correlation | 2 | Small mode-gated flag query adjacent to the sibling runtime-object family. It first checks shell mode gate `0x004338c0` on the active scenario root `0x006cec78`; when that gate is inactive it returns literal `1`. When the gate is active it also returns `1` for nonzero class dword `[this+0x23e]`, and only on the class-0 path does it return byte `[this+0x42]`. This keeps the current note structural around the mode-gated runtime-flag query rather than overnaming the flag itself. | objdump + local disassembly + mode-gate correlation + field inspection |
| 112 | 0x00412af0 | 117 | indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small indexed-collection lookup by casefolded name. The helper walks the live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the first byte of the caller string against entry field `[entry+0x04]` after normalizing both through `0x0051d660`, and then falls back to full string comparison through `0x005a57cf`. On the first exact match it returns that live entry id; otherwise it returns `0`. Current grounded caller is `0x00412b70`, which uses it over the structure-candidate pool `0x0062b268`. | objdump + local disassembly + caller correlation + collection-name-lookup correlation |
| 113 | 0x00412b70 | 35 | indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small resolve-by-name wrapper over `indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04` `0x00412af0`. It searches the current collection for the caller-supplied casefolded name, and when a live id is found it resolves and returns the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`; otherwise it returns null. Current grounded callers are the region-profile helpers `0x0041f940` and `0x0041f9b0`, where it resolves structure-candidate records from region-profile labels against the global candidate pool `0x0062b268`. | objdump + local disassembly + caller correlation + collection-name-lookup correlation |
| 114 | 0x0041f940 | 88 | world_region_count_structure_profiles_passing_availability_gate | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70` and passes the neighboring availability gate `0x0041f998`. The helper walks the live subcollection backward through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, increments the running count only for candidates that survive both gates, and returns that total. Current grounded caller is the editor-side region panel family around `0x004cbe19`, where it acts as the ungated companion to the stricter year-filtered counter `0x0041f9b0`. | objdump + local disassembly + caller correlation + region-subcollection correlation |
| 115 | 0x0041f998 | 23 | structure_candidate_availability_gate_reject_subtype2_without_availability_word_or_recipe_runtime | map | cdecl | inferred | objdump + local disassembly + caller correlation | 2 | Tiny flag-setting predicate over one structure-candidate record. Candidates whose subtype byte `[candidate+0x32]` is not `2` pass immediately. Subtype-`2` candidates only pass when availability word `[candidate+0xba]` is nonzero or runtime recipe latch `[candidate+0x7ac]` is nonzero; when both are zero the helper leaves the zero flag set so its callers reject the candidate. Current grounded callers are the two region-profile counters `0x0041f940` and `0x0041f9b0`. | objdump + local disassembly + caller correlation + candidate-availability correlation |
| 116 | 0x0041f9b0 | 126 | world_region_count_structure_profiles_matching_subtype_and_max_year_after_availability_gate | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70`, passes the neighboring availability gate `0x0041f998`, has subtype byte `[candidate+0x32]` equal to the caller-supplied subtype, and has year word `[candidate+0x26]` less than or equal to the caller-supplied max-year threshold. The helper walks the same live subcollection as `0x0041f940` through `0x00517cf0/0x00518380/0x00518140`, increments only when all four gates pass, and returns that stricter count. Grounded callers include the editor region panel around `0x004cbd41`, where it supplies the subtype-`2`, year-`0x726` companion count, and the later summary or warning pass at `0x004d0b1f`. | objdump + local disassembly + caller correlation + region-subcollection correlation + editor-panel correlation |
| 117 | 0x0041fa30 | 133 | world_region_query_profile_weight_by_casefolded_label | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Linearly scans the current region subcollection `[region+0x37f]`, compares each live profile label against the caller-supplied casefolded string through `0x005a57cf`, and returns float field `[entry+0x1e]` from the first match. When no label matches, the helper returns the shared zero float at `0x005c8598`. The editor copy-industry and region-summary paths already ground `[entry+0x1e]` as the mutable profile-weight lane, so the safest read is a casefolded profile-weight query by label rather than a broader scalar lookup. | objdump + local disassembly + caller correlation + region-subcollection correlation + profile-weight correlation |
| 118 | 0x0041fac0 | 59 | world_region_copy_nth_profile_label_and_weight_by_1_based_ordinal | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Resolves the caller-requested 1-based ordinal out of the current region subcollection root `[region+0x37f]`, copies the matched live profile label string into the caller buffer, and stores float field `[entry+0x1e]` through the caller-supplied out pointer. The helper uses `0x00518380/0x00518140` beneath the same subcollection root as `0x0041f940/0x0041fa30`, and grounded editor callers around `0x00421db7`, `0x00421ec7`, and `0x004d1817` use it as the ordinal enumerator for region profile labels plus weights. The current evidence is strong enough for a 1-based ordinal copy helper, not for a broader iterator name. | objdump + local disassembly + caller correlation + region-subcollection correlation + profile-weight correlation |
| 119 | 0x0041fb00 | 1130 | world_region_class0_stamp_local_secondary_overlay_and_scored_refinement_pass | map | thiscall | inferred | objdump + caller xrefs + local disassembly + raster-helper correlation | 3 | Heavy per-region helper used only on class-0 region records. The function skips any region whose class dword `[region+0x23e]` is nonzero, rounds the region's normalized coordinates through `0x00455800`, `0x00455810`, and `0x005a10d0`, derives one orientation bucket from `(x+y)&3`, and then runs two bounded local passes around that center. The first pass walks one orientation-dependent ring pattern from the static offset tables `0x00624b28/0x00624b48`, probes quarter-resolution secondary-raster cells through `0x00534e10`, and when that predicate stays clear marks the local secondary overlay through `0x004497a0(world, x, y, 1, 3, 1)`. The second pass scans a bounded square around the same center, scores each in-bounds cell through `math_measure_float_xy_pair_distance` `0x0051db80`, and then combines the local helper cluster `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0` before returning. Current grounded callers are the region collection walk at `0x00421d04` and the earlier world-build special case at `0x0044308e`, where the same helper runs immediately before `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`. | objdump + caller xrefs + local disassembly + raster-helper correlation + region-build correlation |
| 120 | 0x0041fff0 | 61 | world_query_shell_mode2_or_thresholded_preview_scalar_gate | map | cdecl | inferred | objdump + caller xrefs + local disassembly + global-field correlation | 2 | Small global gate over shell state `0x006cec74` and preview owner `0x0062be68`. The helper reads dword `[shell+0x2bb]` and returns `1` immediately when that mode equals `2`; when the mode is nonzero but not `2` it instead compares preview scalar `[0x0062be68+0x20]` against float threshold `0x005c9a9c` and returns `1` only when that comparison passes. Zero mode returns `0`. Current grounded callers are the scored world-scalar helper `0x0044afa0` and the city-connection status formatter band around `0x00420b09`, so the safest current read is the shared shell-mode-or-thresholded-preview gate rather than a region-only predicate. | objdump + caller xrefs + local disassembly + global-field correlation + threshold-gate correlation |
| 121 | 0x00455660 | 131 | runtime_object_publish_world_anchor_triplet_from_normalized_xy_and_height_bias | map | thiscall | inferred | objdump + caller xrefs + local disassembly + sibling-vtable correlation | 2 | Shared helper over the broader `0x23a` runtime-object family. The function scales the caller-supplied normalized coordinate pair through `0x005c8700`, converts that pair through world-basis owner `0x006d4024` plus `0x0051f090` and `0x00534490`, adds one caller-supplied integer height bias, optionally rounds that height when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting world-anchor triplet through `0x00530720`. It is used directly from both the city-entry side (`0x00455d09`, `0x00474253`) and the placed-structure specialization side through `0x0045b110`, so the safest current read is one shared world-anchor triplet publisher from normalized XY plus height bias rather than a city-only geometry helper. | objdump + caller xrefs + local disassembly + sibling-vtable correlation + world-anchor correlation |
| 122 | 0x004557b0 | 64 | record_collection_release_global_iteration_root_0x6acd40_if_present | map | cdecl | inferred | objdump + caller xrefs + local disassembly | 2 | Small release-side helper over the current global iteration root at `0x006acd40`. When that root is live the helper clears companion dword `0x006acd3c`, re-enters `0x0045b160` and `0x0045b040` on the pointed record, frees the record through `0x0053b080`, and finally clears `0x006acd40` itself. Current grounded callers include the shell detail-panel manager `0x004ddfc1`, the earlier world-side branch `0x00434a8c`, the building-detail side branch `0x004b6f64`, and later shell constructors at `0x00505dc6` and `0x005147e4`, so the safest current read is one shared global-iteration-root release helper rather than a tool-window-specific cleanup path. | objdump + caller xrefs + local disassembly + global-root correlation |
| 123 | 0x00455800 | 13 | runtime_object_query_normalized_primary_coord | map | thiscall | inferred | objdump + caller xrefs + field inspection + sibling-vtable correlation | 2 | Tiny float getter shared across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1e2]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455810` from city-side, placed-structure, route-link, and world-grid callers, and now also appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized primary coordinate getter rather than a fully named X/Y accessor. | objdump + caller xrefs + field inspection + sibling-vtable correlation |
| 124 | 0x00455810 | 13 | runtime_object_query_normalized_secondary_coord | map | thiscall | inferred | objdump + caller xrefs + field inspection + sibling-vtable correlation | 2 | Tiny float getter paired with `0x00455800` across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1ea]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455800` and appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized secondary coordinate getter rather than a fully named X/Y accessor. | objdump + caller xrefs + field inspection + sibling-vtable correlation |
| 125 | 0x00455930 | 148 | runtime_object_serialize_two_triplet_scalar_bands | map | thiscall | inferred | objdump + local disassembly + serializer symmetry + sibling-vtable correlation | 2 | Shared serializer over the broader `0x23a` runtime-object family. The helper first queries two triplet-like scalar bands through `0x0052e720` and `0x0052e880`, then writes the six resulting dwords to the caller-supplied bundle or stream through `0x00531030`. The grounded load-side stream counterpart is `0x00455870`, which reads those same six four-byte lanes back through `0x00531150` and republishes the resulting triplets. The same serializer slot appears in both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one shared serializer for two triplet scalar bands rather than a city-only stream helper. | objdump + local disassembly + serializer symmetry + sibling-vtable correlation |
| 126 | 0x004559d0 | 102 | runtime_object_serialize_tagged_string_triplet_and_dispatch_slot_0x4c | map | thiscall | inferred | objdump + local disassembly + serializer symmetry + sibling-vtable correlation | 2 | Shared tagged string-triplet serializer beneath the broader `0x23a` runtime-object family. The helper writes bracket tags `0x55f1/0x55f2/0x55f3` through `0x00531340`, emits the three string lanes `[this+0x206/+0x20a/+0x20e]` through `0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before writing the closing tag. Current grounded callers include the common placed-structure serializer path `0x0045b560` and the sibling-table wrapper `0x0041f650`, so this is the safest current read for the tagged string-triplet save-side helper rather than a load-side mirror. | objdump + local disassembly + serializer symmetry + sibling-vtable correlation + tagged-string correlation |
| 127 | 0x00455a40 | 3 | record_collection_dispatch_entry_virtual_slot_0x44 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 1 | Tiny collection-side dispatcher that jumps directly through the current entry vtable slot `+0x44`. Current grounded caller is the linked-list sweep at `0x0048a766`, where it is used while iterating sibling records under `0x00556ef0/0x00556f00`. The safest current read is a raw `slot+0x44` dispatch helper rather than a more semantic serializer name. | objdump + caller xrefs + local disassembly + linked-list sweep correlation |
| 128 | 0x00455a50 | 28 | record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 1 | Small collection-side wrapper that pushes one caller argument into current entry vtable slot `+0x40`, then clears the three global roots at `0x006acd38`, `0x006acd3c`, and `0x006acd40`. Current grounded caller is the object-construction path at `0x0048dd77`, so the safest current read is a raw `slot+0x40` dispatch plus global-iteration-root reset helper rather than a more semantic load or attach name. | objdump + caller xrefs + local disassembly + global-root reset correlation |
| 129 | 0x00455a70 | 135 | runtime_object_publish_current_position_triplet_with_height_bias | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Small runtime-object helper that queries the current position pair through `0x0052e720`, converts that pair through `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds one caller-supplied integer height bias, optionally rounds the result through `0x005a10d0` when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting triplet through `0x00530720`. Current grounded callers are the bounded-region sweeps at `0x00421fef` and `0x00461808`, which makes this the safest current read for a generic current-position triplet publisher rather than a city-entry-only helper. | objdump + caller xrefs + local disassembly + position-triplet correlation |
| 130 | 0x00455820 | 23 | runtime_object_store_byte43_triplet_from_three_bytes_and_recurse_children | map | thiscall | inferred | objdump + local disassembly + wrapper inspection | 2 | Tiny wrapper over `0x0052e680`. The helper forwards three caller-supplied byte lanes plus literal recursion flag `1`, causing the downstream packed-byte setter to write byte-triplet lane `[this+0x43]` and recurse across child list `[this+0x75]` when present. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from three explicit byte arguments. | objdump + local disassembly + wrapper inspection + packed-byte-family correlation |
| 131 | 0x00455840 | 23 | runtime_object_store_byte43_triplet_from_packed_u24_and_recurse_children | map | thiscall | inferred | objdump + local disassembly + wrapper inspection | 2 | Tiny wrapper over `0x0052e680`. The helper unpacks one caller-supplied dword into three byte lanes, forces recursion flag `1`, and forwards the result into the shared packed-byte setter for lane `[this+0x43]`. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from one packed `u24`-style value rather than three explicit byte arguments. | objdump + local disassembly + wrapper inspection + packed-byte-family correlation |
| 132 | 0x00455860 | 5 | runtime_object_thunk_to_shared_formatter_0x530820 | map | thiscall | inferred | objdump + local disassembly + caller correlation | 1 | Tiny tail-jump thunk that forwards directly into `0x00530820`. Current grounded callers include the placed-structure UI formatter `0x0040e9d0` and the city-site connection-status formatter `0x004207d0`, so the safest current read is a shared fallback formatter thunk rather than a standalone owner. | objdump + local disassembly + caller correlation |
| 133 | 0x00455870 | 83 | runtime_object_load_two_triplet_scalar_bands_from_stream_and_publish_them | map | thiscall | inferred | objdump + local disassembly + stream-load symmetry | 2 | Shared load-side helper over the broader `0x23a` runtime-object family. The function reads six four-byte lanes from the caller-supplied stream through `0x00531150`, then publishes the first three as one triplet through `0x00530720` and the second three through `0x0052e8b0`. The accumulated return value is the summed byte count from those six `0x531150` reads. This is the strongest current load-side counterpart to `runtime_object_serialize_two_triplet_scalar_bands` `0x00455930` rather than an unrelated stream helper. | objdump + local disassembly + stream-load symmetry + triplet-publish correlation |
| 134 | 0x00455b20 | 72 | runtime_object_initialize_base_0x23a_record_fields | map | thiscall | inferred | objdump + caller xrefs + local disassembly + field-layout correlation | 2 | Shared base initializer for one `0x23a`-sized runtime object family. The helper installs base vtable `0x005cb1c0`, clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, and re-enters `0x0052ecd0` before returning `this`. Current grounded callers include the city-entry temporary constructor `0x00474110`, multiple specialization loaders around `0x0045b683/0x0045c893`, and the object-construction path at `0x0048dd65`, so the safest current read is a shared base-field initializer rather than a city-only constructor. | objdump + caller xrefs + local disassembly + field-layout correlation + object-size correlation |
| 135 | 0x00455b00 | 1 | runtime_object_noop_stub_vtable_5cfd00_slot0 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name. | objdump + vtable scan + local disassembly |
| 136 | 0x00455b10 | 1 | runtime_object_noop_stub_vtable_5cfd00_slot1 | map | thiscall | inferred | objdump + vtable scan + local disassembly | 1 | Second literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name. | objdump + vtable scan + local disassembly |
| 137 | 0x00455b70 | 266 | runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults | map | thiscall | inferred | objdump + caller xrefs + local disassembly + field-layout correlation | 2 | Shared initializer over the same `0x23a`-sized runtime object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, optionally copies up to three caller-supplied strings into `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` through `0x0051d820`, synthesizes one default local token buffer when the middle string is absent through `0x00518de0`, chooses one effective mode string from the third or first input, derives one owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and then re-enters `0x0052edf0` plus `0x0052e670` to seed the remaining runtime scalar band. Current grounded callers span the city-entry constructor `0x004741e3`, several specialization-side rebuilds, and later object constructors at `0x0048a299`, `0x0048a31d`, and `0x00490a79`, so the safest current read is a shared scalar-band initializer from optional string triplet plus mode defaults rather than a city-only helper. | objdump + caller xrefs + local disassembly + field-layout correlation + optional-string correlation + mode-default correlation |
| 138 | 0x00455fc0 | 250 | runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands | map | thiscall | inferred | objdump + local disassembly + serializer symmetry + sibling-vtable correlation | 2 | Shared tagged-payload loader over the broader `0x23a` runtime-object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, opens the tagged bracket `0x55f1..0x55f3`, reads three temporary strings through `0x00531380`, reseeds the runtime scalar band through `runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults` `0x00455b70` with default float lanes `1.0/1.0` and flag `0`, then dispatches vtable slot `+0x48` and re-enters `0x0052ebd0`. Current grounded callers include the city-entry refresh helper `0x00474260` and the placed-structure specialization loader `0x0045c150`, so the safest current read is a shared tagged string-triplet loader plus scalar-band reseed rather than a city-only payload helper. | objdump + local disassembly + serializer symmetry + sibling-vtable correlation + scalar-band reseed correlation |
| 139 | 0x004560c0 | 53 | runtime_object_query_nested_lookup_float_via_fields_0x14_0x3a_0x21 | map | thiscall | inferred | objdump + local disassembly + field-chain correlation | 1 | Small shared float query over the broader `0x23a` runtime-object family. When lookup root `[this+0x14]` is nonnull, the helper derives one nested table offset from `[this+0x3a]` and `[this+0x21]`, follows that chain, and returns the float at the resolved record's `+0x18`; otherwise it returns `0.0`. Current evidence grounds the lookup chain but not the higher semantic meaning of those fields, so the note stays deliberately structural. | objdump + local disassembly + field-chain correlation |
| 140 | 0x00418a60 | 372 | placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan. | objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation |
| 141 | 0x00418be0 | 346 | placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper. | objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation |
| 142 | 0x004197e0 | 5232 | placed_structure_validate_projected_candidate_placement | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`. | objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation |
| 143 | 0x00480210 | 448 | placed_structure_construct_linked_site_record_from_anchor_and_coords | map | thiscall | inferred | objdump + caller inspection + constructor inspection | 3 | Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`. | objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation |
| 144 | 0x0048a1e0 | 336 | runtime_object_attach_infrastructure_child_with_optional_first_child_triplet_clone | map | thiscall | inferred | objdump + caller xrefs + local disassembly + rdata correlation | 2 | Shared `Infrastructure` child-attach helper over the broader `0x23a` runtime-object family. The function first checks the caller's child list at `[this+0x08]`. When that list holds more than one child, it samples the first child's two triplet scalar bands through `0x0052e880` and `0x0052e720`, destroys the caller-selected prior child through vtable slot `+0x18(0)`, allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, attaches it back to the owner through `0x005395d0`, and republishes the sampled triplets through `0x0052e8b0` and `0x00530720`. When the owner has at most one child, it still allocates and seeds the same `Infrastructure` object but attaches it through `0x0053a5d0` without the cloned-triplet republish. Current grounded callers are the repeated builder branches around `0x004a2cde..0x004a37d9`, so this is the safest current read for attaching one seeded `Infrastructure` child with an optional first-child triplet clone rather than a subtype-specific UI helper. | objdump + caller xrefs + local disassembly + rdata correlation + child-attach correlation |
| 145 | 0x0048abc0 | 11 | linked_site_set_route_entry_anchor_id_field_0x222 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Tiny direct setter over linked-site dword `[this+0x222]`. The helper stores the caller-supplied route-entry id and returns. Current grounded callers are the linked-site constructor and refresh family at `0x00480210`, `0x00480bb0`, and nearby repair branches `0x00480463`, `0x00480968`, `0x00480ac1`, and `0x00480da1`, where this field is treated as the currently chosen route-entry anchor id. The safest current read is therefore a direct linked-site route-entry-anchor setter rather than a generic scalar write. | objdump + caller xrefs + local disassembly + route-anchor correlation |
| 146 | 0x0048abd0 | 1 | linked_site_noop_stub | map | thiscall | inferred | objdump + local disassembly | 1 | Literal no-op stub adjacent to the linked-site route-entry-anchor helpers. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name. | objdump + local disassembly |
| 147 | 0x0048abe0 | 15 | linked_site_query_mode_field_0x226_equals_2 | map | thiscall | inferred | objdump + local disassembly | 2 | Tiny predicate over linked-site dword `[this+0x226]`. The helper returns `1` only when that field equals literal `2`. Current local callers are still indirect through the linked-site vtable, so the field's player-facing meaning remains open; the safest current read is a direct `mode == 2` predicate over linked-site field `0x226`. | objdump + local disassembly + linked-site-field correlation |
| 148 | 0x0048dd50 | 359 | runtime_object_rebuild_infrastructure_children_and_refresh_primary_child_slot | map | thiscall | inferred | objdump + local disassembly + caller correlation + rdata correlation | 2 | Loop-driven `Infrastructure` child rebuild beneath the same `0x005cfd00` family. For each ordinal `0..count-1`, the helper allocates a fresh `Infrastructure` child, dispatches that child through `record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots` `0x00455a50`, and either tears the child down when the current ordinal is above `5` or attaches it back to the owner through `0x005395d0` after republishing the child's current triplet bands. When owner field `[this+0x248]` still points at the same ordinal index byte, it replaces that cached primary-child slot with the rebuilt child. After the loop it recomputes one grid anchor from current world-space fields, refreshes the current world cell through `0x00448a70`, conditionally re-enters `0x00493660` and `0x0048b660` when byte `[this+0x216]` equals `1`, and finally re-enters `0x0048b660` once more before returning. The current note stays structural because the user-facing subtype semantics remain open, but the `Infrastructure` child-rebuild ownership is strong. | objdump + local disassembly + caller correlation + rdata correlation + child-rebuild correlation |
| 149 | 0x0048e140 | 24 | runtime_object_resolve_route_entry_from_field_0x206 | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Tiny direct resolver over owner dword `[this+0x206]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2cec` and the tracker regroup helper `0x004a4ff0`. | objdump + caller xrefs + local disassembly + route-entry-field correlation |
| 150 | 0x0048e160 | 24 | runtime_object_resolve_route_entry_from_field_0x20a | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 2 | Tiny direct resolver over owner dword `[this+0x20a]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2d15` and the tracker regroup helper `0x004a4ff0`. | objdump + caller xrefs + local disassembly + route-entry-field correlation |
| 151 | 0x0048e180 | 24 | runtime_object_resolve_route_entry_from_field_0x20e | map | thiscall | inferred | objdump + local disassembly + route-entry-field correlation | 2 | Tiny direct resolver over owner dword `[this+0x20e]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. It is the third direct sibling of `0x0048e140` and `0x0048e160` over the same triplet-backed route-entry field family. | objdump + local disassembly + route-entry-field correlation |
| 152 | 0x00490a3c | 123 | runtime_object_attach_optional_infrastructure_child_and_seed_three_position_lanes | map | thiscall | inferred | objdump + local disassembly + rdata correlation | 2 | Optional `Infrastructure` child-attach branch beneath the same broader runtime-object family. When the caller-supplied payload stem is nonnull, the helper allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, and attaches it back to the current owner through `0x005395d0`. It then publishes two caller-supplied position lanes through `0x00539530`, one third lane through `0x0053a5b0`, and optionally stores the new child into owner field `[this+0x248]` when the trailing pointer argument is nonnull. The safest current read is therefore an optional `Infrastructure` child attach plus three-lane seed helper rather than a broader constructor for the whole owner object. | objdump + local disassembly + rdata correlation + child-attach correlation |
| 153 | 0x00413580 | 160 | placed_structure_collection_refresh_quarter_subset_route_style_state | map | thiscall | inferred | objdump + caller inspection + collection-iteration inspection | 3 | Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper computes a start index from the scenario time byte at `0x006cec78+0x11` modulo `4`, then walks every fourth live placed-structure record in the collection, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass. | objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation |
| 154 | 0x00414fa0 | 118 | world_grid_count_flagged_cells_and_collect_float_samples | map | cdecl | inferred | objdump + callsite inspection | 3 | Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues. | objdump + callsite inspection + world-grid scan correlation |
| 155 | 0x00415020 | 1968 | world_grid_refresh_flagged_region_float_extrema_and_mean | map | cdecl | inferred | objdump + caller inspection | 3 | Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper. | objdump + caller inspection + version-gate correlation + world-grid scan correlation |
| 156 | 0x00415f20 | 403 | placed_structure_recursive_collect_connected_component_tile_bounds | map | thiscall | inferred | objdump + caller inspection | 3 | Recursive connected-component bounds collector over linked placed-structure records. Starting from one placed-structure node, the helper expands four caller-owned tile-bound out slots from the record-local rectangle fields `[record+0x4a0..0x4ac]`, tags the record with the current component pass id at `[record+0x73e]`, then walks the component membership map rooted at `0x0062ba7c` to find adjacent records whose packed tile key falls inside the current rectangle and whose prior pass id differs. Matching adjacent records recurse through the same helper until the reachable component rectangle is exhausted. On return the helper also seeds one default local rectangle owner through `0x004159e0` when `[record+0x732] == -1`, then refreshes the neighboring runtime side through `0x0040ee10`. Current grounded callers are the wrapper at `0x004160c0` and internal recursive self-calls. | objdump + caller inspection + recursive-component correlation + placed-structure-bound correlation |
| 157 | 0x004160c0 | 168 | placed_structure_collect_connected_component_tile_bounds_with_version_gate | map | cdecl | inferred | objdump + caller inspection | 3 | Wrapper above `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`. The helper initializes four tile-bound accumulators to sentinel values, increments one world-grid reentry depth counter at `0x0062c120+0x2205`, and then chooses between two paths. On builds `1.03` and earlier, or when scenario field `[0x006cec78+0x46c38]` is still clear, it re-enters the recursive component walk through `0x00415f20`; otherwise it skips that older walk entirely. In both cases it decrements the reentry counter and then expands the surviving rectangle by `2` tiles on each side before publishing it through `0x0044d410`. Current grounded caller is the route-entry-backed component wrapper at `0x004161a0`, so this now looks like the version-gated connected-component bounds collector rather than another generic tracker helper. | objdump + caller inspection + version-gate correlation + connected-component correlation |
| 158 | 0x00416170 | 345 | placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tile-range wrapper above `placed_structure_collect_connected_component_tile_bounds_with_version_gate` `0x004160c0`. The helper seeds the current connected-component pass keys at `0x0062ba7c` and `0x0062ba80`, iterates the caller-supplied tile rectangle, allocates or reuses one small per-tile record from the caller-owned queue, and looks up the packed `(row << 16) | col` key through the component map rooted at `0x0062ba7c` via `0x0053dae0`. When one mapped component record exists and the current placed-structure owner at stack arg `+0x0c` still has `[site+0x732] == -1`, the world-side latch at `[0x0062b2fc+0x9c]` is clear, scenario field `[0x006cec74+0x4fd]` is clear, and the caller-supplied suppress-refresh flag at stack arg `+0x10` is zero, it follows the mapped component chain and re-enters `0x004160c0` for each linked record; otherwise it clears one world-grid byte through `0x00448a70`. The resolved or refreshed record is then stored back through `0x0053d9e0` and `0x0053d960`. Current grounded callers are the neighboring local-runtime passes at `0x00418a60` and `0x00418be0`, so this is now the strongest current owner for mapping one tile rectangle into connected-component records with optional bounds refresh rather than another bare recursive walk. | objdump + caller inspection + local disassembly + connected-component-map correlation |
| 159 | 0x00416e20 | 156 | indexed_collection_resolve_live_entry_id_by_stem_string | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small live-entry resolver over an indexed collection. The helper walks the live slot count through `indexed_collection_slot_count` `0x00517cf0`, fetches each live id through `indexed_collection_get_nth_live_entry_id` `0x00518380`, resolves the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and compares the caller-supplied string against the record stem at `[record+0x04]` through `0x005a57cf`. On success it returns the matching live id. On failure it emits localized id `189` through the shell string helpers and returns `-1`. Current grounded callers are the neighboring placed-structure local-runtime builders at `0x00418be0` and `0x0040e450`, plus one shell-side branch at `0x00507e80`, so this is now the strongest current match for a stem-to-live-id resolver rather than an unowned search loop. | objdump + caller inspection + local disassembly + stem-compare correlation |
| 160 | 0x00416ec0 | 1867 | placed_structure_build_projected_runtime_scratch_from_candidate_and_coords | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavy projected-runtime scratch builder beneath the neighboring local placed-structure runtime family. The helper resolves one candidate record from the caller-supplied id, derives rotated footprint extents and centered world-space bounds from the caller-supplied coordinate and heading inputs, allocates and clears several temporary per-footprint mask bands on the stack, then walks up to four candidate-side shape or access sublanes rooted at `[candidate+0xcf]`, `[candidate+0xd3]`, `[candidate+0xd7]`, and `[candidate+0xdb]`. Within that deeper loop it projects rotated footprint cells through the basis pair at `0x006d4024`, rejects out-of-bounds or duplicate cells, checks multiple world-grid acceptance gates through `0x00448af0`, `0x00534e10`, `0x004499c0`, and `0x00413df0`, and marks the surviving cells into both temporary stack masks and the live world-grid byte lane at `[0x0062c120+0x2131]`. The tail publishes the finished scratch payload through `0x00416620`. Current grounded caller is `0x00418be0`, which then copies that scratch block into one queued local runtime record, so this is now the safest current name for the projected-runtime scratch builder rather than a generic placement validator. | objdump + caller inspection + local disassembly + projected-footprint correlation |
| 161 | 0x00418040 | 1168 | placed_structure_render_local_runtime_overlay_payload_from_projected_bounds | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Heavy local-runtime overlay-payload builder beneath the broader local-runtime record family. The helper derives one projected bounds rectangle through `0x004142e0` and `0x00417f20`, rejects very small payloads, allocates one temporary dword buffer, folds that buffer through `0x00415370`, and then walks the projected rectangle producing one packed dword payload per cell. Current bounded gates include a duplicate-entry or occupancy fast path keyed by `[var_10h]`, world-grid rejection through `0x004499c0`, and several distance- and ratio-shaped thresholds built from the projected rectangle geometry. On accepted cells it writes one four-byte packed value into the caller output stream. Current grounded caller is `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` `0x00418be0`, where the result is stored into `[0x0062b7c8]`, so this is now the safest current read for the local-runtime overlay payload renderer rather than a generic geometric sweep. | objdump + caller inspection + local disassembly + overlay-payload correlation |
| 162 | 0x00414470 | 10 | placed_structure_cache_projected_rect_profile_slot_id | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tiny setter for the projected-rectangle profile-slot cache at `0x005ee030`. The helper just stores the caller-supplied dword into that global cache. Current grounded caller is `0x0040e450`, where the cached value is set immediately before the current-subject local-runtime clone path at `0x00418a60`. | objdump + caller inspection + local disassembly + global-cache correlation |
| 163 | 0x00416620 | 521 | placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Publishes one projected-runtime rectangle and its companion globals beneath the local-runtime scratch builder. The helper copies the current scratch owner id from `0x0062b304` into `0x0062b308`, stores the caller-supplied pair into `0x0062b30c/0x0062b310`, grows the active rectangle bounds at `0x0062b7ac` and `0x0062b7b4` when needed, clears one current index slot in `0x0062b318`, and then validates the rectangle against the route-entry store `0x006cfca8` through `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`. On failure it raises localized id `185`; on one special-candidate branch keyed by `[record+0x123]` it re-enters `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, either expands the rectangle by three cells on each side and refreshes the per-cell side tables through `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` or fails with localized id `186`; and on the ordinary branch it can scan the temporary cell-value bank at `0x0062b300` across the rectangle and fail with localized id `187` before again tailing into `0x00414e10`. Current grounded callers are `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0` and the placement validator `0x004197e0`, so this now looks like the projected-runtime rectangle publisher plus side-window validator rather than an anonymous scratch tail. | objdump + caller inspection + local disassembly + projected-rectangle-global correlation |
| 164 | 0x00415570 | 317 | placed_structure_try_select_projected_rect_profile_slot | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Small projected-rectangle profile selector beneath `0x00416620`. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, resets the shared slot id at `0x0062ba3a`, derives one companion value through `0x00413eb0` into `0x0062ba3e`, and then probes the current rectangle at `0x0062b7a8..0x0062b7b4` through repeated `0x004153f0` checks. One fast path reuses the cached selector at `0x005ee030`; another starts from localized id `11` through `0x00518be0`; and both update `0x0062ba3a` on success. Current grounded caller is the special-candidate branch inside `0x00416620`, where the returned success decides whether the rectangle can be expanded and the companion byte tables refreshed. This is therefore best-read as a projected-rectangle profile-slot selector rather than a broad route or placement policy helper. | objdump + caller inspection + local disassembly + rectangle-probe correlation |
| 165 | 0x00414e10 | 200 | world_grid_refresh_projected_rect_surface_and_region_byte_tables | map | cdecl | inferred | objdump + caller inspection + local disassembly | 2 | Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan. | objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation |
| 166 | 0x00494240 | 195 | route_entry_collection_query_rect_window_passes_entry_type_gate | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan. | objdump + caller inspection + local disassembly + route-entry-window correlation |
| 167 | 0x00411ee0 | 451 | structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables | map | thiscall | inferred | objdump + callsite inspection | 3 | Rebuilds the per-candidate cargo summary tables after one runtime descriptor array has been materialized. The helper clears the two cargo-id pointer tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and one float-like per-cargo accumulator band rooted at `[this+0x0a1]`, then walks every live `0xbc` descriptor in `[this+0x37]` against the current scenario year at `[0x006cec78+0x0d]`. For each active subordinate cargo row in the descriptor-owned `0x1c`-byte entry band it resolves one cargo id through the global cargo collection at `0x0062ba8c`, updates the per-cargo accumulator, and tracks one or two levels of cargo membership before compacting those marks into the two emitted cargo-id tables. The stronger production-mode result is now bounded here rather than only in the editor importer: when the descriptor-side mode flag at `[desc+0x00]` is zero the subordinate row amount is multiplied by the shared recipe-book production cap at `[this+0x2a]` and divided by the descriptor amount at `[desc+0x04]`; when that mode flag is nonzero the helper bypasses that scaling path. That matches the editor-side split where production mode keeps the entered annual amount on the supply half while the demand half is normalized to `1.0`, so the demand-side production branch now looks like a normalized input selector or gate while the supply side is the branch that receives cap-scaled runtime rates. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`. | objdump + callsite inspection + scenario-state correlation + cargo-collection correlation |
| 168 | 0x00412560 | 144 | structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`. | objdump + caller xrefs + callsite inspection + cargo-collection correlation + special-condition correlation |
| 169 | 0x004125f0 | 87 | structure_candidate_count_active_scaled_supply_descriptors | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Counts active runtime descriptors that participate in the scaled supply-side production lane for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, selects only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active scaled-supply descriptors. | objdump + caller xrefs + callsite inspection |
| 170 | 0x00412650 | 543 | structure_candidate_query_cargo_runtime_summary_channels | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, then walks every live `0xbc` descriptor across two mode banks through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. Demand-side descriptors with nonzero mode dword accumulate subordinate-row weights into the bank rooted at `[this+0x10e]`; direct supply descriptors with no subordinate rows accumulate annual amounts into `[this+0x03a]`; and scaled supply descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, then publish the per-descriptor share into `[this+0x0a4]` and the subrow-scaled outputs into `[this+0x178]`. The index lanes are tighter now too: the no-subrow paths use the resolved cargo id at `[desc+0x1c]` directly, and the subordinate-row loop indexes each output lane directly from `[desc+0x44+row*0x1c]`, with no post-resolution failure guard in this consumer. So the strongest current read is that unresolved imported marker rows would still fall into the first summary-bank bucket here, while the semantic meaning of cargo id `0` itself remains ungrounded. The helper finally returns one caller-selected cargo entry from all four banks through out-pointers, so current grounded meaning is one direct-supply channel, one cap-normalized supply channel, one demand or input channel, and one scaled production-output subrow channel rather than a single aggregate total. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`. | objdump + caller xrefs + callsite inspection + scenario-state correlation |
| 171 | 0x00412960 | 49 | structure_candidate_query_direct_and_normalized_supply_channels | map | thiscall | inferred | objdump + callsite inspection | 3 | Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the sum of the wrapper's two supply-side out lanes rather than exposing all four summary channels directly. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the direct-supply-side cargo presence test. The wrapper does not add any post-query special case for unresolved cargo bucket `0`; it just sums the returned supply-side floats. | objdump + callsite inspection + wrapper-correlation |
| 172 | 0x004129a0 | 45 | structure_candidate_query_scaled_production_output_channel | map | thiscall | inferred | objdump + callsite inspection | 3 | Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the single scaled production-output subrow channel without combining it with the neighboring supply lanes. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the scaled-supply or production-side cargo presence test. Like the sibling wrapper at `0x00412960`, it does not special-case unresolved cargo bucket `0` after the underlying query returns. | objdump + callsite inspection + wrapper-correlation |
| 173 | 0x004129d0 | 179 | structure_candidate_supports_or_references_cargo_id | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. The current caller picture is tighter too: the placed-structure sweep around `0x00452e60` only enters this helper when the requested cargo id is nonzero. When that sweep receives requested id `0`, it explicitly routes around the cargo-reference branch into a separate linked-site or station-or-transit gate over the current placed structure's subtype latch, linked site id `[site+0x2a8]`, and the narrower linked-site predicate at `0x0047fd50`. So this helper itself does not currently look like the intentional owner for a null-cargo query. | objdump + caller xrefs + callsite inspection + cargo-summary correlation + caller-branch correlation + linked-site-bypass correlation |
| 174 | 0x00412d70 | 563 | structure_candidate_collection_rebuild_runtime_records_from_scenario_state | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062ba8c`. The helper iterates the collection twice against the paired availability bytes at `[candidate+0xba]` and `[candidate+0xbb]`, chooses one existing record to clone when the scenario-side owner id at `[candidate+0x794]` matches, otherwise clears the target record, and then repopulates the candidate runtime fields from the active scenario state rooted at `0x006cec78`. For each rebuilt candidate it copies the recipe-line count from `[state+0x1024]`, the shared production-cap float from `[state+0x13d4]`, and the packed `0xbc` descriptor array from `[state+0x1028]`, then refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` at `0x00411ee0` and the neighboring mode-flag pass at `0x00411ce0`. One bounded text side branch also republishes the candidate label from the scenario-side recipe-book name around `[state+0x0fe8]` when that string ends in `:`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` at `0x00435630` and the larger collection load path at `0x00412fb0`, so this now looks like the candidate-side bridge that projects editor recipe-book state into live runtime records rather than another generic collection copy loop. | objdump + caller xrefs + callsite inspection + scenario-state correlation |
| 175 | 0x00412ca0 | 192 | world_region_pick_commercial_profile_label_by_region_rank | map | thiscall | inferred | objdump + strings + callsite inspection | 4 | Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`. | objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings |
| 176 | 0x004133b0 | 132 | placed_structure_collection_refresh_local_runtime_records_and_position_scalars | map | thiscall | inferred | objdump + caller inspection + local disassembly | 2 | Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b26c` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller is no longer just an anonymous raw callsite: it sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep. | objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation |
| 177 | 0x00413f50 | 47 | placed_structure_local_runtime_site_id_queue_pop_next | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt. | objdump + caller inspection + local disassembly + local-runtime-queue correlation |
| 178 | 0x00414480 | 6 | placed_structure_local_runtime_site_id_queue_count | map | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Tiny count getter over the temporary placed-structure id queue used by the local-runtime refresh family. The helper simply returns the current queue count at `0x0062ba64`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the returned count bounds the queue-drain loop before the later all-sites side refresh. | objdump + caller inspection + local disassembly + local-runtime-queue correlation |
| 179 | 0x0041e8e0 | 63 | structure_candidate_collection_write_filter_and_year_visible_summary_blocks | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small packed-state write wrapper over the live structure-candidate collection at `0x0062ba8c`. The helper opens two tagged packed blocks through `0x00531360` with ids `0x6979` and `0x697a`, forwards the caller's packed-state sink plus side flag into `0x00518680`, and returns the combined emitted size. Current grounded caller is the later world-entry or restore-side branch at `0x00444375`, immediately after the candidate-count refresh family has run, so this is the safest current read for the candidate-summary packed-state write sibling rather than a direct count recompute helper. | objdump + local disassembly + caller correlation + packed-state correlation |
| 180 | 0x0041e930 | 48 | structure_candidate_collection_read_filter_and_year_visible_summary_blocks | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Small packed-state read wrapper over the same structure-candidate summary family at `0x0062ba8c`. The helper opens the tagged blocks `0x6979` and `0x697a` through `0x00531340`, forwards the caller's packed-state source plus side flag into `0x00517d90`, and returns after both reads complete. Current grounded caller is the neighboring world-entry-side branch at `0x00445226`, which uses this read-side companion after shell service and before later post-load status updates, so this is the safest current read for the candidate-summary packed-state import sibling rather than a direct filter refresh helper. | objdump + local disassembly + caller correlation + packed-state correlation |
| 181 | 0x0041e970 | 121 | structure_candidate_collection_refresh_filter_and_year_visible_counts | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide counter refresh over the live structure-candidate pool at `0x0062ba8c`. The helper clears aggregate counts `[this+0x242]` and `[this+0x31a]`, then walks all `0x35` candidate slots through the collection accessors. For each live slot it stores the cargo-economy or editor-filter flag `[entry+0x56]` into one per-slot band rooted at `[this+0x246]`, increments `[this+0x31a]` when that flag is nonzero, re-enters `structure_candidate_is_enabled_for_current_year` `0x0041e220`, stores that result into the paired per-slot band rooted at `[this+0x16e]`, and increments `[this+0x242]` when the year-visible gate succeeds. Current grounded callers include the periodic boundary-service path at `0x0040a56a`, the post-fast-forward setup tail at `0x00437192`, the cargo-economy filter refresh family at `0x0041eac0/0x0041f584`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring locomotive-side bridge at `0x00464aa8`, so this is the safest current read for the shared candidate-collection filter and year-visible count rebuild rather than a one-off world-entry helper. | objdump + local disassembly + caller correlation + candidate-count correlation + year-visible correlation |
| 182 | 0x0041ea50 | 179 | world_setup_building_collection_phase | map | cdecl | inferred | objdump + strings + callsite inspection | 3 | Post-load world-generation subphase inside world_run_post_load_generation_pipeline. The helper iterates the building-related collection at `0x0062ba8c`, chooses either the full pass or one modulo-selected bucket from the current world byte at `[0x006cec78+0x0f]`, resolves each entry through `0x00518380` and `0x00518140`, and then dispatches the selected record into the lower setup worker at `0x0041e2b0`. Current grounded callsite is the early collection sweep inside world_run_post_load_generation_pipeline immediately before the localized progress update `Setting up Players and Companies...`, so this looks like the collection-owned building-setup staging phase rather than one of the later player-speed or shell-frame loops. | objdump + caller context + RT3.lng strings |
| 183 | 0x0041e220 | 52 | structure_candidate_is_enabled_for_current_year | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper. | objdump + caller xrefs + callsite inspection + cargo-economy filter correlation |
| 184 | 0x0041e650 | 142 | structure_candidate_query_route_style_or_local_availability_metric | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + collection-correlation | 3 | Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader. | objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation |
| 185 | 0x00467eb0 | 104 | placed_structure_route_link_attach_site_owner | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Attaches one `0x006ada90` route-link record onto the owner chain of one placed structure. The helper first detaches the current record through `0x00467df0`, stages the caller-supplied placed-structure id into route-link field `+0x0a`, links the record into the placed-structure-owned chain at `[site+0x272]` through route-link field `+0x04`, and then re-enters `0x00467c30` to recompute the route-link flag byte at `+0x12` against neighboring site pairs. When that flag byte keeps bit `0x2` set, the helper also projects one class-indexed signed contribution through `0x0040fa50` and accumulates it into the placed structure through `0x0042b310`. Current grounded caller is the route-link allocator path at `0x00468067`, which makes this the clearest current owner bridge from one freshly allocated `0x006ada90` record into the site-linked chain later scanned by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` and `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650`. | objdump + caller xrefs + chain-layout inspection + route-link-correlation |
| 186 | 0x00467df0 | 183 | placed_structure_route_link_detach_current_owner_chain | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Detaches one `0x006ada90` route-link record from whichever owner chain currently anchors it. The helper first checks route-link field `+0x08`; when nonzero it treats that field as one route-node-like owner id in collection `0x006cfcbc` and unlinks the record through owner field `+0x04` plus route-node link slot `+0x29`. Otherwise it falls back to the placed-structure owner path, using route-link field `+0x0a` as one site id in collection `0x0062b26c`, optionally applying the same class-indexed signed contribution rollback through `0x0040fa50` and `0x0042b310` when flag byte `+0x12` keeps bit `0x2` set, and then unlinking through `[site+0x272]`. Current grounded callers are the site-owner attach path at `0x00467eb0`, the route-node attach path at `0x00467f20`, and the route-link destructor path at `0x004680b0`, so this now looks like the shared detach helper beneath all owner-chain rewrites for the route-link family. | objdump + caller xrefs + chain-layout inspection + owner-slot correlation |
| 187 | 0x00467c30 | 443 | placed_structure_route_link_recompute_endpoint_pair_state | map | thiscall | inferred | objdump + caller xrefs + endpoint-pair inspection | 3 | Recomputes the route-link state byte at `+0x12` from the active site-endpoint pair and updates the linked site contribution when that state flips. The helper only runs on the site-owned branch where route-link field `+0x08` is zero; it resolves the two endpoint site ids from fields `+0x0a` and `+0x0e` through collection `0x0062b26c`, clears the prior bit-`0x2` state, then compares the two endpoint-side route-entry chains through `0x00455f60`, `0x0047de00`, `0x0040c990`, and `0x0047f2d0` until it finds a compatible shared peer. On the first match it restores bit `0x2` in the state byte. If the boolean substate derived from bit `0x1` changes across the recomputation, the helper applies one signed class-indexed contribution through candidate class byte `+0x10`, the class-weight table at `0x0062ba8c+0x8e`, and `0x0042b310` against the first endpoint owner. Current grounded callers are the site-owner attach path `0x00467eb0`, the route-link rebuild sweep around `0x004682e6`, and the route-link allocator path at `0x0046809b`, so this now looks like the endpoint-pair state reconciler beneath the route-link family rather than a generic chain walk. | objdump + caller xrefs + endpoint-pair inspection + shared-peer correlation |
| 188 | 0x00467f20 | 45 | placed_structure_route_link_attach_route_node_owner | map | thiscall | inferred | objdump + caller xrefs + chain-layout inspection | 3 | Attaches one `0x006ada90` route-link record onto the owner chain of one route-node-like record in collection `0x006cfcbc`. The helper first detaches the current record through `0x00467df0`, then stages the caller-supplied route-node id into route-link field `+0x08` and links the route-link through owner field `+0x04` plus route-node link slot `+0x29`. Current grounded caller is the route-node-side rewrite path at `0x004680e0`, which keeps this as the route-node owner companion to `placed_structure_route_link_attach_site_owner` rather than another site-chain helper. | objdump + caller xrefs + chain-layout inspection + route-node-owner correlation |
| 189 | 0x00467f50 | 352 | placed_structure_route_link_allocate_site_pair_for_candidate_class | map | cdecl | inferred | objdump + caller xrefs + stack-layout inspection + class-counter correlation | 3 | Allocates and seeds one new `0x006ada90` route-link record for a caller-supplied placed-structure pair and candidate class. The helper builds one `0x19`-byte local template whose current grounded creation-side writes seed route-link fields `+0x0c` and `+0x0e` from the two input site ids, class byte `+0x10` from the supplied candidate-class argument, and one masked initial state template from the class side table at `0x005f2adc[class]`. It then allocates the live record from the route-link collection, attaches it to the first site through `placed_structure_route_link_attach_site_owner` `0x00467eb0`, increments the grouped class counters at `[class_record+0x5a]` and `[class_record+0x5e]` through the candidate-class table at `0x0062ba8c+0x8e`, and finally re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current direct creation-side caller is `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0`, while grounded internal calls land at `0x00468067` and `0x0046809b`; this is therefore the strongest current owner for creation-side site-pair seeding in the route-link family. | objdump + caller xrefs + stack-layout inspection + class-counter correlation + route-link-collection correlation |
| 190 | 0x004680b0 | 96 | placed_structure_route_link_release_and_detach | map | thiscall | inferred | objdump + caller xrefs + class-counter correlation | 3 | Releases one live `0x006ada90` route-link record's class-side counters and then detaches it from its current owner chain. The helper resolves the candidate-class record from route-link byte `+0x10` through `0x0062ba8c+0x8e`, subtracts the fixed creation-side increment from `[class_record+0x5a]`, then chooses one of the two trailing accumulator slots `[class_record+0x62]` or `[class_record+0x66]` by testing state byte `+0x12 & 0x1`. After that class-side rollback it tails into `placed_structure_route_link_detach_current_owner_chain` `0x00467df0`. Current grounded caller is the route-link collection sweep around `0x004681ae`, which keeps this as the clearest release-side companion to `placed_structure_route_link_allocate_site_pair_for_candidate_class` rather than another attach helper. | objdump + caller xrefs + class-counter correlation + detach-tail correlation |
| 191 | 0x00468110 | 39 | placed_structure_route_link_collection_construct | map | thiscall | inferred | objdump + world-bringup correlation + collection-layout inspection | 3 | Constructs the world-side route-link collection later published at `0x006ada90`. The helper seeds the collection vtable at `0x005ce130`, then initializes one indexed collection through `0x00518570` with grounded parameters `(record_size=0x19, initial_slots=0x64, growth=0x64, id_base=1)`. Current grounded caller is the world bring-up path at `0x004488a3`, where the resulting manager is stored into `0x006ada90` beside the placed-structure and candidate collections. This is the strongest current owner name for the record family later scanned by the route-style overlay and availability helpers. | objdump + world-bringup correlation + collection-layout inspection + manager-publication correlation |
| 192 | 0x00468140 | 18 | placed_structure_route_link_collection_destroy | map | thiscall | inferred | objdump + world-shutdown correlation + collection-layout inspection | 3 | Destroys the world-side route-link collection rooted at `0x006ada90`. The helper restores the same collection vtable at `0x005ce130`, releases the indexed-collection payload through `0x00518600`, and then tails into the common collection teardown at `0x00518bd0`. Current grounded callers are the global world-shutdown path at `0x0044931d` and the route-link collection sweep at `0x004681ae`, which keep this as the clear destructor companion to `placed_structure_route_link_collection_construct`. | objdump + world-shutdown correlation + collection-layout inspection + manager-publication correlation |
| 193 | 0x004681f0 | 100 | placed_structure_route_link_collection_remove_links_touching_site_id | map | thiscall | inferred | objdump + caller xrefs + field-match inspection | 3 | Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose grounded site-reference triple matches one caller-supplied placed-structure id. The helper walks the live route-link collection and deletes any record whose `u16` fields at `+0x0a`, `+0x0c`, or `+0x0e` equal the requested id, reusing the collection erase vfunc for each match. Current grounded callers include the placed-structure teardown path at `0x0040e23b`, where the supplied id comes from `[site+0x2a4]`, so this now looks like the site-side cleanup companion for the route-link family rather than a generic collection filter. | objdump + caller xrefs + field-match inspection + site-cleanup correlation |
| 194 | 0x00468260 | 84 | placed_structure_route_link_collection_remove_links_by_route_node_id | map | thiscall | inferred | objdump + caller xrefs + field-match inspection | 3 | Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose route-node owner field at `+0x08` matches one caller-supplied id. The helper walks the live route-link collection, compares each record's `u16` field `+0x08` against the requested route-node id, and erases matching records through the same collection vfunc used by the broader cleanup paths. Current grounded caller is the neighboring runtime teardown at `0x004acf03`, which keeps this as the route-node-side cleanup companion to `placed_structure_route_link_collection_remove_links_touching_site_id` rather than another site sweep. | objdump + caller xrefs + field-match inspection + route-node-cleanup correlation |
| 195 | 0x004682c0 | 58 | placed_structure_route_link_collection_recompute_all_endpoint_pair_state | map | thiscall | inferred | objdump + caller inspection + collection-iteration inspection | 3 | Collection-wide recompute sweep over the live `0x006ada90` route-link family. The helper iterates every live route-link id through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` on each resolved record. This is the clean whole-collection state refresh companion to the per-record recompute helper rather than another allocator or cleanup path. | objdump + caller inspection + collection-iteration inspection + recompute-helper correlation |
| 196 | 0x00468300 | 235 | placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state | map | thiscall | inferred | objdump + caller inspection + world-grid correlation + collection-iteration inspection | 3 | Higher-level rebuild pass above the route-link family that resets the route-style world-grid counters and then recomputes live endpoint state across `0x006ada90`. The helper first reads three candidate-class ids from the structure-candidate side table at `0x0062ba8c+0x88/+0x8a/+0x8c`, walks the active world-grid tables rooted at `[0x0062c120+0x2129]`, and clears the aligned per-cell dword lanes at offset `+0x103` for those three classes. It then iterates every live route-link record in `0x006ada90`, clears state bit `0x2` in each record's flag byte at `+0x12`, and re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current grounded callers include the recurring simulation-maintenance branch at `0x0040a575`, the world bring-up side near `0x00444b2f`, and one later world-side update path at `0x00481157`, which makes this the clearest current owner of the full-family route-style counter-and-state rebuild rather than just another collection walk. | objdump + caller inspection + world-grid correlation + collection-iteration inspection + route-style-class correlation |
| 197 | 0x0041e2b0 | 589 | structure_candidate_rebuild_local_service_metrics | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `world_setup_building_collection_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate. | objdump + caller xrefs + callsite inspection + world-grid correlation |
| 198 | 0x0042db20 | 1040 | scenario_event_refresh_runtime_record_from_packed_state | scenario | thiscall | inferred | objdump + caller inspection + local disassembly + shell-event-window correlation | 2 | Heavy per-event runtime materializer beneath the live event collection at `0x0062be18`. The helper reads one packed event definition from the caller-supplied state or stream object, conditionally clears and repopulates several fixed text bands on the destination event record at offsets such as `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, then rebuilds two event-runtime row families from caller-supplied counts and packed row payloads. Current shell-side xrefs now tighten that split. The first family allocates `0x1e`-byte rows, fills scalar and byte fields from the packed source, conditionally extends the row on later-format branches, remaps bounded id ranges through the live structure-candidate collection `0x0062ba8c`, and links the resulting rows through one standalone event-side list anchor; the adjacent helper cluster `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is only consumed by `EventConditions.win`, so this first family now reads as the runtime condition-row list. The second family repeats the same materialization pattern with `0x28`-byte rows across four grouped slots on the destination event record, applying version-gated field extension and bounded remap logic against the locomotive collection `0x006ada84`, the live structure-candidate collection `0x0062ba8c`, and the global candidate pool `0x0062b268` before linking each rebuilt row into one of four grouped list anchors; the generic deep-copy helper `0x0042e050` now clones those same grouped lists during event duplication, so this second family still reads as the grouped event-effect row side rather than another condition list. Current grounded caller is the collection-wide wrapper `0x00433130`, so this is now the safest current read for one live event's runtime-record refresh from packed scenario-state data rather than a generic collection helper. | objdump + caller inspection + local disassembly + event-record materialization correlation + candidate-and-locomotive-remap correlation + shell-event-window correlation |
| 199 | 0x0042d700 | 59 | scenario_event_query_standalone_condition_row_list_class_and_modifier_flags | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + local disassembly | 2 | Aggregates the class and modifier bits implied by one live event's standalone `0x1e`-row condition list. The helper first short-circuits to literal `0x7f` when event byte `[event+0x82b]` is set, then otherwise walks the list rooted at `[event+0x00]`, OR-ing the static row-class byte from `0x005f3e04 + id*0x81` for ordinary nonnegative row ids and using the negative-id fallback branch only to preserve special marker value `0x7f`. Current grounded callers are the condition-window summary refreshes `0x004d9970` and the broader control refresh `0x004da0f0`, so this is the safest current read for the standalone condition-list class or modifier aggregate rather than a generic linked-list scan. | objdump + EventConditions.win refresh correlation + local disassembly + condition-row-class-table correlation |
| 200 | 0x0042d740 | 87 | scenario_event_query_grouped_effect_row_list_type_flags | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + local disassembly | 2 | Aggregates one grouped effect-row type bitfield for a live event. The caller supplies the grouped list ordinal on the stack, and the helper walks the selected grouped anchor at `[event + group*4 + 0x04]`, OR-ing one descriptor byte from `0x006103fd + opcode*0x6e` across the linked `0x28`-row family. One caller-controlled boolean also enables a narrower normalization path that remaps a small special opcode subset to shared bit `0x08` before the OR step. Current grounded callers are the conditions-window refresh family `0x004d9d10` and `0x004da0f0`, plus one world-side branch at `0x00431120`, so this is the safest current read for grouped effect-row type flags rather than a standalone condition helper. | objdump + EventConditions.win refresh correlation + local disassembly + grouped-effect-descriptor correlation |
| 201 | 0x0042df30 | 63 | scenario_event_condition_row_list_has_class_bit0_or_flag7f9_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Tiny predicate over the standalone `0x1e`-row event-condition list rebuilt by `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. The helper walks the linked list rooted at the caller-supplied event record, tests each nonnegative row id against class-bit `0x01` in the static per-condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7f9]`. Current grounded callers are the `EventConditions.win` refresh path at `0x004da19a` and `0x004da23c`, so this now reads as the class-bit-0 condition-summary gate rather than a generic list scan. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 202 | 0x0042df70 | 63 | scenario_event_condition_row_list_has_class_bit1_or_flag7fa_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x02` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7fa]`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da1de`, so this now reads as the class-bit-1 condition-summary gate rather than another anonymous list helper. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 203 | 0x0042dfb0 | 62 | scenario_event_condition_row_list_has_class_bit2_or_type63_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to the event-record dword check `[event+0x7f0] == 0x63`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da2be`, so this now reads as the class-bit-2 condition-summary gate rather than another generic scan. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-type correlation |
| 204 | 0x0042dff0 | 82 | scenario_event_condition_row_list_has_any_class_bit012_or_special_fallback | scenario | thiscall | inferred | objdump + EventConditions.win refresh correlation + static-bit-table inspection | 2 | Broad predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as the smaller `0x0042df30/0x0042df70/0x0042dfb0` family, tests each nonnegative row id against any of class bits `0x01|0x02|0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to any of the three special event-record checks `[event+0x7f9]`, `[event+0x7fa]`, or `[event+0x7f0] == 0x63`. Current grounded caller is the early `EventConditions.win` refresh gate at `0x004da17d`, so this now reads as the broad condition-summary eligibility probe rather than a generic linked-list walk. | objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation |
| 205 | 0x0042e050 | 603 | scenario_event_clone_runtime_record_deep_copy | scenario | cdecl | inferred | objdump + caller xrefs + local disassembly + shell-event-window correlation | 2 | Deep-copy helper for one already-materialized live event runtime record. The helper copies the six fixed text bands at destination offsets `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, mirrors the compact event metadata band at `+0x7ee..+0x80e`, then deep-copies the standalone `0x1e`-row linked list and the four grouped `0x28`-row linked lists from one live event-runtime record into the caller-supplied destination record. Current grounded caller is `shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal` `0x004db8b0`, where it clones the currently selected live event into a newly created event record before selector refresh. This is therefore the safest current owner for deep-copy of an already-materialized event runtime record rather than another packed-state loader or an effects-only staging helper. | objdump + caller xrefs + local disassembly + shell-event-window correlation + deep-copy correlation |
| 206 | 0x0042c1b0 | 886 | placed_structure_redistribute_local_service_pressure_from_neighbors | map | thiscall | inferred | objdump + caller xrefs + neighborhood sweep inspection | 3 | Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop. | objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation |
| 207 | 0x0041eac0 | 794 | structure_candidate_collection_refresh_cargo_economy_filter_flags | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + rdata strings | 3 | Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and the live copy of special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]`; when that slot is set the branch at `0x0041ed37` further tests the wartime cargo family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and `Diesel` before writing the resulting enabled-or-filtered state into `[entry+0x56]` and re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule plus the `Use Wartime Cargos` scenario rule into live structure-candidate filtering rather than a purely editor-side helper. | objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation |
| 208 | 0x00421b60 | 180 | world_region_collection_seed_default_regions | map | thiscall | inferred | objdump + strings + callsite inspection | 4 | Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup. | objdump + RT3.lng strings + caller xrefs + callsite inspection |
| 209 | 0x00421c20 | 187 | world_region_collection_run_building_population_pass | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup. | objdump + caller xrefs + callsite inspection |
| 210 | 0x0042b2d0 | 49 | world_grid_cell_has_packed_u16_token_in_6byte_roster | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Small world-grid cell probe over one packed six-byte roster rooted at `[cell+0xef]` with count `[cell+0xeb]`. The helper walks that roster linearly, compares the caller-supplied `u16` token against the first word of each six-byte record, and returns `1` on the first match or `0` when no record matches. Current grounded callers include the city-connection peer probes `0x00420030/0x00420280`, where it filters site-class tokens from the caller's six-byte class table, plus the center-cell wrapper `0x0041f6e0`. | objdump + local disassembly + caller correlation + packed-roster correlation |
| 211 | 0x0041f9b0 | 125 | world_region_count_structure_profiles_before_year_for_category | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Counts region-subcollection structure profiles whose backing candidate resolves through `0x00412b70`, passes the availability gate at `0x0041f998`, matches one caller-selected category byte, and has threshold year `[profile+0x26]` less than or equal to the caller-supplied year. Current grounded callers include the region stats path at `0x004cbd41`, where category `2` feeds the localized `Industry Weightings` report, and the deeper per-region worker at `0x004235c0`, where the same count bounds demand for the weighted category-2 profile family. | objdump + caller xrefs + callsite inspection + RT3.lng strings |
| 212 | 0x0041fa30 | 133 | world_region_find_named_structure_profile_weight | map | thiscall | inferred | objdump + strings + caller xrefs | 3 | Looks up one named structure profile in the current region subcollection `[region+0x37f]`. The helper linearly compares the caller-supplied text against each profile label and returns the float-like weight at `[profile+0x1e]` for the first exact match, otherwise `0.0`. The same region-subcollection string block is now partially grounded from nearby `.rdata` as labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, `Fertilizer Factory`, and `farm`. Current grounded callers sit in world-side UI or telemetry branches around `0x004cbb74`, `0x004cc054`, and `0x004ccc54`. | objdump + caller xrefs + rdata strings |
| 213 | 0x0041fac0 | 60 | world_region_read_structure_profile_label_and_weight_by_index | map | thiscall | inferred | objdump + caller xrefs + strings | 4 | Reads one 1-based structure-profile entry from the current region subcollection `[region+0x37f]`. It copies the profile label string into the caller buffer and writes the float-like weight at `[profile+0x1e]` into the caller-provided out-slot. This is the label/value helper used beneath the region structure-demand worker and the adjacent UI or telemetry callers. The grounded profile-name block around `0x005c9100` now includes labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, and `Fertilizer Factory`. | objdump + caller xrefs + rdata strings |
| 214 | 0x00422320 | 1320 | world_region_normalize_cached_structure_balance_scalars | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Collection-wide region normalization pass over the live region manager `0x0062bae0`. The helper first early-outs in sandbox/editor-side mode through `[0x006cec7c+0x82]` and the active-mode latch `[0x006cec78+0x4aef]`, then runs one per-region prepass through `0x00420d40`, and finally performs two cohort sweeps split by region live byte `[region+0x23e]`. Across those sweeps it accumulates the cached scalar bands `[region+0x2b2/+0x2b6/+0x2ba/+0x2be/+0x2c2/+0x2c6]`, derives bounded normalization ratios, and writes the resulting cached growth-balance band back to `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. The player-facing meaning is tighter now from the editor growth report at `0x004d1d60`: `[region+0x2e2]` is the cached weighted-profit-margin scalar and `[region+0x2ee]` is the cached annual-density-adjust scalar later formatted as a percent, while `[region+0x2e6]` and `[region+0x2ea]` are the intermediate normalized-delta and clamped companion slots beneath that final annual-density adjust. The helper also uses world_region_count_linked_placed_structures_by_category `0x004228b0` as the direct category-count companion during the writeback sweep, and it applies one final live-value adjustment into `[region+0x25e]` when the shell latch `[0x006cec78+0x46c38]` is clear. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a265` inside `simulation_service_periodic_boundary_work` `0x0040a590`, so this is now the safest current read for the region cached growth-balance normalization pass rather than a one-time setup helper. | objdump + local disassembly + caller inspection + recurring-maintenance correlation + editor-growth-report correlation |
| 215 | 0x004228b0 | 68 | world_region_count_linked_placed_structures_by_category | map | thiscall | inferred | objdump + local disassembly | 3 | Counts linked placed-structure records in the current region entry whose category byte matches one caller-supplied value. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and increments one simple match count without applying the heavier cap or availability filters used by `0x00422be0`. The current grounded local caller is the broader region-side worker around `0x00422320`, where this helper is used as the direct category-count companion to the later aggregate and placement passes rather than as a full demand-balancing gate. | objdump + local disassembly + local caller correlation |
| 216 | 0x00422850 | 91 | world_region_count_class0_regions_passing_city_connection_peer_probe_variant | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Counts live class-0 regions in the current region collection that pass one specific `city_connection_bonus_exists_matching_peer_site` variant through `0x00420030`. The helper skips non-class-0 records, calls `0x00420030` with fixed boolean flags `(1,1,1)` plus one caller-supplied trailing dword, and increments a simple count only when that probe returns nonzero. Current grounded callers are the script or query dispatch at `0x0042f856` and the region-stats formatter at `0x004d2088`, so the safest current read is the narrow class-0 count wrapper over that peer-probe variant rather than a broader city-growth metric. | objdump + local disassembly + caller correlation + city-connection-probe correlation |
| 217 | 0x00422900 | 352 | world_region_accumulate_structure_category_totals | map | thiscall | inferred | objdump + callsite inspection | 3 | Aggregates the current structure-category totals for one region entry. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and returns both counts and accumulated weight-like totals across four categories via the caller-provided out-pointers. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the outputs feed the later demand-balancing logic for the region-owned building-population pass. | objdump + callsite inspection |
| 218 | 0x00422a70 | 355 | world_region_validate_and_commit_candidate_placement | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Shared placement-validation and commit gate beneath the region candidate-placement family. The helper takes one region entry in `ECX`, one candidate or profile id on the stack, one candidate world-coordinate pair, one caller-controlled side flag, one direct-versus-staged commit flag, and one optional out-pointer for the created placed-structure id. It first clears the optional out-slot, conditionally snaps the candidate coordinate pair to integers under the preview gate `0x434050 -> 0x46d2b0`, then validates projected placement through `placed_structure_validate_projected_candidate_placement` `0x004197e0`. On the direct-commit lane it additionally resolves the candidate world cell through `0x0044a800` and requires that cell's region id to match `[region+0x23a]`. When placement is allowed and the shell-side latch `[0x006cec78+0x46c3c]` is clear, one branch emits the staged side path through `0x0046d260`; otherwise it commits directly through `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` and stores the resulting placed-structure id in the caller's out-slot. Current grounded callers are `world_region_try_place_candidate_structure` `0x00422ee0` and the world-side randomized batch helper `world_try_place_random_structure_batch_from_compact_record` `0x00430270`, so this is best read as the shared region-side candidate-placement validator and commit gate rather than as one region-worker-private helper. | objdump + local disassembly + caller correlation + placement-validator correlation |
| 219 | 0x00422be0 | 768 | world_region_count_placed_structures_for_category | map | thiscall | inferred | objdump + callsite inspection | 3 | Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen. | objdump + callsite inspection |
| 220 | 0x00422ee0 | 884 | world_region_try_place_candidate_structure | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family. | objdump + caller xrefs + callsite inspection |
| 221 | 0x004235c0 | 1887 | world_region_balance_structure_demand_and_place_candidates | map | thiscall | inferred | objdump + callsite inspection | 4 | Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, queries projected structure-count scalars through `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0`, and then computes target demand for three structure categories by comparing those projected totals against live placed counts plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop. | objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation + projected-demand correlation |
| 222 | 0x004234e0 | 211 | world_region_query_projected_structure_count_scalar_by_category | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Returns one projected structure-count scalar for the requested region and category family. On the live-region branch `[region+0x23e] != 0`, the helper indexes the category table at `0x005ee1b0` by `(live_region_class, category)`, scales it by scenario difficulty and the normalized region-density field `[region+0x25e]`, then multiplies by the cached building-count slot `[region+0x242]`. On the fallback branch it instead derives one region bucket from `[region+0x25e]`, combines the two static tables `0x005ee138` and `0x005ee1b0`, and applies the alternate scenario-difficulty scale before returning the final float. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator. | objdump + local disassembly + caller correlation + city-count-stats correlation |
| 223 | 0x00423d30 | 51 | world_region_refresh_cached_category_totals_and_weight_slots | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Refreshes one small cached region summary band rooted at `[this+0x27a]`. The helper forwards three out-pointers `+0x27a/+0x27e/+0x282` plus one return slot `+0x286` into world_region_accumulate_structure_category_totals `0x00422900`, forcing the remaining category outputs and optional aggregate pointers to zero. Current grounded caller is the post-load seeding-burst tail around `0x00437bdc`, which sweeps the live region collection `0x0062bae0` after simulation_run_chunked_fast_forward_burst `0x00437b20`. This is therefore the narrow cached-category-summary refresher beneath that region-side setup and maintenance family rather than a company debt-table helper. | objdump + local disassembly + caller inspection + post-load caller correlation |
| 224 | 0x00423d70 | 176 | company_repay_bond_slot_and_compact_debt_table | simulation | thiscall | inferred | objdump + caller inspection | 4 | Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper. | objdump + caller inspection + finance-field correlation |
| 225 | 0x00423ec0 | 33 | company_adjust_available_track_laying_capacity_with_floor_zero | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter. | objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation |
| 226 | 0x004240a0 | 28 | company_query_available_track_laying_capacity_or_unlimited | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 2 | Returns the current company's available track-laying capacity. When scenario byte `[0x006cec78+0x4aaf]` is enabled, the helper returns the live company counter at `[this+0x7680]`; otherwise it returns fixed fallback `29999`, which currently reads as an effectively-unlimited path. Current language-table correlation now ties that scenario byte to RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`, so this helper is best read as the live getter beneath that scenario rule rather than only as an internal company counter accessor. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, and `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`, where the returned value is used as the company-side track-laying-capacity gate for route synthesis and station-attachment placement. | objdump + caller xrefs + callsite inspection + track-laying-capacity correlation + RT3.lng correlation |
| 227 | 0x00424010 | 29 | company_has_territory_access_rights | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`. | objdump + caller inspection + territory-access table correlation |
| 228 | 0x00423e40 | 112 | company_compute_weighted_average_bond_interest_rate | simulation | thiscall | inferred | objdump + caller xrefs + debt-record inspection | 4 | Computes the company's current weighted average bond interest rate from the live debt table rooted at `[this+0x5f]`. The helper rejects inactive companies and companies with no live bond slots, then walks each 12-byte debt record, accumulates total principal from `[slot+0x00]`, accumulates principal-times-rate from `[slot+0x08]`, and returns the weighted quotient `sum(principal*rate) / sum(principal)`. Current grounded callers are the bond-quote wrapper at `0x00427540`, the CompanyDetail capital summary panel at `0x004c23a0`, and the city-connection bonus ladder at `0x00425320`, so this is the shared average coupon or interest-rate helper rather than a generic finance multiplier. | objdump + caller xrefs + debt-record inspection + finance-summary correlation + bond-quote correlation |
| 229 | 0x00423eb0 | 6 | company_query_cached_share_price_scalar | simulation | thiscall | inferred | objdump + caller xrefs + per-share panel correlation | 3 | Tiny cached-float accessor that returns the company field at `[this+0x0d7b]`. Current grounded shell callers are the CompanyDetail per-share panel at `0x004c2720` and later train-side consumer paths, where this cached scalar is used in the same lane as the `Share Price` readout. The write-side owner is now tighter too: `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` optionally snapshots its final float into the same field when the caller requests a cache refresh, so this remains the narrow cached share-price accessor rather than an arbitrary finance-field read. | objdump + caller xrefs + per-share panel correlation + cached-float-field correlation + stock-price-cache-write correlation |
| 230 | 0x00424030 | 22 | company_set_territory_access_rights_byte | simulation | thiscall | inferred | objdump + caller inspection | 4 | Stores one territory-access byte for the requested company and territory id. The helper writes the supplied byte value into the same per-territory access table rooted at `[this + territory*0x38d + 0x1d9f]`. Current grounded shell caller is the immediate commit path inside `shell_company_detail_buy_territory_access_rights_flow` at `0x004c5fc9`, where the purchase path writes value `1` after the access-rights dialog is accepted. | objdump + caller inspection + territory-access table correlation |
| 231 | 0x004241e0 | 23 | company_sum_control_transfer_offer_policy_fields_raw | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the raw sum of two company-side floating fields at `[this+0x124f]` and `[this+0x12a7]`. Current grounded callers are the merger-offer builder around `0x004eb5a9` and adjacent control-transfer offer-side stat readers, where the returned value is paired with surrounding formatter setup for mode `0x0b` but is not itself passed an issue argument. This now looks like a narrow raw control-transfer offer policy total rather than a generic finance calculation. | objdump + caller inspection + merger-offer dialog correlation |
| 232 | 0x00424200 | 37 | company_sum_control_transfer_offer_policy_fields_scaled_tenths | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the same `[this+0x124f] + [this+0x12a7]` company-side policy total as `company_sum_control_transfer_offer_policy_fields_raw`, but scaled by the `0.1` constant at `0x005c9b50`. Current grounded callers are the merger and chairmanship-takeover offer builders at `0x004eb588` and `0x0050c7cb`, where the scaled result is immediately paired with surrounding formatter setup for mode `0x0b`. The helper itself does not consume an issue id, so this now reads as the scaled control-transfer offer policy total rather than a broader vote-weight function. | objdump + caller inspection + takeover and merger dialog correlation |
| 233 | 0x004248d0 | 759 | company_compute_cached_recent_per_share_performance_subscore | simulation | thiscall | inferred | objdump + caller inspection | 3 | Builds one cached company-side per-share performance subscore from recent yearly stock-data history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it first walks up to five recent years above founding year `[this+0x157]`, weighting yearly `Earnings Per Share` from slot `0x1f` and yearly `Revenue Per Share` from slot `0x1e` through `0x0042a5d0`; the current partial year uses weight `(5 * [world+0x0f]) - 5`, while the prior four full years use `48`, `36`, `24`, and `12`. That yields two normalized history lanes: `EPS * 10` into the first lane and `Revenue Per Share` into the second. It then runs a second trend pass over `Dividend Per Share` slot `0x20`, rewarding adjacent year pairs where the newer dividend does not fall below the previous year's value; that pairwise ladder uses weights `9`, `8`, `7`, and `6` from newest to oldest surviving comparison. The third lane is a dividend-strength score derived from that rewarded ratio, the previous-year dividend, and the constants `0.5`, `0.6`, `30`, and `230`, then floored to `1.13 * min(max(EPS lane, 1.0), revenue lane, current Book Value Per Share slot 0x1d)`. The fourth lane is current `Book Value Per Share` from slot `0x1d`. Negative lanes are clamped to zero. Base lane weights come from `0x005ee208` as `40/10/20/30`, and for company age under five years they are ramped through the four-dword rows at `0x005ee218`: `0/0/0/100`, `25/25/35/100`, `50/50/65/100`, `75/75/85/100`, and `100/100/100/100`. The strongest lane then gets weight `*1.25` while the weakest gets `*0.8`, and the resulting weighted blend ratio is stored as bounded intermediate `[this+0x0d19]` after multiplying by `((difficulty_table[[world+0x2d]] + 1.0) / 2.0)` and flooring at `0.5`. The final cached score recomputes that same base blend, multiplies it by the raw difficulty scalar table at `0x005f33b8` (`0.8/0.9/1.0/1.1/1.2/0.9/0.95/1.0`), applies post-bankruptcy smoothing for companies within ten years of `[this+0x163]` as `score * ((0.025 * years_since_bankruptcy) + 0.5)`, floors the result at `1.0`, and finally caches the float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded caller is `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, where this helper now reads as the recent per-share performance feeder rather than a generic governance-support history walker. | objdump + caller inspection + cache-field correlation + stock-data-family correlation + per-share-panel correlation + weight-ladder correlation + dividend-trend correlation + age-ramp-table correlation + difficulty-table correlation |
| 234 | 0x00425a90 | 194 | company_declare_bankruptcy_and_halve_bond_debt | simulation | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path. | objdump + RT3.lng strings + caller inspection + finance-field correlation |
| 235 | 0x004261b0 | 74 | company_count_unassigned_shares_after_active_chairman_holdings | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the current company share pool at `[this+0x47]` minus the positive holdings found in each active chairman profile record under `0x006ceb9c`. The helper uses the company collection index from `[this+0x00]` to read per-profile holdings from `[profile + company_index*4 + 0x15d]`, sums only positive entries, and subtracts that total from the company share count. Current grounded callers are the takeover and merger vote resolvers, which stage the result into `0x006d1a04` and `0x006d1104` before the lower public-vote support formulas run. | objdump + caller inspection + takeover and merger vote correlation |
| 236 | 0x00426260 | 607 | company_compute_board_approved_dividend_rate_ceiling | simulation | thiscall | inferred | objdump + caller inspection | 4 | Computes one nonnegative per-share dividend ceiling for the selected company. The helper starts from the current support or governance lane `0x2329/0x0d`, normalizes that value by the current outstanding-share band at `[this+0x47]`, then scans a bounded recent-year window relative to the founding year `[this+0x157]` and current scenario year `[0x006cec78+0x0d]`, taking minima from the shareholder-facing slots `0x2b` and `0x2c`. In the early-company path it also folds in `[this+0x57]` and the previous-year slot `0x1c`, applies several scale constants, and clamps the result at zero before returning the final per-share ceiling. Current grounded shell caller is `shell_company_detail_handle_change_dividend_rate_dialog_message` at `0x004c5140`, where this is the direct board-approval limit behind localized id `991` when the player tries to raise the dividend too far. | objdump + caller inspection + dividend-ceiling correlation |
| 237 | 0x004273c0 | 132 | company_repurchase_public_shares_and_reduce_capital | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Repurchases one caller-supplied quantity of public shares and reduces company capital accordingly. The helper converts the share count into one cash-side total through the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` and fixed market-scale constants, posts the resulting negative amount into company stat slots `0x0c` and `0x0d` through `0x0042a080` and `0x0042a040`, and subtracts the same share count from the outstanding-share field `[this+0x47]`. Current grounded callers are the `CompanyDetail.win` stock-buyback flow at `0x004c46d0` and the annual finance-policy helper at `0x00401c50`, where it contributes the RT3.lng `2887` repurchase headline. | objdump + caller xrefs + callsite inspection + stock-buyback correlation + annual-finance correlation |
| 238 | 0x00427450 | 224 | company_issue_public_shares_and_raise_capital | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Issues one caller-supplied quantity of public shares and increases company capital. When the optional pricing flag is clear, the helper derives one implied share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, the current company credit-rating score at `0x00425320`, and fixed underwriting constants; when the flag is set it reuses the caller-supplied scalar instead. It then posts the resulting proceeds into company stat slot `0x0c`, records the issued-share quantity in stat slot `0x0d`, snapshots the prior current-issue packed calendar tuple from `[this+0x16b/+0x16f]` into `[this+0x173/+0x177]`, writes the active world tuple from `[0x006cec78+0x0d/+0x11]` back into `[this+0x16b/+0x16f]` when taking the derived-pricing lane, and increases the outstanding-share field `[this+0x47]` by the issued quantity. Current grounded callers are the `CompanyDetail.win` stock-issue flow at `0x004c3f30` and the annual finance-policy helper at `0x00401c50`, where it contributes the debt-refinance-plus-borrowing and straight new-borrow capital side. | objdump + caller xrefs + callsite inspection + stock-issue correlation + annual-finance correlation + calendar-tuple-stamp correlation |
| 239 | 0x00427540 | 76 | company_compute_bond_interest_rate_quote | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Computes one company-specific bond interest-rate quote from the requested term and current credit or rate state. When the company is active it combines the current company credit-rating score from `0x00425320`, the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, and one term-dependent adjustment from the caller-supplied year span, then returns the resulting float rate; otherwise it falls back to `1.0`. Current grounded caller is `company_issue_bond_and_record_terms` `0x004275c0`, where this helper supplies the quoted rate when the caller does not already provide one. | objdump + caller xrefs + callsite inspection + bond-rate correlation + credit-rating correlation + prime-rate correlation |
| 240 | 0x004275c0 | 255 | company_issue_bond_and_record_terms | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Issues one new bond and appends its term record to the live company debt table. The helper first rejects companies already at the `0x14` bond-slot cap, computes or accepts one quoted interest rate through `company_compute_bond_interest_rate_quote` `0x00427540`, posts the bond proceeds into company stat slot `0x0c`, posts the principal into stat slot `0x12`, posts the coupon rate into stat slot `0x0d`, and then writes one new three-dword bond record into the next 12-byte entry rooted at `[this+0x5f]`: principal, maturity year, and quoted rate. It increments the bond count at `[this+0x5b]` and returns success. Current grounded callers are the `CompanyDetail.win` bond-issue flow at `0x004c3890` and the annual finance-policy helper at `0x00401c50`, where it supplies both straight new borrowing and refinance-plus-borrow follow-ons. | objdump + caller xrefs + callsite inspection + bond-issue correlation + annual-finance correlation |
| 241 | 0x00426890 | 68 | company_find_collection_index_by_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`. | objdump + caller inspection + company collection correlation |
| 242 | 0x00426be0 | 53 | company_can_purchase_territory_access_rights | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt. | objdump + caller inspection + RT3.lng strings + territory-flag correlation |
| 243 | 0x00426d60 | 393 | company_deactivate_and_clear_chairman_share_links | simulation | thiscall | inferred | objdump + caller inspection + collection-state correlation | 4 | Runs the destructive selected-company clear path currently reached from `CompanyDetail.win`. The helper first rejects inactive companies through `[this+0x3f]`, then zeroes all active-chairman share holdings for this company across `0x006ceb9c`, clears the linked chairman backpointer `[company+0x3b]` and the profile-side owning-company field `[profile+0x1dd]`, clears the selected-company latch when the scenario currently points at this company, marks the company inactive by zeroing `[company+0x3f]`, and walks two live collections to drop or invalidate remaining references that still point back to this company. The tail then rebuilds one local name block from `[company+0x4]` and publishes the change through the scenario-state helper at `0x004360d0`. Current grounded shell caller is the `0x9493` section-0 control under `shell_company_detail_window_handle_message`, so current best meaning is a company deactivation or liquidation-style clear path rather than an ordinary governance vote helper. | objdump + caller inspection + collection-state correlation + CompanyDetail control correlation |
| 244 | 0x00426ef0 | 43 | company_get_linked_chairman_profile_record | simulation | thiscall | inferred | objdump + caller inspection | 4 | Resolves the linked chairman profile record for one company. The helper reads the linked chairman id from `[this+0x3b]`, validates it against the live profile collection at `0x006ceb9c`, and returns the resolved profile record through `0x00518140`; zero or invalid ids return null. Current grounded callers include the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the direct bridge from a selected company to the chairman profile used for ownership and governance text. | objdump + caller inspection + chairman-link correlation |
| 245 | 0x0042a0e0 | 77 | company_query_highest_coupon_bond_slot_index | simulation | thiscall | inferred | objdump + caller inspection + debt-record layout correlation | 3 | Returns the live bond-slot index with the highest coupon rate from the debt table rooted at `[this+0x5f]`. The helper walks the current bond count at `[this+0x5b]`, compares each slot's rate field at `[this+0x67 + slot*0xc]`, and returns the zero-based index of the strongest surviving slot or `-1` when no bond slots are live. Current grounded caller is the annual finance-policy helper at `0x00401c50`, where this picks the reference bond used by the build-`1.03+` stock-issue lane before it checks current cash against that slot's principal plus a small fixed buffer. | objdump + caller inspection + debt-record layout correlation + annual-finance correlation |
| 246 | 0x0042a040 | 55 | company_add_delta_into_stat_series_and_current_slot | simulation | thiscall | inferred | objdump + caller xrefs + field-write correlation | 3 | Adds one caller-supplied float delta into the company stat-family series lane selected by the requested slot id. The helper increments both the year-indexed series rooted at `[this+0x0d7f]` and the current aggregate lane rooted at `[this+0x1c47]`, but does not touch the broader cash-side shadow totals. Current grounded callers include bond repayment `0x00423d70`, bankruptcy `0x00425a90`, stock buyback `0x004273c0`, territory-access purchase `0x004c5fc9`, and several placement or world-service mutations, so this now reads as the shared company stat poster without the optional cash-side follow-on. | objdump + caller xrefs + field-write correlation + finance-mutator correlation |
| 247 | 0x0042a080 | 95 | company_add_delta_into_stat_series_current_slot_and_optional_cash_totals | simulation | thiscall | inferred | objdump + caller xrefs + field-write correlation | 3 | Adds one caller-supplied float delta into the selected company stat-family lane, exactly like `company_add_delta_into_stat_series_and_current_slot` `0x0042a040`, and optionally mirrors the same delta into the broader cash-side shadow totals when the third argument is nonzero. The shared stat writes still land in the year-indexed series rooted at `[this+0x0d7f]` and current aggregate lane `[this+0x1c47]`; the optional follow-on also increments the cash-pair totals at `[this+0x11f7]` and `[this+0x1caf]`. Current grounded callers include stock buyback `0x004273c0`, chairman-salary and dividend policy paths around `0x00427920`, linked world-service updates, and several company-side cash or capital mutators, so this is the stronger shared company stat poster when cash-side shadow totals must stay synchronized. | objdump + caller xrefs + field-write correlation + cash-pair correlation + finance-mutator correlation |
| 248 | 0x0042a2e0 | 645 | company_read_control_transfer_metric_slot | simulation | thiscall | inferred | objdump + caller inspection | 3 | Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader. | objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation |
| 249 | 0x0042a5d0 | 131 | company_read_year_or_control_transfer_metric_value | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula. | objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation |
| 250 | 0x0042c690 | 311 | placed_structure_rebuild_candidate_cargo_service_bitsets | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. The cargo-id sweep is tighter now too: the inner loop starts at cargo id `1` and runs upward through the current live cargo count, so this steady-state bitset owner never intentionally queries cargo id `0`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path. | objdump + caller xrefs + callsite inspection + cargo-summary correlation + cargo-id-loop correlation |
| 251 | 0x0042c8f0 | 112 | placed_structure_refresh_linked_candidate_flag4 | map | thiscall | inferred | objdump + caller xrefs + linked-instance inspection | 3 | Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild even though the exact player-facing meaning of `[candidate+0xba]` is still open. | objdump + caller xrefs + linked-instance inspection + candidate-flag correlation |
| 252 | 0x0042cab0 | 117 | placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link | map | thiscall | inferred | objdump + caller inspection + route-style remap inspection | 3 | Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests. | objdump + caller inspection + route-style remap inspection + peer-link emission correlation |
| 253 | 0x0042cb30 | 124 | placed_structure_clamp_candidate_service_age_table | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper. | objdump + caller xrefs + callsite inspection + route-age correlation |
| 254 | 0x0042cbb0 | 145 | placed_structure_route_supports_candidate_local_service_mode | map | thiscall | inferred | objdump + caller xrefs + route-record inspection | 3 | Boolean route-linked predicate for one candidate-local service branch. The helper walks the route or service record chain owned by the current site through `[this+0x0d4]` and collection `0x006cec20`, reads one candidate-indexed float lane at `[route+0x3e]`, and compares the route-side threshold at `[route+0x112]` against the current local word-table value for that candidate after scaling through `0x00437d20`. It returns `1` on the first matching route record and `0` otherwise. Current grounded caller is `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, where this predicate selects one of the route-backed scoring transforms. | objdump + caller xrefs + route-record inspection + candidate-table correlation |
| 255 | 0x0042cc50 | 402 | placed_structure_apply_route_linked_service_caps | map | thiscall | inferred | objdump + caller xrefs + route-record inspection | 3 | Route-linked cap pass over the aligned local service tables. The helper walks the route or service record chain rooted at `[this+0x0d4]` through `0x006cec20`, then for each live non-remapped candidate that passes `structure_candidate_is_enabled_for_current_year` it compares the route-side candidate float at `[route+0x42]` against the current site float table at `[this+0x107]` and the current primary word-table value at `[this+0x00]`. When the route-linked ratio stays inside the live clamp window it writes a lower capped value back into the primary word table. Current grounded caller is the composite local refresh `0x0042d580`, so this now looks like the first route-backed cap pass that shapes the rebuilt local service tables before the later neighborhood redistribution and recent-service clamp run. | objdump + caller xrefs + route-record inspection + local-table correlation |
| 256 | 0x0042cdf0 | 16 | placed_structure_refresh_candidate_service_state | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Tiny composite refresh for one placed-structure or site record. The helper first rebuilds the candidate cargo-service bitsets through `placed_structure_rebuild_candidate_cargo_service_bitsets` at `0x0042c690`, then tail-calls `placed_structure_refresh_linked_candidate_flag4` at `0x0042c8f0` to refresh the sibling state bit at `[this+0x0e6]`. Current grounded callers include the world-grid sweep at `0x00450003`, so this now looks like the common steady-state placed-structure service-state refresh immediately above the editor-driven cargo runtime tables. | objdump + caller xrefs + wrapper inspection |
| 257 | 0x0042ce00 | 1394 | placed_structure_rebuild_candidate_local_service_tables | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Large per-site rebuild over the live candidate collection at `0x0062ba8c`. The helper walks every candidate with live runtime state at `[collection+0x16e]` and no remap entry at `[collection+0x9a]`, decays positive floats in the aligned per-candidate table rooted at `[this+0x107]`, and commits those float updates back through `0x0041e1b0`. It then combines that float table with two aligned per-candidate word tables rooted at `[this+0x02]` and `[this+0x6c]`, the direct-supply cargo bitset at `[this+0x0df]`, the site-side latch at `[this+0x0d4]`, and the branch predicate `0x0042cbb0` to choose among several normalized scoring transforms before writing the quantized result back into the destination word table. Current grounded callers now put this directly under the local wrapper at `0x0042d580`, so this looks like the first real site-side candidate service-score rebuild above the editor-driven cargo runtime lane rather than another candidate-only helper. | objdump + caller xrefs + callsite inspection + table-layout correlation |
| 258 | 0x0042d580 | 26 | placed_structure_refresh_local_service_score_bundle | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Composite local-service refresh for one placed-structure or site record. The helper first runs `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, then immediately chains into the neighboring local post-passes at `0x0042cc50`, `0x0042c1b0`, and `0x0042cb30` before returning. Current grounded caller is the world-grid sweep at `0x00450110`, which uses this as the stronger per-site local-service refresh after the lighter cargo-service-state pass at `0x00450003`. | objdump + caller xrefs + wrapper inspection |
| 259 | 0x00428a10 | 22 | company_clear_selected_chairman_if_current_profile | simulation | thiscall | inferred | objdump + caller inspection | 4 | Clears the linked chairman for the current company when the supplied profile id matches `[this+0x3b]`. On a match the helper zeroes the incoming profile id and tail-calls `0x00427c70`; otherwise it returns without changing company state. Current grounded shell caller is `shell_company_detail_resign_chairmanship_flow`, which uses this as the commit step behind the localized resignation confirmation. | objdump + caller inspection + chairman-link correlation |
| 260 | 0x00425320 | 607 | company_compute_credit_rating_score | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 4 | Computes the bounded company credit-rating score reused by the debt-side shell and several adjacent company-policy gates. The helper returns a fixed floor when the company-active flag at `[this+0x3f]` is clear; otherwise it starts from a weighted four-year net-profits-minus-fuel ladder over slots `0x2b` and `0x09`, blends in the current debt total from stat-family `0x2329/0x12`, folds in the weighted average bond interest rate through `company_compute_weighted_average_bond_interest_rate` `0x00423e40`, conditionally adds the prime-rate baseline and raw issue-39 total through `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, then derives several debt- or liquidity-side ratios from derived stat slots `0x30` and `0x31` before applying company-age smoothing. The tail then adds the raw issue-38 total through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`, rounds the result, and uses that bounded score both for the CompanyDetail credit row and for bond-offer gating. Current grounded callers are the city-connection news owner `0x00406050`, the bond-interest quote wrapper `0x00427540`, the bond-side boolean gate `0x00427590`, the generic derived-metric reader at `0x0042a2e0` for the credit-rating-style slot, the CompanyDetail debt-credit-rate summary panel `0x004c23a0`, and the CompanyDetail bond-issue flow `0x004c3890`. The surrounding text anchors are explicit: shell localized id `952` is `Credit Rating:`, and localized id `974` says new bonds require a strong enough credit rating. This is therefore the safest current read for the debt-market or creditworthiness score, distinct from the issue-39 prime-rate lane and from the broader issue-37 equity-support lane. | objdump + caller xrefs + callsite inspection + RT3.lng strings + credit-rating correlation + bond-dialog correlation + prime-rate contrast + issue-38 correlation |
| 261 | 0x00424fd0 | 751 | company_compute_public_support_adjusted_share_price_scalar | simulation | thiscall | inferred | objdump + caller inspection | 3 | Computes one bounded investor-support and share-price scalar used by stock-capital policy, cached share-price readouts, and adjacent governance or control-transfer vote lanes. The helper starts from `company_compute_cached_recent_per_share_performance_subscore` at `0x004248d0`. If the older company-side support field `[this+0x57]` is still at least as strong as that fresh score and the company is within five years of founding year `[this+0x157]`, it interpolates the two through a capped startup-progress term derived from the current world calendar counter `[0x006cec78+0x15]`, the company stamp `[this+0x0d07]`, and the founding year, with the progress side capped at `50`; otherwise it keeps the fresh per-share score directly. The first caller argument is then normalized by current outstanding shares `[this+0x47]` and clamped into the narrow pressure band `[-0.2, 0.2]`. When the caller supplies nonzero control arguments, that pressure term can also refresh the mutable support field `[this+0x4f]` by blending the prior field with the staged delta. The later share-price body is tighter now too: it derives a share-count growth term from outstanding shares through the power helper `0x005a1b60` on `(shares / 20000)^0.33`, scales that by `1.4`, folds it back against current shares, and then runs a piecewise compression or clamp ladder over the resulting support scalar at thresholds `0.6`, `0.45`, `0.3`, `1.7`, `2.5`, `4.0`, and `6.0`. After that it multiplies by the scenario issue-opinion multiplier from `scenario_state_compute_issue_opinion_multiplier` `0x00436590` using issue id `0x37`, rounds through `0x005a10d0`, floors the rounded result at `0.0001`, and optionally snapshots it into the cached share-price field `[this+0x0d7b]` when the second control argument is nonzero. Current grounded callers include the cached share-price accessor `0x00423eb0`, the stock buyback and stock issue mutators `0x004273c0` and `0x00427450`, the bankruptcy recompute path `0x00425a90`, the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual creditor-pressure or shareholder-policy lane that surfaces localized ids `300..304`. The surrounding finance split is now tighter too: `company_compute_credit_rating_score` `0x00425320` feeds the explicit `Credit Rating` shell rows and bond-offer rejection flow, while `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds the explicit `Prime Rate` row and cash interest helpers. That leaves issue `0x37` as the broader equity-market or investor-confidence lane behind company or chairman performance. The strongest direct text anchors are still localized ids `300/301` `Shareholders revolt against poor management`, `1217` `Investors are somewhat pleased with the chairman's performance.`, and `3048/3049` `Investors are %1 your performance./the chairman's performance.`. A deeper follow-up now rules out three tempting label shortcuts: the nearby `0x460a90..0x460c53` and `0x473620..0x47366a` registration families are camera-view and related shell-command bindings, not finance issue owners; the editor-side `Stock Prices` label belongs to the separate float-tuning block `[state+0x0bde..0x0bf6]`, not the issue table behind `0x37`; and the extracted `CompanyDetail.win` shell resource from `rt3_2WIN.PK4` does not expose any separate plain-English investor or finance caption for this lane, which matches the owner-side read that section-0 is a dynamic text widget (`0x947f`) fed by `shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a fixed label row. | objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation + stock-buyback correlation + stock-issue correlation + share-price-cache correlation + per-share-performance correlation + pressure-band correlation + startup-interpolation correlation + power-helper correlation + credit-vs-prime-rate correlation + negative-label-owner correlation + shell-resource extraction negative-result |
| 262 | 0x00424580 | 82 | company_compute_prime_rate_from_issue39_scenario_baseline | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Small company-side rate helper that produces the current prime-rate-style baseline from scenario state plus issue `0x39`. It first reads one normalized scenario baseline through `0x00433740` on active scenario state `0x006cec78`, then adds the scaled raw issue-39 total from `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` using the current company id `[this+0x00]`, linked chairman id `[this+0x3b]`, and no territory argument. Current grounded callers now bound the player-facing meaning more tightly: the bond-interest quote wrapper at `0x00427540`, the negative and positive cash interest helpers at `0x00425880` and `0x004258c0`, and the CompanyDetail capital summary row labeled `954` `Prime Rate:` at `0x004c23a0`. This now reads as the shared prime-rate or market-rate helper rather than a generic company-support scalar. | objdump + caller xrefs + callsite inspection + issue-39 correlation + prime-rate correlation + bond-quote correlation |
| 263 | 0x004246b0 | 544 | company_compute_five_year_weighted_shareholder_return | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Computes the stock-data lane surfaced as `5 Year Weighted Return`. Inactive companies fall back to the fixed scalar at `0x005c8598`; otherwise the helper walks up to five recent years above founding year `[this+0x157]`, samples yearly `Share Price` from slot `0x1c`, measures year-over-year price appreciation against the prior sample, blends that with the paired historical shareholder-payout lane from slot `0x23`, and weights recent years more heavily through the same scenario-side year weighting byte at `[0x006cec78+0x0f]`. Current evidence now bounds that paired lane more tightly: slot `0x23` falls back to direct company field `[this+0x53]` on the current-company path and is only consumed here, so the strongest current read is the historical dividend-per-share or shareholder-payout component paired with yearly price appreciation. The tail normalizes the accumulated weighted return by the accumulated weights and returns one bounded annualized-style float. Current grounded caller is `company_read_control_transfer_metric_slot` at `0x0042a2e0` for slot `0x21`, which matches the stock-data label `942` `5 Year Weighted Return:` and tooltip `936`. | objdump + caller inspection + RT3.lng strings + stock-data-label correlation + weighted-return correlation + shareholder-payout-lane correlation |
| 264 | 0x00425880 | 64 | company_compute_negative_cash_balance_interest_rate | shell | thiscall | inferred | objdump + LoadScreen report correlation + localized string correlation | 4 | Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows. | objdump + LoadScreen report correlation + localized string correlation + helper call inspection + prime-rate correlation |
| 265 | 0x004258c0 | 396 | company_compute_positive_cash_balance_interest_rate | shell | thiscall | inferred | objdump + LoadScreen report correlation + localized string correlation | 4 | Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same prime-rate helper at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows. | objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation + prime-rate correlation |
| 266 | 0x00429c70 | 976 | company_read_derived_financial_report_metric_slot | simulation | thiscall | inferred | objdump + caller inspection + shell-label correlation | 3 | Reads one derived company metric from the higher report-style slot family rooted at `0x2b`. The jump-table body now has one safe finance-side core: slot `0x2c` sums raw slots `0x01..0x04` into the broader revenue aggregate, slot `0x2d` combines the neighboring expense-side derived lanes, and slot `0x2b` then combines `0x2c` and `0x2d` into the net-profits-style lane reused by shell labels `1212` `Profits`, `925` `Profits:`, and the annual finance policy. The same helper also owns several later derived ratios and aggregates, including one asset-side pair around `0x30/0x31` and the per-unit revenue lanes that divide the revenue aggregate `0x2c` by count or distance slots such as `0x24`, `0x16`, and `0x17`. Current grounded callers arrive indirectly through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, so this is the shared derived financial-report metric reader beneath CompanyDetail, LoadScreen, and annual finance rather than a shell-only formatter helper. | objdump + caller inspection + shell-label correlation + derived-metric correlation + income-statement correlation |
| 267 | 0x00429990 | 86 | company_collection_get_nth_active_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows. | objdump + caller inspection + active-company roster correlation |
| 268 | 0x004299f0 | 84 | company_collection_count_active_companies_before_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`. | objdump + caller inspection + active-company roster correlation |
| 269 | 0x00429a50 | 62 | company_collection_count_active_companies | simulation | thiscall | inferred | objdump + caller inspection | 4 | Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math. | objdump + caller inspection + active-company roster correlation |
| 270 | 0x00430270 | 225 | world_try_place_random_structure_batch_from_compact_record | map | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Shared world-side retry loop that tries to place multiple structures from one compact spawn record. The caller supplies one small record whose fields now read most safely as a structure or profile token at `+0x00`, requested placement count at `+0x11`, center coordinates at `+0x12/+0x14`, and placement radius or extent at `+0x16`. The helper translates the token through the static table at `0x0061039c` into the live structure-profile collection `0x0062b268`, increments the region-manager reentrancy counter at `[0x0062bae0+0x88]`, and then runs up to `200` randomized attempts while placements remain. Each attempt samples a candidate coordinate inside the requested radius, rejects points outside the live world bounds at `[0x0062c120+0x2155/+0x2159]`, resolves the owning region through `0x0044a800` and `0x0062bae0`, adapts the candidate through `0x00412880`, and finally re-enters `world_region_validate_and_commit_candidate_placement` `0x00422a70`. Successful placements decrement the remaining batch count and reset the local retry counter. Current grounded caller is the world-side dispatch branch at `0x00431b43`, where only compact record classes in the `0x1f7..0x265` table range enter this batch placer. This is therefore the strongest current read for the world-side randomized structure-batch placement loop rather than a region-worker-private helper. | objdump + local disassembly + caller correlation + placement-batch correlation |
| 271 | 0x00430b50 | 624 | scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Builds one runtime-effect record in the live scenario event collection from a compact source record plus the caller's currently resolved targets. The helper first allocates a new runtime-effect entry through `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`, then seeds several per-record control bytes and target selectors in the new object, including mode byte `[record+0x7ef]`, optional gating bytes `[record+0x7f4/+0x7f9/+0x7fa]`, a primary selector at `[record+0x7f0]`, and optional comparison ids at `[record+0x82c/+0x830]`. Current grounded callers are the compact runtime-effect dispatcher `0x00431b20`, where fallback branches synthesize follow-on runtime effects from one compact linked record, and the shell-side branch at `0x004d60fd`, where the same builder is reached with a caller-owned output slot. This is therefore the current safest read for the runtime-effect follow-on record builder rather than a generic collection insert wrapper. | objdump + local disassembly + caller correlation + runtime-effect-builder correlation |
| 272 | 0x00431b20 | 399 | world_apply_compact_runtime_effect_record_to_resolved_targets | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Dispatches one linked compact runtime-effect record against the caller-resolved target context. The record token at `[*record+0x00]` is translated through the static table at `0x0061039c`; when the translated class lies in the `0x1f7..0x265` range the helper immediately re-enters `world_try_place_random_structure_batch_from_compact_record` `0x00430270`. Otherwise it jumps through the local class table at `0x004320b4/0x004320fc` into a mixed effect family that now includes: shell-state modifier branches over `0x006cec78`, signed scalar adjustments on resolved company/profile/territory targets through the `0x004d6611/0x004d6617` numeric readers, territory-access writes through `company_set_territory_access_rights_byte` `0x00424030`, selected-profile updates through `0x00434890/0x004348c0`, and several collection-side erase or follow-on branches. Current grounded caller is the outer loop at `0x00432317`, which walks linked compact records via `[record+0x24]` and supplies optional resolved company, chairman-profile, and adjacent owner context before each dispatch. This is therefore the current safest read for the wider compact runtime-effect dispatcher above the separate world-side structure-batch placement branch rather than as a placement-only helper. | objdump + local disassembly + caller correlation + effect-dispatch correlation |
| 273 | 0x004323a0 | 842 | scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Per-record service pass over one live runtime-effect record in the scenario event collection. The helper first enforces several activation gates over the record's local control bytes and shell-side preview state, including one one-shot latch at `[this+0x81f]`, mode byte `[this+0x7ef]`, optional preview-policy byte `[this+0x7f4]`, and shell-side state at `0x006cec78/0x006cec74`. Once active it formats the optional status line through shell news helper `0x004554e0`, derives a target-availability bitmask through `0x0042d700`, resolves optional company/chairman/territory target pools, and then walks the linked compact effect chain rooted at `[this+0x00]`. Each linked record is dispatched through `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, while fallback branches synthesize follow-on runtime-effect records through `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50`. When any effect fires it may refresh company share-price caches through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, and records with nonzero `[this+0x7f5]` set the one-shot latch `[this+0x81f]`. Current grounded caller is the collection-wide service loop `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40`. This is therefore the current safest read for the runtime-effect record service and linked-effect dispatcher rather than a low-level target iterator. | objdump + local disassembly + caller correlation + runtime-effect-service correlation |
| 274 | 0x00433130 | 169 | scenario_event_collection_refresh_runtime_records_from_packed_state | scenario | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper stages one small packed header read from the caller-supplied state or stream object, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk. | objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation |
| 275 | 0x004336d0 | 95 | world_runtime_reset_startup_dispatch_state_bands | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Small runtime-object zero-init helper immediately above `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`. The helper clears a bounded startup-owned state band on the caller object, including `[+0x4cae]`, `[+0x4cb2]`, `[+0x46a80..+0x46aa0]`, `[+0x66b2]`, `[+0x66b6]`, `[+0x46c34]`, and `[+0x66ae]`, then returns the same pointer. Current grounded callers are the mode-`4` `LoadScreen.win` lane inside `shell_transition_mode` at `0x004830b6` and the multiplayer preview launch lane at `0x0046b8c9`, both of which then publish the returned object into `0x006cec78` and immediately call `0x00438890`. This is therefore the safest current read for the pre-dispatch runtime reset helper rather than another world-release path. | objdump + caller xrefs + local disassembly + pre-dispatch-state correlation |
| 276 | 0x00432ea0 | 103 | scenario_event_collection_allocate_runtime_effect_record_from_compact_payload | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Allocates and initializes one live runtime-effect record in the scenario event collection at `0x0062be18` from a compact payload source. The helper allocates one temporary `0x88f` payload object, inserts a new collection entry through the generic collection allocator path, resolves the inserted live entry, and then initializes that entry from the caller-supplied compact payload through `0x0042d670` before freeing the temporary object. Current grounded callers are `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50` and the shell-side branch at `0x004db9f1`, where the returned live entry id is stored back into the caller object. This is therefore the current safest read for the scenario event collection's runtime-effect allocator rather than a generic collection clone helper. | objdump + local disassembly + caller correlation + runtime-effect-allocation correlation |
| 277 | 0x00432f40 | 267 | scenario_event_collection_service_runtime_effect_records_for_trigger_kind | scenario | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Collection-wide service loop over the live scenario event collection at `0x0062be18` for one caller-selected trigger kind byte. The helper first rejects fast-forward and editor-map gates through `0x006cec78+0x46c38`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x68]` unless the trigger kind is `9`, then walks every live runtime-effect record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Each resolved record is serviced through `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` `0x004323a0` with the selected trigger kind and optional text sink. When any record fires, the helper refreshes every active company's cached share price through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`; when the collection dirty latch at `[this+0x88]` is raised it clears that latch and immediately reruns the whole pass with trigger kind `0x0a`. The caller split is now tighter too: recurring simulation maintenance drives kinds `1`, `0`, `3`, and `2` through `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3`, while the neighboring route-style follow-on at `0x0040a91f` drives kinds `5` and `4` through `0x0040a930` and `0x0040a9ac`; world or startup-side company creation branches at `0x00407682`, `0x0047d293`, `0x0047d42b`, and `0x0047d6de` drive kind `7`; the kind-`6` branch is now tighter too, covering the placed-structure post-create tail at `0x0040f69e`, the build-version-gated company-startup or roster-refresh tail at `0x00428406`, and the route-entry post-change sweep at `0x004a3eae`; the kind-`8` world-entry one-shot gate now sits inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where it fires after the post-load company or route setup passes and then clears shell-profile latch `[0x006cec7c+0x97]`; and the `LoadScreen.win` briefing page at `0x004e520b` drives kind `9`. This is therefore the current safest read for the scenario event collection's collection-wide runtime-effect service loop rather than a generic text-query helper. | objdump + local disassembly + caller correlation + collection-service correlation + trigger-kind callsite decode |
| 278 | 0x00433bd0 | 546 | world_refresh_selected_year_bucket_scalar_band | simulation | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads the packed world year at `[this+0x0d]`, bins it against the threshold table at `0x005f3978/0x005f3980`, derives one interpolated bucket fraction when the current year falls inside a nontrivial range, and writes the resulting float band into `[this+0x65]`, `[this+0x69]`, `[this+0x6d]`, and `[this+0x4ca2]` after one build-version-sensitive clamp through `0x00482e00`. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on. | objdump + local disassembly + caller inspection + year-bucket-table correlation + world-entry correlation |
| 279 | 0x00434050 | 11 | shell_has_auxiliary_preview_owner | shell | cdecl | inferred | objdump + caller inspection + side-owner correlation | 4 | Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live. | objdump + caller inspection + side-owner correlation + caller xrefs |
| 280 | 0x00434080 | 80 | scenario_state_query_cached_available_locomotive_rating_clamped_for_shell | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small read-side helper over cached scenario-state float `[this+0x4cbe]`. The helper returns that cached available-locomotive rating in `st(0)` when it stays under the local threshold, and otherwise falls back to one fixed shell-side float constant before returning. Current grounded caller is the shell-side formatter band around `0x004b11c5`, where this cached value is optionally rounded to an integer and then compared against display thresholds `40/50/70/85/100`. This is therefore the safest current read for the query-side companion of the later locomotive-rating refresh rather than a broader world-state getter. | objdump + caller inspection + local disassembly + shell-threshold correlation + display-bucket correlation |
| 281 | 0x00434300 | 881 | world_runtime_release_global_services | map | cdecl | inferred | objdump + analysis-context | 3 | Releases or clears a broad set of world-runtime global services owned by the current map object before a new world entry or sibling save branch continues. The helper walks the owner collection at [this+0x66b2] and then touches many global manager slots including 0x0062b244 0x0062cfcbc 0x0062be10 0x0062c120 0x0062ba8c 0x0062ba88 0x0062b2fc 0x0062b268 0x006cea4c and 0x006acd34 through repeated release-style calls and nulling writes. Current grounded callers are the heavier world-entry branch at 0x00443a50 the sibling .smp world-state branch at 0x00446d40 and shell_transition_mode at 0x00482ec0. | objdump + analysis-context + caller xrefs |
| 282 | 0x00434d40 | 100 | placed_structure_collection_seed_candidate_subtype2_runtime_latch | map | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Shared post-setup sweep over the live placed-structure collection at `0x0062b26c`. The helper walks every live placed structure through the indexed-collection accessors, resolves each linked candidate or structure descriptor through vtable slot `+0x80`, and when the resolved record's subtype byte `[candidate+0x32]` equals `2` it writes `1` to runtime dword `[candidate+0x7b0]`. Local field evidence is now tight enough to keep the name structural: the same dword is zeroed during candidate runtime materialization around `0x00412112`, read as a one-shot guard in the world-side placement branch around `0x00423c43`, and also written there after the guarded follow-on fires. Current grounded callers are the post-fast-forward setup tail at `0x00437bf9` and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared subtype-`2` candidate-runtime latch seeder rather than a one-off world-entry patch. | objdump + local disassembly + caller correlation + candidate-runtime-latch correlation |
| 283 | 0x004354a0 | 355 | world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Shared shell-facing scalar publisher beneath selected-year changes, shell-state selector updates, and the late world-entry reactivation band. The helper always resolves the current shell presentation object through controller `0x006d4024 -> [controller+0x18]` and writes one clamped `0..255` integer into `[object+0x15]` through `0x00523d60`. Its source split is now bounded enough to name conservatively: when tutorial flag `0x006d3b4c` is live it forces `0`; otherwise it first honors the temporary shell-state selector pair `[0x006cec74+0x1df/+0x1e3]`, then the persisted selector pair `[0x006cec74+0x23b/+0x23f]` when sandbox bit `[0x006cec7c+0x82]` is set, and only when no selector override is active does it derive one interpolated scalar from the current year `[this+0x15]` against the ensured threshold band `[this+0x51/+0x55/+0x59/+0x5d/+0x61]` plus the base value at `[this+0x3a]`, re-entering `scenario_state_ensure_derived_year_threshold_band` `0x00435603` before the year-band path needs it. Current grounded callers are the simulation year-advance path at `0x0040ab39`, the shell-state setter at `0x00482878`, the startup-side branch at `0x005173d3`, and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared shell-controller progress-scalar publisher rather than a world-entry-only helper. | objdump + local disassembly + caller correlation + shell-controller correlation + year-threshold-band correlation |
| 284 | 0x00434ea0 | 124 | scenario_state_query_named_candidate_availability_record_value | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Read-side lookup over the scenario-side named candidate-availability collection at `[this+0x66b2]`. The helper normalizes the first byte of the caller-supplied candidate name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x1e]`; otherwise it returns zero. The insert sibling `0x00434f20` shows the exact record shape now too: each collection entry is a zero-initialized `0x22`-byte blob with a fixed zero-terminated name slot at `[entry+0x00..+0x1d]` and one trailing availability dword at `[entry+0x1e]`. Current grounded callers are the runtime refresh pass `0x00412c10`, the editor-side detail and summary formatters at `0x004cc209`, `0x004cdfa3`, `0x004d14b8`, and `0x004d1684`, and the same startup-side candidate filter family that later writes `[candidate+0x7ac]`. This is therefore the current safest read for the candidate-side lookup sibling of the named availability helpers rather than a generic string-table query. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation |
| 285 | 0x00434f20 | 272 | scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437743` and `0x00436ad7` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation |
| 286 | 0x00435030 | 124 | scenario_state_query_named_locomotive_availability_record_value | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Read-side lookup over the scenario-side named locomotive-availability collection at `[this+0x66b6]`. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x3d]`; otherwise it returns zero. The insert sibling `0x004350b0` shows the exact record shape now too: each collection entry is a zero-initialized `0x41`-byte blob with a fixed zero-terminated locomotive-name slot at `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`. Current grounded callers are the shell-side `Locomotives` availability page constructor `map_editor_locomotive_availability_panel_construct` `0x004cd680`, the locomotive-side stats and summary branches at `0x004d0e5f` and `0x00461ed5`, and the neighboring startup or restore-side upsert family at `0x00438d6b` and `0x004478ea`. This is therefore the safest current read for the locomotive-side lookup sibling of the named availability helpers rather than a generic string-table query. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-availability correlation + record-layout correlation |
| 287 | 0x004350b0 | 249 | scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage | map | thiscall | inferred | objdump + caller xrefs + local disassembly | 3 | Upserts one named locomotive-availability record into the scenario-side collection at `[this+0x66b6]` and then refreshes dependent runtime locomotive usage state. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches existing names through `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the locomotive-availability dword at `[entry+0x3d]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x41`-byte record, copies the supplied zero-terminated locomotive name into `[entry+0x00..+0x3c]`, and seeds that same trailing dword. When the live locomotive pool `0x006ada84` exists it then re-enters `0x00461e00`, where the queried value is later stored into `[loco+0x7b]`. The write-side caller set is now tight enough to close the remaining semantic gap here too: the grounded startup or restore-side seeding lanes at `0x00438d6b`, `0x004478ea`, and `0x00461eab` and the shell-side `Locomotives` availability handler family at `0x004cf178`, `0x004cf1fe`, `0x004cf2f9`, and `0x004cf3fc` all supply only boolean values, so `[entry+0x3d]` now reads safely as a real locomotive-availability override bit rather than a broader policy enum. | objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-runtime-refresh correlation + record-layout correlation + callsite-argument correlation |
| 288 | 0x00436af0 | 384 | scenario_state_refresh_cached_available_locomotive_rating | map | thiscall | inferred | objdump + local disassembly + caller inspection | 3 | Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, filters them through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. It then normalizes and clamps that winning value into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper. | objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation |
| 289 | 0x0043cb00 | 295 | world_view_step_heading_quadrant | shell | thiscall | inferred | objdump + caller xrefs | 3 | Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag. | objdump + caller xrefs + callsite inspection |
| 290 | 0x0043cc30 | 437 | world_view_step_zoom_bucket | shell | thiscall | inferred | objdump + caller xrefs | 3 | Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4. | objdump + caller xrefs + callsite inspection |
| 291 | 0x0043d050 | 111 | world_view_set_focus_position_xyz | shell | thiscall | inferred | objdump + caller xrefs | 4 | Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d. | objdump + caller xrefs |
| 292 | 0x0043af60 | 205 | world_view_should_drive_primary_pan_channel | shell | thiscall | inferred | objdump | 3 | Returns whether the world-view owner should drive its primary pan channel on this pass. The predicate first honors the latched override at [this+0xa2] then checks several shell-view gates through 0x00543e00 0x00543e20 and 0x00543e40 on the active controller node plus one optional guard under 0x006d1a8c and the world-mode flag at [0x006cec74+0x120]. When the controller view is active it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as one enabling condition; `shell_input_apply_window_key_transition` grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36 which ties held Shift state back into the same world-view pan family. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and the smaller motion helper at 0x0043e610. | objdump + callsite inspection |
| 293 | 0x0043b030 | 173 | world_view_should_drive_secondary_pan_channel | shell | thiscall | inferred | objdump | 3 | Returns whether the world-view owner should drive its secondary pan channel on this pass. Like the neighboring primary predicate it combines shell controller view gates through 0x00543e00 0x00543e20 and 0x00543e40 optional suppression under 0x006d1a8c and one world-mode check at [0x006cec74+0x120]; when the active controller view is present it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as an enabling condition. Those bits are now grounded as the left and right Shift modifiers from scan codes 0x2a and 0x36 rather than an opaque gameplay-only flag source. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and in the smaller motion helpers at 0x0043e610 and 0x0043f4f0. | objdump + callsite inspection |
| 294 | 0x0043b2c0 | 133 | world_view_store_camera_view_slot_snapshot | shell | thiscall | inferred | objdump + caller inspection + world-view correlation | 4 | Stores one live camera-view snapshot into a fixed slot family rooted inside the world-view owner at `0x0062be68`. The helper expands the caller slot selector into one `0x30`-byte record, sets slot-valid dword `[slot+0x10e]`, copies the current scenario-side focus-kind pair from `[0x006cec78+0x45/+0x49]` into `[slot+0x112/+0x116]`, and then mirrors the live world-view focus and camera fields `[view+0x04/+0x08/+0x0c/+0x18/+0x10/+0x14/+0x1c/+0x20/+0x24]` into `[slot+0x11a..+0x13a]`. Current grounded caller is the shell-side assignment owner `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`, which uses this helper for the ten-slot `Assign Camera View` family. This is therefore the safest current read for the fixed camera-view snapshot writer rather than a generic view-state copier. | objdump + caller inspection + world-view correlation + slot-layout correlation |
| 295 | 0x0043ca20 | 223 | world_view_restore_camera_view_slot_snapshot_if_populated | shell | thiscall | inferred | objdump + caller inspection + world-view correlation | 4 | Restores one previously saved camera-view snapshot from the fixed slot family inside the live world-view owner at `0x0062be68`. The helper expands the caller slot selector into the same `0x30`-byte record used by `world_view_store_camera_view_slot_snapshot` `0x0043b2c0`, rejects immediately when slot-valid dword `[slot+0x10e]` is zero, re-enters `0x004349f0` to clear or normalize scenario-side focus state, restores the saved focus and camera fields back into `[view+0x04/+0x08/+0x0c/+0x18/+0x10/+0x14/+0x1c/+0x20/+0x24]`, clamps the restored heading through `0x005a1390`, optionally replays the saved focus-kind pair `[slot+0x112/+0x116]` through `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`, and finally rebuilds the dependent view state through `0x0043db00` and `0x0043bde0` before returning `1`. Empty slots return `0` without side effects. Current grounded caller is the shell-side selection owner `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`, which uses this helper for the ten-slot `Select Camera View` family. This is therefore the safest current read for the fixed camera-view snapshot restore helper rather than a generic world-view reset. | objdump + caller inspection + world-view correlation + slot-layout correlation + focus-replay correlation |
| 296 | 0x0043d0c0 | 111 | world_view_apply_screen_delta_to_focus_position | shell | thiscall | inferred | objdump + caller xrefs | 4 | Converts one screen-relative drag delta into a new world-view focus position and forwards it through world_view_set_focus_position_xyz. When the auxiliary object at [this+0x6e] is live it samples a derived center or height term through 0x00534490 and scales both incoming deltas by the world-view projection constant at 0x005c8700 before calling the lower focus-position setter. The current grounded caller is the cursor-drag helper at 0x00478d31 inside the larger input loop at 0x00478cb0. | objdump + caller xrefs |
| 297 | 0x0043d130 | 292 | world_view_pan_relative_offset_in_camera_plane | shell | thiscall | inferred | objdump + caller xrefs | 4 | Applies one local X/Z pan offset to the world-view owner at 0x0062be68 in the current camera plane and forwards the result through world_view_set_focus_position_xyz. The helper derives a scale from the active view-height field [this+0x18] rotates the incoming offset by the current heading-like field [this+0x10] through sine and cosine calls at 0x005a13e4 and 0x005a1494 adds the rotated result onto the current world focus position in [this+0x04] and [this+0x0c] preserves the current Y term in [this+0x08] and then calls the lower focus-position setter. Current grounded callers are the GameUppermost hotspot path at 0x004e094b and the keyboard-owned service branch inside world_view_service_keyboard_turn_and_pan_bindings at 0x0043dae4 which together indicate a shared world-view pan action rather than a separate gameplay command dispatcher. | objdump + caller xrefs |
| 298 | 0x0043d740 | 937 | world_view_service_keyboard_turn_pan_and_zoom_bindings | shell | thiscall | inferred | objdump + callsite inspection | 4 | Keyboard-driven world-view interaction helper beneath world_view_service_shell_input_pan_and_hover. It samples elapsed wall-clock time through 0x0051d890 against the previous timestamp at 0x0062be74 clamps the per-pass delta into the 0x08 through 0xc8 range and polls four configurable binding-pair families through the shell input table at 0x006d4018 via 0x0054e7d0. The first two pair families at [this+0x0a6] through [this+0x0b2] and [this+0x0b6] through [this+0x0c2] now ground as the default `Camera Forward` or `Camera Backward` pair and `Camera Left` or `Camera Right` pair. The third family at [this+0x0c6] through [this+0x0d2] produces a signed zoom-step or view-height delta that is returned through the caller-owned out-parameter for later smoothing and grounds as the default `Camera Zoom In` or `Camera Zoom Out` pair, while the fourth family at [this+0x0d6] through [this+0x0e2] applies continuous heading turns through 0x0043c810 and grounds as the default `Camera Rotate Left` or `Camera Rotate Right` pair. When the pan families are active the helper reaches world_view_pan_relative_offset_in_camera_plane at 0x0043d130 after checking the active world-view state. Current grounded caller is world_view_service_shell_input_pan_and_hover at 0x0043db00. | objdump + callsite inspection + caller xrefs + registration xrefs + RT3.lng |
| 299 | 0x0045ea90 | 365 | shell_input_binding_format_display_label_from_registry_entry | shell | cdecl | inferred | objdump + local disassembly + registry correlation | 4 | Formats one user-facing binding label directly from a live registry entry. The helper clears the destination buffer, rejects entries whose primary binding code `[entry+0x0c]` is `0xff`, prepends up to three localized prefix fragments from ids `0xdef`, `0xdf0`, and `0xdf1` according to bits `0x4`, `0x2`, and `0x1` in mode field `[entry+0x94]`, then scans the static binding-descriptor table rooted at `0x005f0a34` for the current action id `[entry+0x0c]`. When the descriptor-side localized caption id at `[row+0x04]` exists and `0x0051c900` accepts it, the helper appends that localized caption through `0x005193f0`; otherwise it appends the fallback literal stem at `[row+0x08]`. Current grounded caller is `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0`, which uses this helper beneath the camera-view modal family and the hotkey report path. This is therefore the safest current read for the lower binding-label formatter rather than a generic string helper. | objdump + local disassembly + registry correlation + descriptor-table correlation + localized-prefix correlation |
| 300 | 0x0045ec00 | 108 | shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments | shell | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Splits one compound binding label into a primary token plus one optional modifier fragment. The helper copies the caller source string into the primary destination unchanged when the string either begins with `+`, does not contain the localized token from id `0xdf2`, or contains no later `+` delimiter. Otherwise it trims the source at the first `+`, copies the suffix after that delimiter into the primary destination, and copies the preserved prefix fragment into the secondary destination buffer. Current grounded caller is the hotkey import worker `0x0045f420`, where it prepares one imported binding label for action lookup and modifier parsing before the rebucket helper `0x0045ef00`. This is therefore the safest current read for the localized plus-split helper rather than a generic string tokenizer. | objdump + caller inspection + local disassembly + hotkey-import correlation |
| 301 | 0x0045ec70 | 88 | shell_input_binding_descriptor_query_action_id_by_localized_label | shell | cdecl | inferred | objdump + local disassembly + descriptor-table correlation | 4 | Resolves one action id from the binding-descriptor table rooted at `0x005f0a34` by matching a user-facing label. The helper rejects empty input with `0xff`, then walks the descriptor rows and compares the caller text against either the localized caption at `[row+0x04]` when `0x0051c900` accepts that id or the fallback literal stem at `[row+0x08]` otherwise. On success it returns the descriptor action id at `[row+0x00]`; failure returns `-1`. Current grounded caller is the hotkey import worker `0x0045f420`, which uses this helper after `shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments` `0x0045ec00` to recover the target action id for one imported binding row. | objdump + local disassembly + descriptor-table correlation + localized-caption correlation + hotkey-import correlation |
| 302 | 0x0045e940 | 216 | placed_structure_build_attached_emitter_variant_list_by_owner_stem | map | cdecl | inferred | objdump + local disassembly + literal inspection + caller inspection | 2 | Builds a repeated attached-emitter list for one owner stem on top of the global emitter table. The helper rejects literal `Stadium` immediately, clears caller flag bit `0x10` when the owner stem matches `ParticleCar`, then iterates `effect_emitter_table_select_next_existing_formatted_3dp_variant` `0x00474860` first with reset mode `1` and then resume mode `0`. For each accepted formatted variant it creates one attached sprite emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, optionally ORs flag `0x10000` when startup latch `[0x006cec78+0x46c3c]` is live, ORs emitter flag `0x02` for literal `Nuclear`, appends the created emitter into the caller output array when that array is present, and terminates the list with a trailing null when at least one output slot was available. Current grounded callers are the heavier placed-structure transient builders around `0x0045b828` and `0x0045e23e`, so this is best read as the owner-stem-driven attached-emitter variant-list builder rather than a one-off specialization stub. | objdump + local disassembly + literal inspection + caller inspection + formatted-variant correlation + transient-family correlation |
| 303 | 0x0045ea20 | 61 | shell_emit_indexed_audio_feedback_nudge_if_live | shell | cdecl | inferred | objdump + caller correlation + local disassembly | 4 | Small indexed audio-feedback helper used by shell command paths and tutorial guidance. When selector `ECX` is in the bounded range `2..0x40` and the two audio override gates at `0x00ccba14` and the service-side `0x00531e10` checks remain clear, the helper looks up one pair of table-driven dwords from `0x005f0828/0x005f082c`, forwards them together with the caller scalar and three zero trailing arguments into the shell audio service at `0x006d402c` through `0x00531e10`, and otherwise returns without side effects. Current grounded callers include the pause-toggle shell command `0x00440880` with selector `0x2c` and the tutorial-step advance path `0x00516be0`, which makes this the reusable indexed feedback-nudge owner rather than a one-off pause-only stub. | objdump + caller correlation + local disassembly + audio-service correlation |
| 304 | 0x0045ecd0 | 155 | shell_input_binding_parse_modifier_fragment_to_compact_mode_code | shell | cdecl | inferred | objdump + local disassembly + caller inspection | 3 | Parses one binding-label modifier fragment into a small compact mode code. The helper normalizes the caller text through `0x005a2abe`, probes it for one localized header token from `0xdf3` and the follow-on localized fragments `0xdf4` and `0xdf5`, and then returns one of four compact codes: default `1` when the header token is absent, `4` when only the middle fragment is absent, `2` when the trailing fragment is absent, and `0` for the fully matched final branch. Current grounded caller is the hotkey import worker `0x0045f420`, which uses this compact code immediately before `shell_input_binding_expand_compact_mode_code_to_registry_mask` `0x0045ed70` and the rebucket helper `0x0045ef00`. This is therefore the safest current read for the localized modifier-fragment parser rather than a stronger semantic mode-name decoder. | objdump + local disassembly + caller inspection + hotkey-import correlation |
| 305 | 0x0045ed70 | 26 | shell_input_binding_expand_compact_mode_code_to_registry_mask | shell | cdecl | inferred | objdump + local disassembly + caller inspection | 3 | Tiny compact-mode projector for the input-binding family. The helper expands the caller compact code in `ECX` into the registry-facing mode mask over bits `0x1`, `0x2`, and `0x4` using the low two bits plus one high nibble bit, then returns that mask in `EAX`. Current grounded caller is the hotkey import path at `0x00500205`, where it immediately feeds the result into `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00`. | objdump + local disassembly + caller inspection + hotkey-import correlation |
| 306 | 0x0045ed90 | 69 | shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular | shell | cdecl | inferred | objdump + local disassembly + descriptor-table correlation | 4 | Descriptor-side bucket-key query for the shell input-binding registry. The helper scans the static descriptor table rooted at `0x005f0a34` for the caller action id in `ECX`, counts the number of set bits in the caller mode mask in `EDX`, and only when that bit count is `0` or `1` returns the descriptor-side bucket key at `[row-0x04]` / `[row+0x30]`; multi-bit masks return `0`. Current grounded callers are `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, the hotkey message path at `0x005001e1`, and the rebucket helper `0x0045ef00`, which all use this helper as the singular-mode bucket discriminator above the live registry buckets. This is therefore the safest current read for the descriptor-side bucket-key query rather than a generic action-table scan. | objdump + local disassembly + descriptor-table correlation + mode-mask correlation + bucket-key correlation |
| 307 | 0x0045f370 | 95 | shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id | shell | cdecl | inferred | objdump + caller inspection + registry correlation | 4 | Lookup helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper scans each linked per-bucket list for a record whose action id at `[entry+0xa0]` matches the caller key in `ECX`; on success it writes the entry's primary binding code `[entry+0x0c]` through the first out-parameter and packs three mode bits from `[entry+0x94]` into a small output mask through the second out-parameter before returning `1`. Failure returns `0`. Current grounded caller is `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`, where this helper resolves the default `Camera Forward/Backward/Left/Right/Zoom/Rotate` action ids before the resulting codes are normalized into the world-view slot-pair band. This is therefore the safest current read for the action-binding query helper rather than a generic shell hash-table scan. | objdump + caller inspection + registry correlation + output-mask correlation |
| 308 | 0x0045ede0 | 88 | shell_input_binding_registry_resolve_entry_by_action_stem | shell | cdecl | inferred | objdump + local disassembly + registry correlation | 4 | Resolves one shell input-binding registry entry by stem text. The helper copies the caller string into a local `0x80`-byte buffer, normalizes it through `0x0053d810`, hashes or canonicalizes that normalized stem, and then scans the linked registry buckets rooted at `0x006acd78..0x006ad960` for an entry whose cached normalized token at `[entry+0x90]` matches the derived value. On success it returns the live registry entry pointer; otherwise it returns null. Current grounded callers are `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0` and `shell_input_binding_registry_query_primary_code_by_action_stem` `0x0045f400`, which use this helper as the shared action-stem lookup beneath the camera-view modal family. This is therefore the safest current read for the stem-to-binding-entry resolver rather than a generic string hash helper. | objdump + local disassembly + registry correlation + normalized-stem correlation |
| 309 | 0x0045ef00 | 568 | shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask | shell | cdecl | inferred | objdump + local disassembly + caller inspection + registry correlation | 4 | Rehomes one existing binding entry into a different action bucket and mode-mask family while preserving its current binding data. The helper first resolves the target descriptor bucket through `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular` `0x0045ed90` unless the requested action id is `0xff`, then resolves the source live entry by stem through `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`, allocates one fresh record from the pool owner at `0x006acd6c`, copies the source entry payload into that fresh record, overwrites the new action id `[entry+0x0c]` and mode mask `[entry+0x94]`, unlinks the old record from its current per-bucket list, optionally moves the old record into the detached `0xff` side list rooted at `0x006ad96c..0x006ad974`, and finally links the new record into the requested target bucket at `0x006acd78..0x006ad960`. Failure at either the descriptor-bucket or source-entry step returns `0`; success returns `1`. Current grounded caller is the hotkey message path at `0x0050020f`, where this helper commits one imported or reassigned binding row after the local label split and modifier decode. This is therefore the safest current read for the binding-entry rebucket helper rather than a generic pool copier. | objdump + local disassembly + caller inspection + registry correlation + pool-allocation correlation + detached-list correlation |
| 310 | 0x0045f250 | 278 | shell_input_binding_report_iterate_next_entry_in_sorted_priority_order | shell | cdecl | inferred | objdump + caller inspection + local disassembly + registry correlation | 4 | Iterates the next live binding entry in one temporary sorted report order. On first use when sentinel `0x005f0fe0 == 1`, the helper allocates a small queue owner at `0x006acd74`, initializes it through `0x0053d740`, walks every live registry bucket at `0x006acd78..0x006ad960`, and pushes each entry into that queue with priority `0x7ffffffe - [entry+0x9c]`. Each call then pops one entry through `0x0053d540`; when one record is available it formats the user-facing label into scratch `0x006ad980` through `shell_input_binding_format_display_label_from_registry_entry` `0x0045ea90`, copies the action stem from `[entry+0x10]` into `0x006ada00`, mirrors the binding code and companion field into `0x006ad978` and `0x006ad97c`, and returns `0x006ad978`. When the queue is exhausted it destroys the temporary owner, resets `0x006acd74` to null, restores sentinel `0x005f0fe0` to `1`, and returns `0`. Current grounded callers are the hotkey-report writer `0x0045f550` and the hotkeys-window refresh path at `0x004fed16/0x004fedb2`, which makes this the current sorted binding-report iterator rather than a generic priority-queue wrapper. | objdump + caller inspection + local disassembly + registry correlation + temporary-queue correlation + report-scratch correlation |
| 311 | 0x0045f3d0 | 33 | shell_input_binding_registry_format_display_label_by_action_stem | shell | cdecl | inferred | objdump + caller inspection + registry correlation | 3 | Small display-label helper above `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`. The helper resolves the caller action stem into one registry entry, then forwards the destination buffer plus that entry into `0x0045ea90` to format the user-facing label string. Success returns `1`; unresolved stems return `0`. Current grounded callers are the camera-view command owners `0x004408f0` and `0x004409c0`, where it formats the optional current focus labels embedded in the assignment and unassigned-view modals. | objdump + caller inspection + registry correlation + modal-text correlation |
| 312 | 0x0045f400 | 18 | shell_input_binding_registry_query_primary_code_by_action_stem | shell | cdecl | inferred | objdump + local disassembly + registry correlation | 3 | Tiny primary-code accessor above `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`. The helper resolves the caller action stem into one registry entry and, on success, returns that entry's primary binding code from `[entry+0x0c]`; unresolved stems return `0`. Current local evidence only grounds the raw field access, not a stronger player-facing meaning beyond the shared binding-registry lane. | objdump + local disassembly + registry correlation + field-access correlation |
| 313 | 0x0045f420 | 296 | shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels | shell | thiscall | inferred | objdump + local disassembly + caller correlation + import-file correlation | 4 | Imports one saved hotkeys file and rehomes matching live binding entries into the requested action or mode buckets. The helper first loads one parsed text resource through the small loader pair `0x00557320 -> 0x00557630`, retrying with the secondary `(0x28,0x29)` selector pair when the primary `(0x21,0x7e)` load fails. On the success path it walks the resulting nested record lists at `[root] -> [group+0x108] -> [entry+0x104]`, splits each imported `foo+bar` label through `shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments` `0x0045ec00`, normalizes both fragments through `0x00557280/0x005572e0`, resolves the target action id from the descriptor table through `shell_input_binding_descriptor_query_action_id_by_localized_label` `0x0045ec70`, decodes the modifier fragment through `shell_input_binding_parse_modifier_fragment_to_compact_mode_code` `0x0045ecd0`, and finally commits the rebucket through `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00` using the preserved stem at `[entry+0x04]`. A fully successful import returns `1`; early parse or load failures return the loader status unchanged. Current grounded caller is the registry constructor `0x00461120`, which tail-jumps here with the fixed path `hotkeys\\hotkeys.txt` when the caller requests saved-hotkey import. This is therefore the safest current read for the hotkeys-file import worker rather than a generic text-resource walker. | objdump + local disassembly + caller correlation + import-file correlation + nested-record-walk correlation + rebucket correlation |
| 314 | 0x0045f550 | 382 | shell_input_write_hotkeys_report_file | shell | cdecl | inferred | objdump + caller inspection + local disassembly + literal correlation | 4 | Writes the current hotkey report to the fixed output path `hotkeys\\hotkeys.txt`. The helper opens that file through mode string `wt`, writes the fixed report header `!Hotkeys~\\n`, appends the localized heading strip from ids `0xdf6` through `0xdfc`, then iterates the current binding set through `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250`. For each returned record it copies the action stem at `[entry+0x08]` into a local `0x20`-byte padded column, falls back to the localized empty-label string `0x0b3e` when the stem is empty, and formats each output line through the fixed template `%s = %s\\n`; rows whose leading dword is zero instead use the alternate template `%s = %s\\n` with the shifted value pointer at `[entry+0x08]`. Current grounded callers are the shell command path at `0x00461082` and the hotkeys-window message path at `0x00500153/0x0050021d`, which makes this the current shared hotkey-report writer rather than a generic file dump helper. | objdump + caller inspection + local disassembly + literal correlation + report-iterator correlation + hotkeys-path correlation |
| 315 | 0x0045f6d0 | 334 | shell_input_register_action_binding_with_mode_specific_defaults | shell | cdecl | inferred | objdump + caller inspection + registry correlation | 4 | Shared registration helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper first selects one mode-specific `(binding_code, companion_value)` pair from the caller's four fallback pairs according to shell mode dword `0x006d3c84`; when the selected binding code is not `0xff`, it re-enters `0x0045ed90` to resolve or create the target registry bucket, optionally updates an existing entry for the same companion discriminator `[entry+0x94]` through `0x0045f8a0`, or allocates and links a fresh entry from the pool owner at `0x006acd6c` and the monotonic id source `0x006acd68`. The new or updated record stores the action id, mode flags, callback pointer, localized label string, and the selected default pair before it is linked back into the per-action bucket family. Current grounded callers include the camera-view command registration block at `0x00460903..0x00460cac` and the world-view keyboard registration block at `0x00460720..0x004608e7`, which makes this the current shared action-binding registration helper rather than a camera-specific leaf. | objdump + caller inspection + registry correlation + allocation-pool correlation + mode-specific-default correlation |
| 316 | 0x0045f8a0 | 315 | shell_input_binding_registry_replace_existing_entry_by_action_bucket_and_mode_mask | shell | cdecl | inferred | objdump + local disassembly + caller inspection + registry correlation | 4 | Updates one existing binding entry for a specific action bucket plus mode-mask discriminator. The helper first scans the requested live bucket at `0x006acd78..0x006ad960` for an entry whose stored mode mask `[entry+0x94]` matches the caller value in `EDX`; when found it copies the full record to a local stack frame, unlinks and releases the live record from both its bucket and the pool owner at `0x006acd6c`, then re-enters `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` with the preserved callback pointer, localized label pointer, default-pair payload, and the copied companion values while forcing the binding-code selector to `0xff`. Current grounded caller is the registration helper `0x0045f6d0`, which uses this path when a same-bucket same-mode entry already exists for the target action. This is therefore the safest current read for the existing-entry replacement helper rather than a generic free-and-realloc wrapper. | objdump + local disassembly + caller inspection + registry correlation + preserved-payload correlation |
| 317 | 0x0045f9e0 | 598 | shell_input_seed_default_binding_registry_entries_from_static_table | shell | cdecl | inferred | objdump + local disassembly + static-table inspection | 4 | Seeds the shell input-binding registry from the static default table rooted at `0x005ecadc`. The helper walks `0x71` eight-byte rows, localizes each row label id at `+0x04`, decodes the packed row policy word at `+0x06` into the mode-specific default tuple expected by `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, and installs each resulting binding into the live registry. After the fixed table pass it appends a smaller manual post-table strip for adjacent shell commands such as the wrappers at `0x00441a00`, `0x00441940`, `0x00441980`, `0x00482b00`, `0x004408b0`, `0x00441ac0`, `0x004408d0`, and `0x00441af0`, using localized ids `0x0d4a` through the neighboring `0x0d53` band. Current grounded caller is the registry initializer `0x00461120`, which runs this helper after rebuilding the pool and queue roots. This is therefore the safest current read for the default binding seeder rather than a generic command-registration batch. | objdump + local disassembly + static-table inspection + post-table registration-strip correlation |
| 318 | 0x00461000 | 52 | shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d | shell | cdecl | inferred | objdump + local disassembly + installer correlation | 2 | Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level. | objdump + local disassembly + installer correlation + registration-strip correlation |
| 319 | 0x00461040 | 40 | shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a | shell | cdecl | inferred | objdump + local disassembly + installer correlation | 2 | Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level. | objdump + local disassembly + installer correlation + registration-strip correlation |
| 320 | 0x00461070 | 170 | shell_input_binding_registry_destroy_all_roots_and_reset_globals | shell | cdecl | inferred | objdump + local disassembly + global-field correlation | 4 | Destroys the live shell input-binding registry and clears all of its global roots. The helper first re-enters `shell_input_write_hotkeys_report_file` `0x0045f550` when the main pool owner at `0x006acd6c` is present, then releases the main pool owner `0x006acd6c`, the companion owner at `0x006acd70`, zeroes every bucket head/tail/count triple across `0x006acd78..0x006ad974`, and finally releases the temporary report queue owner at `0x006acd74` if it is still live. Current grounded caller is the setup helper `0x00461120`, which uses this as the hard reset before rebuilding the registry state. This is therefore the safest current read for the binding-registry teardown and global reset owner rather than a one-off file export command. | objdump + local disassembly + global-field correlation + teardown correlation + hotkey-report correlation |
| 321 | 0x00461120 | 171 | shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file | shell | thiscall | inferred | objdump + local disassembly + caller correlation | 4 | Constructs the live shell input-binding registry, seeds the default action set, and optionally imports the saved hotkeys file. The helper first hard-resets the old registry through `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070`, zeros the monotonic id source `0x006acd68`, allocates and clears the primary pool owner at `0x006acd6c`, allocates the two companion owners at `0x006acd70` and `0x006acd74`, seeds the default bindings through `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0`, and when the caller flag in `ECX` equals `1` immediately tail-jumps into the hotkey import worker `0x0045f420` using the fixed path literal `hotkeys\\hotkeys.txt`. This is therefore the safest current read for the binding-registry constructor and optional hotkey-import owner rather than a generic allocator batch. | objdump + local disassembly + caller correlation + pool-allocation correlation + default-seed correlation + hotkey-import correlation |
| 322 | 0x00439e40 | 557 | world_view_seed_keyboard_binding_slot_pairs | shell | thiscall | inferred | objdump + callsite inspection | 4 | Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store. | objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng |
| 323 | 0x0043db00 | 1968 | world_view_service_shell_input_pan_and_hover | shell | thiscall | inferred | objdump + callsite inspection | 4 | Recurring world-view service that fuses shell input state into the live world-view owner at 0x0062be68. It begins by delegating keyboard-bound turn pan and zoom work to world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 then samples controller and view state through 0x00543c50 and 0x00543ba0 caches successive shell input coordinates from 0x006d4018 offsets 0xa94 and 0xa98 derives smoothed cursor or hover deltas against [this+0x2f6] [this+0x2fa] and [this+0x2fe] updates one world-under-cursor cache through 0x00448ac0 and 0x00448bd0 and refreshes the GameUppermost overlay through 0x004e0730 when the pan state changes. The helper repeatedly consults world_view_should_drive_primary_pan_channel at 0x0043af60 and world_view_should_drive_secondary_pan_channel at 0x0043b030 drives one of the lower motion branches at 0x0043e610 0x0043f4f0 or 0x0043e2c0 and smooths the keyboard zoom-step channel through the shared accumulator at 0x0062be78 before issuing discrete view-height bucket steps through world_view_step_zoom_bucket at 0x0043cc30. Current grounded callers include the recurring world-frame path at 0x00439730 and two setup or transition loops at 0x00516859 and 0x00516921. This now looks like the shared shell-input coordinator above keyboard turn pan zoom cursor drag and hotspot world-view motion rather than a mouse-only helper. | objdump + callsite inspection + caller xrefs |
| 324 | 0x00420030 | 578 | city_connection_bonus_exists_matching_peer_site | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan. | objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding |
| 325 | 0x00420280 | 204 | city_connection_bonus_select_first_matching_peer_site | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan. | objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation |
| 326 | 0x004207d0 | 1053 | city_site_format_connection_bonus_status_label | map | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. When the preview-global `0x0062be84` is armed or the city-side subtype field `[this+0x23e]` is nonzero the function falls back into the neighboring virtual-style formatter at `0x00455860`; otherwise it builds one visible text block from the base city label at `[this+0x356]`, optionally appends the numeric value in `[this+0x276]`, and can append localized id `207` `(Connected)` when the active linked world object and city class checks succeed. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` at `0x00420030` with three meaningful filter combinations: a deeper peer-reachability pass, an active-company-only pass using `scenario_state_get_selected_chairman_company_record` at `0x004337a0`, and a broader any-company pass. After those boolean note checks it also re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` to recover one representative matching peer site, resolves that peer's linked company through `placed_structure_query_linked_company_id` at `0x0047efe0`, and uses the selected company record when formatting the follow-on company-oriented text lane. That current grounded split is enough to tie `3869` `Connected By Another Station`, `3870` `Already Connected`, `3871` `Connected By Another Company`, `3872` `Already Connected by Another Company`, and `3873` `Not Connected` to this formatter boundary rather than to the station-detail overlay body. The helper also writes one caller-owned color field and label-priority scalar before returning style code `3`, so it currently reads as a world-label or hover-summary formatter for city connection-bonus state rather than a generic text helper. | objdump + caller inspection + RT3.lng strings + city-bonus note correlation + filter-combination decoding + peer-selector correlation |
| 327 | 0x0043f640 | 3797 | world_render_station_candidate_service_map_overlay | render | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner. | objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check |
| 328 | 0x00439140 | 1086 | simulation_frame_accumulate_and_step_world | simulation | cdecl | inferred | objdump + analysis-context | 4 | Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup. | objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation |
| 329 | 0x00433a40 | 82 | shell_can_open_company_list_or_detail_panel_or_warn | shell | thiscall | inferred | objdump + caller inspection + shell-detail correlation | 4 | Shared availability gate above the shell-side company-list and selected-company-detail lanes. The helper reads scenario toggle `[0x006cec78+0x4aef]`; when that dword is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`, otherwise it returns `1`. Current grounded callers are the direct shell command branches `0x004405b3` and `0x0044062c`, plus the broader shell-strip and page-side handlers `0x004de2e3` and `0x004de3ae`, all of which open company-list or selected-company-detail panels only on success. This is therefore the safest current read for the company list/detail availability gate rather than a generic scenario-action blocker. | objdump + caller inspection + shell-detail correlation + modal-path correlation |
| 330 | 0x00433aa0 | 95 | shell_can_open_stockbuy_window_or_warn | shell | thiscall | inferred | objdump + caller inspection + stockbuy correlation | 4 | Shared availability gate above the shell-side `StockBuy.win` family. The helper first rejects scenario states where toggle `[0x006cec78+0x4aa7]` is nonzero, surfacing the same shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0`. When the scenario toggle allows the action, it still requires a nonzero selected-company id at `[scenario+0x21]`; if no company is currently selected it raises the sibling shell modal rooted at localized id `335` and returns `0`. Only the success path returns `1` to the callers at `0x00440673` and `0x004de50f`, both of which immediately open detail-panel mode `0x0c` that later refreshes through the `StockBuy.win` family. This is therefore the safest current read for the stock-buy availability gate rather than a generic company-selection check. | objdump + caller inspection + stockbuy correlation + modal-path correlation |
| 331 | 0x00433b00 | 117 | shell_can_open_trainbuy_window_or_warn | shell | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Shared availability gate above the shell-side `Trainbuy.win` family. The helper first rejects scenario states where the train-buy action is globally disabled through `[0x006cec78+0x4aa3]`, surfacing localized id `334` `That action is not allowed in this scenario.` through the shared shell modal path when blocked. It then checks whether the active company or world object state supplied by the caller allows train purchase; if no company is active it raises id `337` `You can't buy a train without starting a company first!`, and if no track has been placed it raises id `338` `You can't buy a locomotive until some track has been placed!`. Only the success path returns nonzero to the callers at `0x004406d3` and `0x004de7d9`, both of which immediately enter `shell_open_or_focus_trainbuy_window` at `0x00512c50`. | objdump + caller inspection + RT3.lng strings + train-buy gate correlation |
| 332 | 0x00434db0 | 91 | shell_can_open_detail_panel_mode_0x0b_or_warn | shell | thiscall | inferred | objdump + caller inspection + shell-detail correlation | 3 | Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the safest current read for the mode-`0x0b` availability gate rather than a tighter family name we have not yet recovered. | objdump + caller inspection + shell-detail correlation + modal-path correlation |
| 333 | 0x00434e20 | 128 | shell_can_open_detail_panel_mode_0x06_or_warn | shell | thiscall | inferred | objdump + caller inspection + shell-detail correlation | 3 | Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the safest current read for the mode-`0x06` availability gate rather than a tighter family name we have not yet grounded. | objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation |
| 334 | 0x00433b80 | 69 | scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero | map | thiscall | inferred | objdump + local disassembly + caller correlation | 2 | Runs a small dispatcher of optional collection-side refresh hooks, but only when global mutation depth `0x0062be40` has fallen back to zero. On the active path it conditionally refreshes four live collection families through shell-state-controlled gates: the placed-structure collection at `0x006cec20` through `0x00481430`, the sibling placed-structure helper family at `0x0062b26c` through `0x00413860`, the train-side collection at `0x006cfcbc` through `0x004b2a90`, and the route-entry collection at `0x006cfca8` through `0x004931e0`. Current grounded callers include the periodic maintenance branch at `0x0040a914`, the placed-structure finalize path at `0x0040f6b4` after it decrements `0x0062be40`, and several shell or editor mutation branches around `0x0049d3a8` and `0x00508f97/0x0050900a`. This is therefore the safest current read for the zero-depth optional collection-refresh dispatcher rather than a single collection owner. | objdump + local disassembly + caller correlation + zero-depth-dispatch correlation + collection-refresh correlation |
| 335 | 0x0050f740 | 6 | shell_has_live_trainbuy_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Tiny presence probe for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper returns the live-flag dword at `0x006d3ae4`, which is set during `shell_open_or_focus_trainbuy_window` at `0x00512c50` and cleared after that family tears the singleton down. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, building-detail, load-screen, settings, custom-modal, and file-options probes. | objdump + caller inspection + strings correlation + singleton correlation |
| 336 | 0x0050f750 | 11 | shell_mark_trainbuy_window_dirty | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Tiny dirty-latch setter paired with `shell_has_live_trainbuy_window`. The helper stores `1` into `0x006d3adc`, which current nearby call patterns treat as the `Trainbuy.win` refresh or service request latch once the live singleton family rooted at `0x006d3ac8` exists. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is consumed on the message-`0` service path inside the family handler at `0x00512202` through the `0x00512c09` branch. | objdump + caller inspection + nearby-family correlation + singleton correlation + service-path inspection |
| 337 | 0x0050f760 | 45 | shell_trainbuy_window_query_selected_locomotive_id | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`. | objdump + caller inspection + strings correlation + selected-row correlation |
| 338 | 0x0050f790 | 241 | shell_trainbuy_window_compute_selected_upgrade_total_and_count | shell | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Computes the current selected-train upgrade summary beneath the shell-side `Trainbuy.win` family. The helper counts all flagged train entries in the `0x2000`-byte selection array rooted at `0x006d1aa8`, resolves the currently selected locomotive choice through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, and then multiplies the resulting selected-train count by the per-train upgrade cost from `0x004619c0` after converting the current and target locomotive ids through `0x004337b0` and `0x004337a0`. It writes the total upgrade cost through the first out-parameter and the number of selected trains through the second. Current grounded callers are the summary formatter at `0x0050f890` and the purchase-or-upgrade confirmation path inside `shell_trainbuy_window_handle_message`. | objdump + caller inspection + RT3.lng strings + selection-array correlation + upgrade-cost correlation |
| 339 | 0x0050f890 | 368 | shell_trainbuy_window_render_selected_train_upgrade_summary | shell | cdecl | inferred | objdump + caller inspection + RT3.lng strings | 4 | Formats the selected-train upgrade summary text in the shell-side `Trainbuy.win` family. After resolving the currently selected locomotive id through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, the helper calls `shell_trainbuy_window_compute_selected_upgrade_total_and_count` at `0x0050f790` and then builds the player-facing status string from localized ids `1338` `No trains currently selected to upgrade.`, `1339` `Total Cost to Upgrade the %1 Selected Trains to %2 is %3.`, and `1340` `Total Cost to Upgrade the 1 Selected Train to %1 is %2.`. It publishes the resulting heap-backed text through the callback-driven shell control path rooted at control resource `0x275c`. Current grounded callers are the family refresh path at `0x00511500` and the row-selection branch at `0x00512ac7`. | objdump + caller inspection + RT3.lng strings + upgrade-summary correlation |
| 340 | 0x0050fc00 | 1003 | shell_trainbuy_window_render_selected_train_route_and_state_panel | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Renders the richer selected-train detail panel beneath the shell-side `Trainbuy.win` family. The helper resolves the currently selected train and its linked locomotive definition, formats one header block through the shared shell text path at `0x005519f0`, and then builds the lower route or cargo state block through `0x0053de00`, `0x0041d540`, and `0x00552560`. When the runtime latch at `[0x006cec74+0x180]` is set it also appends up to three localized fragments through ids `1341..1343`, gated by bytes `[train+0x30..0x32]`, before laying the final text out. Current grounded callers are the per-row hover or selection refresh paths beneath `Trainbuy.win`; the evidence is strong enough to treat it as the selected-train route-and-state renderer even though the exact player-facing captions for the three optional fragments are still unrecovered. | objdump + caller inspection + nearby-family correlation + selected-train correlation |
| 341 | 0x00511500 | 2941 | shell_trainbuy_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Constructs the shell-side `Trainbuy.win` singleton later published at `0x006d3ac8`. The constructor binds the window resource through `0x0053fa50`, caches three shell runtime handles in `0x006d3abc..0x006d3ac4`, seeds the live singleton pointer at `0x006d3ac8`, builds one filtered locomotive-choice list under `0x006d3ae8`, and then wires the family controls and callbacks through `0x00540120`. Current grounded control ownership is broad enough to treat this as the full `Trainbuy.win` family rather than a small helper: it binds the main action and selection controls under resources `0x2afa..0x2aff`, the selected-train summary path through `shell_trainbuy_window_render_selected_train_upgrade_summary` at `0x0050f890`, the per-row hover helpers at `0x0050fa00` and `0x0050fc00`, the selected-row refresh helper at `0x00511170`, and the selection-paging helper at `0x00512080`. Current grounded caller is `shell_open_or_focus_trainbuy_window` at `0x00512c50`. | objdump + caller inspection + strings correlation + control-wiring inspection + singleton correlation |
| 342 | 0x00512080 | 372 | shell_trainbuy_window_refresh_controls | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Refreshes the visible control state for the shell-side `Trainbuy.win` family. The helper consumes and clears the temporary refresh gate at `0x006d3ae1`, clamps the current selected locomotive-row index from control resource `0x2aff` against the live filtered choice list length at `0x006d3aec`, rewrites the list-selection state across control `0x88`, updates the current mode-strip and list-state controls rooted at `0x00622b28`, and then tail-calls the selected-row detail refresher at `0x00511170`. Current grounded callers are the family constructor at `0x00511500`, the action path after row or mode changes inside `shell_trainbuy_window_handle_message`, and the initial open path in `shell_open_or_focus_trainbuy_window` at `0x00512dd5`. | objdump + caller inspection + strings correlation + list-state correlation |
| 343 | 0x00512c50 | 615 | shell_open_or_focus_trainbuy_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation + RT3.lng strings | 4 | Shared opener for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper first rejects duplicate opens through the live flag at `0x006d3ae4`, seeds the family globals `0x006d3ad0..0x006d3ad8`, `0x006d3acc`, `0x006d3aa8`, `0x006d1aa0`, `0x006d1aa4`, `0x006d3af0`, `0x006d3af4`, `0x00622b24`, and the filtered locomotive-choice list at `0x006d3ae8`, allocates an `0x80`-byte shell window object, constructs it through `shell_trainbuy_window_construct` at `0x00511500`, refreshes it through `shell_trainbuy_window_refresh_controls` at `0x00512080`, and publishes it to the shell runtime at `0x006d401c`. Current grounded callers are the direct train-buy shell command branches at `0x004406ee` and `0x004de7f4` after `shell_can_open_trainbuy_window_or_warn` at `0x00433b00`, plus the sibling train-side action family around `0x00514c97` and `0x00514d7e`. The current family semantics are broader than a bare locomotive picker: nearby message and summary paths show that the same window also stages selected-train upgrade state and train-route editing affordances, but the strongest resource-name anchor remains `Trainbuy.win`. | objdump + caller inspection + strings correlation + RT3.lng strings + singleton correlation + control-family correlation |
| 344 | 0x00512f80 | 193 | shell_trainbuy_window_refresh_selection_side_toggle | shell | thiscall | inferred | objdump + caller inspection + control-flow inspection | 4 | Refreshes the small side-toggle strip beneath `Trainbuy.win` and stores the chosen side in `0x006d3b28`. The helper converts the caller-supplied boolean into two opposing style states on controls `0x6593` and `0x6594`, rewrites one small layout block through `0x0053fe90`, and keeps the current side latched for the surrounding message paths that call it with `0` and `1` at `0x00514fed` and `0x00514fd8`. Current grounded caller is the neighboring train-side window family rooted at `0x006d3b20`, which reuses the same selected-train context but is not yet safely named. | objdump + caller inspection + control-flow inspection + side-toggle correlation |
| 345 | 0x005130f0 | 62 | shell_trainbuy_window_query_selected_train_record | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Returns the currently selected train record or `0` when the active shell detail controller at `0x006d0818` does not hold one valid train id in `[this+0x90]`. The helper validates that selected id against the train collection at `0x006cfcbc` and then resolves the live record through `0x00518140`. Current grounded callers include the neighboring train-side shell window family around `0x005146d6`, `0x00514ce2`, and `0x00515176`, which repeatedly reuse the same selected-train pointer for route, upgrade, and warning flows. | objdump + caller inspection + nearby-family correlation + selected-train correlation |
| 346 | 0x00513130 | 51 | shell_trainbuy_window_query_selected_train_id | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Returns the currently selected train id from the active shell detail controller at `0x006d0818` when that id is positive and still present in the train collection at `0x006cfcbc`; otherwise returns `-1`. Current grounded callers are the same neighboring train-side shell families that package selected-train requests for local and multiplayer follow-on work. | objdump + caller inspection + nearby-family correlation + selected-train-id correlation |
| 347 | 0x00513170 | 44 | shell_trainbuy_window_has_valid_selected_train | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Boolean validity probe above `shell_trainbuy_window_query_selected_train_id`. The helper returns `1` only when the active shell detail controller at `0x006d0818` currently holds one positive train id in `[this+0x90]` and that id is still live in the train collection at `0x006cfcbc`. Current grounded callers include the train-side command family around `0x00514c66`, `0x00514cb5`, `0x00514d9c`, and `0x0051515c`, where it gates nearly every selected-train verb before deeper ownership or route checks run. | objdump + caller inspection + nearby-family correlation + selected-train-id correlation |
| 348 | 0x005131a0 | 125 | shell_trainbuy_window_selected_train_belongs_to_selected_company | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Boolean ownership probe for the currently selected train. After resolving the selected train record through the same `0x006d0818` plus `0x006cfcbc` path as `shell_trainbuy_window_query_selected_train_record`, the helper compares that record's linked company id at `[train+0x51]` against the current scenario-selected company from `0x004337a0`. It returns `1` only when they match. Current grounded callers include the neighboring train-side command family, where failure falls into the explicit warning path at `0x00513220`. | objdump + caller inspection + nearby-family correlation + company-match correlation |
| 349 | 0x00513220 | 351 | shell_trainbuy_window_warn_selected_train_not_owned_by_current_company | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Shared warning modal raised when a selected train does not belong to the current scenario-selected company. The helper resolves one player-facing label through `0x004a8bd0` when a live selected train exists, falls back to the static string block at `0x005c87a8` otherwise, formats localized id `0x250`, and then opens the standard callback-driven shell modal through `shell_open_custom_modal_dialog_with_callbacks` at `0x004c98a0`. Current grounded caller is the ownership-failure branch immediately after `shell_trainbuy_window_selected_train_belongs_to_selected_company` at `0x00514a35`. | objdump + caller inspection + nearby-family correlation + modal correlation |
| 350 | 0x00513720 | 168 | shell_trainbuy_window_refresh_selection_column_empty_state_labels | shell | thiscall | inferred | objdump + caller inspection + control-flow inspection | 4 | Refreshes the paired empty-state labels and styles on controls `0x65a1` and `0x65a2`. The helper inspects the currently active side resource `0x65a3/0x65a4`, checks whether its list selection at `[resource+0x1d6]` is negative, and then switches the two visible placeholder strings between localized ids `0x25b..0x25e` while also rewriting both controls' styles through `0x00540120`. Current grounded callers are the neighboring train-side shell window family constructor at `0x005145f3` and the row-selection action lane at `0x005148f3`. | objdump + caller inspection + control-flow inspection + placeholder-label correlation |
| 351 | 0x00514110 | 67 | shell_train_detail_window_refresh_selected_train_name_label | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Small dynamic-label refresher beneath the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. After validating the currently selected train id from the shell detail controller at `0x006d0818`, the helper resolves control `0x659d` inside the live `TrainDetail.win` singleton and forwards the caller-supplied subject string through `0x004bffc0`. Current grounded caller is the family constructor at `0x00514420`, which binds this helper as the dynamic-text callback for control `0x659d`. | objdump + caller inspection + strings correlation + callback binding |
| 352 | 0x00514160 | 704 | shell_train_detail_window_refresh_controls | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Refreshes the visible control state for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The helper rewrites the two top selection bands `0x65a3` and `0x65a4` from the current side latch at `0x006d3b24`, rebuilds the selected train's nested row state from the current train record resolved through the shell detail controller at `0x006d0818`, installs the per-row callbacks and renderers for the metric rows `0x65b6`, `0x65b9`, `0x65bc`, and `0x65bf`, updates the placeholder and summary text controls `0x659a`, `0x659b`, and `0x659d`, and then refreshes the current row selection plus the paired empty-state labels through `0x004bf320` and `shell_trainbuy_window_refresh_selection_column_empty_state_labels` at `0x00513720`. Current grounded callers are the family constructor at `0x00514420`, the opener at `0x00514620`, and several action paths inside the family message dispatcher at `0x00514690`. | objdump + caller inspection + strings correlation + callback binding + row-state correlation |
| 353 | 0x00514420 | 512 | shell_train_detail_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Constructs the shell-side `TrainDetail.win` singleton later published at `0x006d3b20`. The constructor seeds the local vtable at `0x005d1990`, caches three shell runtime handles in `0x006d3b14..0x006d3b1c`, binds the `TrainDetail.win` resource directly through `0x0053fa50` using the embedded string at `0x005d19c0`, and then wires the family controls and callbacks through `0x00540120`. Current grounded bindings are broad enough to treat this as the full `TrainDetail.win` family: it installs row-click callbacks on `0x65a3` and `0x65a4`, metric renderers on `0x65ab` and `0x65ac`, the selected-train callback on `0x659c`, the dynamic-name label callback on `0x659d`, seeds the side-toggle state through `shell_trainbuy_window_refresh_selection_side_toggle` at `0x00512f80`, and then refreshes the full window through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current grounded callers are the shell detail-panel transition manager at `0x004ddda1` and the direct opener at `0x00514620`. | objdump + caller inspection + strings correlation + callback binding + singleton correlation |
| 354 | 0x00514620 | 110 | shell_open_or_focus_train_detail_window | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Shared opener or focus path for the shell-side `TrainDetail.win` singleton. When the caller supplies one valid train id present in the train collection at `0x006cfcbc`, the helper can seed the selected train subject through `0x004a7390`; when a live `TrainDetail.win` singleton already exists at `0x006d3b20` and the current shell runtime subject matches the incoming one, it simply refreshes that window and pings the shell runtime. Current grounded direct caller is the surrounding shell command path at `0x0046cbda`, and the existing constructor edge at `0x004ddda1` confirms that this opener sits above the same `TrainDetail.win` family rather than the neighboring `Trainbuy.win` singleton. | objdump + caller inspection + strings correlation + singleton correlation |
| 355 | 0x00514690 | 1920 | shell_train_detail_window_handle_message | shell | thiscall | inferred | objdump + caller inspection + control-flow inspection + RT3.lng strings | 4 | Primary message dispatcher for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The handler processes shell messages `0`, `0xca`, `0xcb`, and the recurring service message `0x3e9`; routes the top-level side-toggle, list-selection, and metric-row controls through a dispatch table over resources `0x659c..0x6947`; repeatedly reuses the currently selected train via the helper family at `0x005130f0..0x00513220`; and fans out into several now-bounded train verbs. Current explicit branches include one selected-train engine-replacement or trainbuy handoff lane that checks scenario gate `[0x006cec78+0x4a97]`, raises localized ids `593` `That action is not allowed in this scenario.` and `594` `You can not replace the engine while the train is broken-down.` on failure, and otherwise re-enters `shell_open_or_focus_trainbuy_window` at `0x00512c50` or the neighboring local follow-on path at `0x00436820`; one selected-train retirement lane that checks `[0x006cec78+0x4a9b]`, rejects blocked states through ids `595` and `597`, confirms through id `596`, and then either tears the train down locally through the train collection plus `shell_detail_panel_transition_manager` mode `2` or packages multiplayer opcode `0x37`; plus one tighter route-edit lane over the shared `0x33`-stride route-entry family, where removal re-enters `train_route_list_remove_entry_and_compact` at `0x004b3000` and staged insertion re-enters `train_route_list_insert_staged_entry_at_index` at `0x004b3160`, then validates the resulting route through `train_route_list_validate_reachability_and_station_pair` at `0x004b2c10` and commits the follow-on train state through `train_set_route_operating_mode_and_scalar` at `0x004ab980`, with multiplayer opcode mirrors `0x3d`, `0x3f`, and `0x41`. It also consumes the family refresh path through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current evidence is broad enough to treat this as the full `TrainDetail.win` message owner even though several deeper per-action verbs remain semantically open. | objdump + caller inspection + control-flow inspection + dispatch-table inspection + selected-train helper correlation + RT3.lng strings |
| 356 | 0x004a01a0 | 789 | route_entry_collection_try_build_path_between_optional_endpoint_entries | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy route-entry collection method over the global route store at `0x006cfca8`. The helper accepts up to two optional endpoint-entry pointers or ids, two endpoint coordinate pairs, a route-policy or mode byte, and optional output slots for the chosen endpoint-entry ids. It first resolves any supplied route-entry ids through `0x00518140` and projects them back to compact coordinate pairs through `0x0048a170`, rejects early when either endpoint lands on an invalid world tile through `0x00449980`, and computes one span scalar through `0x004952f0`. When the leading endpoint entry is absent it can synthesize one fresh route entry from the supplied coordinates and policy arguments through `0x00493cf0`; after that it resolves the chosen entry, copies four `3*dword` route-shape or bounding blocks from that entry into the collection-owned builder-state area at `[this+0x139]..[this+0x167]` through `0x005394b0`, stores the chosen endpoint coordinates at `[this+0x11d]` and `[this+0x121]`, latches one active-builder flag at `[this+0x118]`, and stages one linked entry field from `[entry+0x202]` into `[this+0x125]`. On one newly synthesized-entry path and policy bytes `1/2` it also touches the auxiliary route-entry family at `0x006cfcb4` through `0x004a42b0`, `0x00494f00`, and `0x004a4340`. Current caller evidence now narrows one more policy case: both the later world-side caller at `0x00480cd0` and the linked-site refresh helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` enter this helper with both optional endpoint-entry ids unset and literal policy byte `2`, so the strongest current read for that byte is a full linked-site route-anchor rebuild between optional endpoint entries rather than the narrower direct endpoint-anchor creation or replacement lane carried by literal byte `1` in `0x00493cf0`. The helper then resets the collection's transient path-search state through `0x00495480`, re-enters the deeper route-search core at `0x0049d380`, optionally writes the chosen endpoint-entry ids back through the caller-supplied output pointers on success, and finally tears down the transient search state through `0x00495540` and `0x0049ad90`. Current grounded callers are the early route-search lane inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, two neighboring retry branches at `0x004030d0` and `0x00403330`, a paired startup-connection branch at `0x00403ac0`, that later world-side caller at `0x00480cd0`, and the linked-site refresh helper at `0x00480bb0`. This now looks like the shared route-entry search or synthesis owner above the deeper path-search core rather than a generic route-store mutator. | objdump + caller xrefs + callsite inspection + route-entry search correlation + builder-state correlation + partial-mode-byte correlation + linked-site refresh correlation + linked-site policy-byte split correlation |
| 357 | 0x004a3db0 | 272 | route_entry_collection_service_recent_entry_state_promotions_and_followon_refreshes | map | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Collection-wide post-change sweep over the global route-entry store at `0x006cfca8`. The helper first snapshots collection field `[this+0x90]` into `[this+0x94]`, then, when shell-state gate `[0x006cec74+0x94]` is set, walks every live route entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. The current changed-entry lane is now bounded: for entries newer than collection threshold `[this+0x102]` via `[entry+0x240]` and still carrying state byte `[entry+0x216] == 1`, it promotes that state through `0x0048b830(entry, 2)` and then releases any queued side list at `[entry+0x244]` through `0x00489f40`. After that sweep it drains the collection-owned linked list at `[this+0x98]`, resets `[this+0x88] = -1`, and, when shell runtime `0x006d401c` is live while collection latch `[this+0xed]` is clear, posts shell status id `0xbb` through `0x00538e00`. When any entry was promoted it also re-enters `0x004358d0` on the active mode object at `0x006cec78`, triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6`, and then tails into `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` on `0x006ada90`. Current grounded callers include the city-connection route-builder tail at `0x00404564`, the linked-site route-anchor refresh tail at `0x00480d1c`, and TrackLay-side follow-ons at `0x0050d7ed` and `0x0050db24`, so this is now the safest current read for the route-entry collection's recent-entry state-promotion and follow-on refresh sweep rather than a generic collection walk. | objdump + caller inspection + local disassembly + route-entry collection correlation + state-promotion correlation + runtime-effect trigger-kind correlation + route-link followon correlation |
| 358 | 0x00489f80 | 11 | route_entry_assign_aux_tracker_group_id | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 3 | Tiny route-entry helper that writes the caller-supplied auxiliary tracker id into route-entry field `+0x212`. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, and neighboring tracker-update branches at `0x004996e0`, `0x004a4380`, `0x004a4ce0`, and `0x004a4ff0`. This now looks like the direct route-entry aux-tracker group-id assignment helper rather than a generic field store. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 359 | 0x00493cf0 | 456 | route_entry_collection_create_endpoint_entry_from_coords_and_policy | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Creates one fresh route-entry endpoint record from caller-supplied coordinates and a small policy tuple. The helper rejects when either coordinate pair falls outside the live world bounds in `0x0062c120`, optionally validates the supplied company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0`, allocates a new route-entry-like record from the current collection through `0x00518900` with type `0x257`, applies one company-side setup branch through `company_adjust_available_track_laying_capacity_with_floor_zero` `0x00423ec0` when the company id is nonzero, and then commits the detailed endpoint payload through `0x00490ac0`. It can also re-enter `0x00491e60` when the created record or the owning collection keeps one follow-on latch set, and if the collection field `[this+0x88]` is still unset it seeds that field from the created record's word at `+0x240`. Current mode-byte evidence is still partial but tighter now. Literal policy byte `1` is the strongest current match for direct linked-site endpoint-anchor creation or replacement, because the linked-site constructor and its nearby repair branches at `0x00480463`, `0x00480a77`, and `0x00480b69` all pass that byte before rebinding one chosen anchor through `0x0048abc0`. The TrackLay-side callers at `0x0050df1e` and `0x0050eec6` are tighter now too: they derive the passed policy byte from the shared TrackLay mode `0x00622b0c` through `route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte` `0x004955b0`, which currently gives the strongest read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`. Bytes `1/2` are also the ones later reused by `0x004a01a0` to enable the auxiliary tracker lane, while the company-side charge split is no longer vague: when a company id is present, ordinary company-bound synthesis passes `-1` into `0x00423ec0`, while byte `4` instead passes `-2`, so the current strongest read is that policy byte `4` consumes a larger company-side available-track-laying-capacity unit rather than skipping the company setup branch outright. The older builder-state path at `0x0046f2d1` still passes a dynamic byte from `[esi+0x05]`. The function returns the newly created route-entry id or `-1` on failure. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, those neighboring route-building branches, and the TrackLay-side callers at `0x0050df1e` and `0x0050eec6`, so this now looks like the shared endpoint-entry synthesis helper rather than a generic collection allocator. | objdump + caller xrefs + callsite inspection + route-entry creation correlation + partial-mode-byte correlation + caller-pattern correlation + route-build-capacity correlation + linked-site policy-byte split correlation + TrackLay mode correlation |
| 360 | 0x00494e40 | 61 | aux_route_entry_tracker_reset | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 2 | Zeroes or reinitializes one small auxiliary route-entry tracker record. The helper seeds the two endpoint-entry ids at `+0x04` and `+0x08` to `-1`, clears the small refcount at `+0x10`, clears the cached route-key and class-signature words at `+0x18` and `+0x1e`, resets the boolean latch at `+0x1c` to `0`, and clears the trailing payload band through `+0x42`. Current grounded callers are the tracker allocator paths at `0x004a42b0` and several neighboring `0x006cfcb4` setup sites, so this is the clearest current initializer for the auxiliary route-entry tracker family. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 361 | 0x00494e90 | 15 | aux_route_entry_tracker_seed_owner_entry_id | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 2 | Seeds one auxiliary route-entry tracker with its owner or primary route-entry id. The helper writes the caller-supplied id into tracker field `+0x00` and clears the small accumulator fields at `+0x42` and `+0x46`. Current grounded callers are the tracker allocator paths at `0x004a42b0`, which use it immediately after allocating one `0x006cfcb4` record keyed by a route-entry id. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 362 | 0x00494eb0 | 15 | aux_route_entry_tracker_adjust_refcount | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 2 | Adds the caller-supplied delta into the small refcount field at tracker offset `+0x10` and returns the updated total. Current grounded callers are the collection-side tracker updater `0x004a4340`, where a zero result triggers the tracker's destruction path. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 363 | 0x00494ed0 | 26 | aux_route_entry_tracker_contains_endpoint_entry_id | map | thiscall | inferred | objdump + caller xrefs + field-layout inspection | 2 | Small membership probe over one auxiliary route-entry tracker. The helper returns `1` when the caller-supplied route-entry id matches either tracker endpoint slot `+0x04` or `+0x08`, and `0` otherwise. Current grounded callers include several tracker-regroup and repair branches around `0x00490d62`, `0x0049a9ed`, `0x0049f162`, and `0x004a4ce0`, where it acts as the cheap endpoint-membership test beneath adjacent-chain transfer and duplicate-split logic. | objdump + caller xrefs + field-layout inspection + tracker-family correlation |
| 364 | 0x00494f00 | 176 | aux_route_entry_tracker_merge_or_bind_endpoint_entry | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Binds one route-entry id into the two-endpoint auxiliary tracker record. The helper resolves the supplied route-entry through `0x006cfca8`, derives one route-key-like value through `0x0048aa70`, reads the route-entry signature fields at `+0x22e` and byte `+0x44`, and then either seeds both endpoint slots `+0x04/+0x08` on the first bind or merges the new entry into one side when the signature, route-key, and boolean class latch match the tracker's existing state. On failure it returns `0`; on success it returns `1`. Current grounded callers are the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring `0x006cfcb4` tracker update branches around `0x0049f1ce`, `0x0049f38d`, `0x0049f90b`, `0x004a4685`, `0x004a4830`, `0x004a4982`, `0x004a5175`, and `0x004a5189`. This now looks like the tracker-side endpoint bind or merge helper rather than a generic route-entry accessor. | objdump + caller xrefs + callsite inspection + tracker-family correlation |
| 365 | 0x00494fb0 | 97 | aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Refreshes the small boolean class latch at tracker offset `+0x1c` and notifies the owning route-entry group when that latch changes. When the route-store latch `[0x006cfca8+0xf1]` is clear, the helper resolves the current endpoint-entry ids from `+0x04` and `+0x08`, recomputes whether the bound endpoint pair carries the nonzero route-entry byte `+0x44` on both sides, writes the resulting boolean back into `+0x1c`, compares it against the previous latch value, and on change calls `0x004a6360` on the auxiliary tracker collection `0x006cfcb4` with the owner entry id at `+0x00`. Current grounded callers are the neighboring route-state branch at `0x004915e0` and the compatible endpoint-slot rewrite helper `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0`. This now looks like the tracker-side boolean class-latch refresh plus owner-notify path rather than a generic predicate helper. | objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-notify correlation |
| 366 | 0x00495020 | 188 | aux_route_entry_tracker_refresh_cached_match_fields_and_maybe_split_duplicate_pair | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + field-layout inspection | 3 | Refreshes one auxiliary tracker's cached match metadata and clears its trailing relationship payload band. Under two scenario-threshold branches keyed by `[0x006cec78+0x46c34]`, the helper seeds or refreshes tracker cache fields from the currently bound endpoint pair: it derives one route-key-like value through `0x0048aa30`, reuses one endpoint signature word from route-entry field `+0x22e`, and falls back to constant `1` when no endpoint slot is available on the active branch. After that it zeroes the trailing payload band at `+0x24..+0x46`. When both endpoint slots `+0x04` and `+0x08` still point to the same route-entry id and the tracker refcount `+0x10` is greater than `1`, it tail-calls the deeper split or reseed path at `0x004a51a0` with the owner route-entry id at `+0x00`. Current grounded caller is the broader tracker-side branch at `0x004a41b0`. The current objdump shape keeps the exact `+0x18/+0x1e` destination split slightly irregular on the second threshold path, so this row stays conservative about the final field assignment while still grounding the helper as cached-match refresh plus duplicate-pair split prep. | objdump + caller xrefs + callsite inspection + field-layout inspection + tracker-family correlation |
| 367 | 0x004950f0 | 128 | aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Rewrites one matching endpoint slot in an auxiliary tracker after compatibility checks. The helper validates the replacement route-entry id, derives its route-key-like value through `0x0048aa70`, requires that value plus the route-entry signature word `+0x22e` to match the tracker's cached comparison fields, and then only replaces endpoint slot `+0x04` or `+0x08` when the caller-supplied old endpoint id currently occupies that slot. After any replacement it re-enters `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0` so the boolean class latch at `+0x1c` stays in sync. It returns `1` when a slot was replaced and `0` otherwise. Current grounded callers include the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, the neighboring route-state helpers at `0x00490bf0` and `0x004996e0`, and the tracker-side link-rewrite family at `0x004a4ce0`. This now looks like the compatibility-checked endpoint-slot rewrite helper beneath the auxiliary tracker family rather than a generic record mutator. | objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-slot rewrite correlation |
| 368 | 0x004955b0 | 43 | route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Small mapper from the live TrackLay primary mode into one of the endpoint-synthesis policy bytes consumed by `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`. The helper returns `1` immediately when the caller-supplied mode dword is `1`; otherwise it inspects two route-store state fields at `[this+0x1e1]` and `[this+0x1fd]` before either keeping that same `1` fallback or returning `4`. Current grounded callers are the TrackLay-side branches at `0x0050df00` and `0x0050eea8`, where the input mode comes directly from the shared TrackLay state at `0x00622b0c` already bounded as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40`. That makes the strongest current read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`, with one route-store-state-dependent fallback still preventing a fully closed user-facing name. | objdump + caller xrefs + callsite inspection + TrackLay mode correlation + partial-policy-byte correlation |
| 369 | 0x004952f0 | 208 | math_compute_quadrant_adjusted_heading_angle_from_xy_pair | map | cdecl | inferred | objdump + caller xrefs + arithmetic inspection | 4 | Computes one quadrant-adjusted heading angle from two float XY point pairs. The helper handles the vertical-line degeneracy explicitly by returning `pi/2` or `3*pi/2`, otherwise computes one arctangent ratio through the CRT helper at `0x005a1270` and then adds either `pi` or `2*pi` when the caller's delta pair lands in the corresponding quadrant. The result is a normalized heading-like angle in the `0 .. 2*pi` range. Current grounded callers include the route-entry search family at `0x004a01a0`, `0x0049d380`, and `0x0049c900`, plus several neighboring route and world-side geometry branches. | objdump + caller xrefs + arithmetic inspection + constant correlation |
| 370 | 0x004953c0 | 95 | math_normalize_subtracted_angle_delta_and_report_wrap | map | thiscall | inferred | objdump + caller xrefs + arithmetic inspection | 4 | Subtracts one angle from another and normalizes the resulting delta back into the principal `[-pi, pi]` range. When the optional pointer in `ECX` is nonnull the helper clears it to `0`, then sets it to `1` only when the delta had to be wrapped by adding or subtracting `2*pi`. Current grounded callers include the route-entry search family at `0x0049d380` and `0x0049c900`, several route-node or waypoint geometry branches, and neighboring world-side angle tests. This now grounds `0x004953c0` as a reusable wrapped-angle-delta helper rather than another anonymous quality check. | objdump + caller xrefs + arithmetic inspection + constant correlation |
| 371 | 0x0049d380 | 1134 | route_entry_collection_search_path_between_entry_or_coord_endpoints | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy internal route-search core beneath the route-entry synthesis family. The helper accepts a leading route-entry id, one company id, two endpoint coordinate pairs, a route-policy tuple, one optional external target entry id, and several scratch or output buffers. It begins by validating the company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0` when present, then packages the current search context into the collection-owned builder state, including one current-search latch at `[this+0x1d5]` and one distance-like scalar at `[this+0x1d1]`. From there it runs three bounded internal stages. First, it enters the deeper candidate path sweep at `0x0049bd40`; this can return a direct matching route-entry id or leave the search unresolved. Second, when that first stage does not settle the search, it rehydrates the returned route entry through `0x0048a170`, evaluates point-to-point distance, span, and angle-like quality terms through `math_measure_float_xy_pair_distance` `0x0051db80`, `0x004952f0`, `0x004953c0`, and `0x005a152e`, and only accepts the result when those quality gates pass. Third, when the quality gates or initial sweep fail, it can fall back to route-entry extension helpers `0x00494cb0` and `0x0049c900`, plus route-state propagation through `0x0048e600`, while rewriting several collection-side path blocks rooted at `[this+0x169]`, `[this+0x175]`, `[this+0x181]`, `[this+0x18d]`, `[this+0x199]`, `[this+0x1a5]`, `[this+0x1b1]`, and `[this+0x1bd]`. The function returns one resolved route-entry id or `-1`, and current direct callers are only internal route-entry family wrappers at `0x004a0470`, `0x004a0870`, `0x004a0b2a`, and `0x004a0cef`. In current evidence this is the search core that the higher wrapper `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` hands off to after endpoint reuse or synthesis, rather than a user-facing route mutator by itself. | objdump + caller xrefs + callsite inspection + path-search correlation + builder-state correlation + distance-helper correlation + track-laying-capacity correlation |
| 372 | 0x0049bd40 | 982 | route_entry_collection_run_initial_candidate_path_sweep | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Runs the first candidate route sweep beneath `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`. The helper clears any prior temporary path list through `0x0049ad90`, seeds two caller-owned status dwords, resolves the starting route-entry id through the collection, rejects one trivial or degenerate local-delta case, and then seeds an initial extension attempt through `0x00494cb0`. From there it builds one temporary candidate chain in `[this+0x1cd]`, derives route quality terms from point-to-point distance through `math_measure_float_xy_pair_distance` `0x0051db80`, re-enters the route-node search against the auxiliary tracker collection `0x006cfcb4` through `0x004a6630`, and on a passing result publishes one follow-on route-entry id through the caller-supplied output slot. Current evidence now narrows the internal quality policy too: when the route-state gate at `[this+0xe9]` stays clear the helper selects a larger quality multiplier of `1.8` on route-policy byte `4` or field `[0x006cec78+0x4c74]`, and otherwise uses `1.4`; the same branch also folds in one signed angle-bias term `+/-0.181000038854627` before the later acceptance checks. That field is still the same player-facing TrackLay preference slot grounded elsewhere as `Auto-Show Grade During Track Lay`, but on this route-search lane it now reads more concretely as a temporary search-quality override: the shared city-connection builder `0x00402cb0` and the broader company periodic pass `0x004019e0` both mirror electric-locomotive context into it specifically to force this same larger initial-sweep multiplier branch. Current grounded direct caller is the search core `0x0049d380`, where this helper is the first stage before the later quality-gate and extension fallbacks. This now looks like the initial candidate path sweep rather than a generic collection iterator. | objdump + caller xrefs + callsite inspection + candidate-sweep correlation + tracker-family correlation + quality-threshold constant correlation + distance-helper correlation + temporary-override correlation |
| 373 | 0x0049c900 | 829 | route_entry_collection_try_extend_search_frontier_toward_target_coords | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Tries to extend the current route-search frontier toward one target coordinate pair. The helper starts from two endpoint coordinate pairs plus one caller-owned result slot, initializes that result slot to `-1`, computes span and angle-like quality terms through `0x004952f0`, `0x005a152e`, and the same constant families used by the search core, and then repeatedly advances the search sample window until one candidate route extension passes the quality thresholds. Current evidence now narrows those thresholds too: this helper reuses the same signed angle-bias family `+/-0.181000038854627` seen in the initial candidate sweep before deciding whether to probe a covering entry. On successful passes it re-enters `route_entry_collection_try_find_route_entry_covering_point_window` `0x00494cb0`, verifies the returned entry through `0x0048ba40`, `0x004953c0`, and neighboring state bytes, and publishes the accepted route-entry id through the caller-owned result pointer. On failure it leaves that pointer at `-1`. Current grounded direct callers are the search core `0x0049d380` and the neighboring route wrapper at `0x004a0740`, which together make this the clearest current extension or frontier-advance helper beneath the route-entry search family rather than a free-standing world query. | objdump + caller xrefs + callsite inspection + frontier-extension correlation + quality-threshold constant correlation |
| 374 | 0x00494cb0 | 398 | route_entry_collection_try_find_route_entry_covering_point_window | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Searches the current route-entry collection for one entry whose sampled span covers the caller's point window. The helper rejects immediately when the supplied window radius is nonpositive, quantizes the caller's center coordinates into world-grid bounds, iterates the resulting rectangular tile window inside `0x0062c120`, and repeatedly re-enters `0x004921a0` on each candidate tile or route bucket until it finds one acceptable route-entry id. Current grounded callers include the station-attachment validation lane at `0x00403d30`, the placement validator at `0x00417ba1` and `0x0041a2c9`, the world-side route mutation lane at `0x00480d88`, the initial candidate sweep `0x0049bd40`, the search core `0x0049d724`, and several neighboring route-search branches. This now looks like the shared route-entry point-window coverage query beneath both placement-side track attachment and the heavier route-entry search family rather than a generic tile scan. | objdump + caller xrefs + callsite inspection + world-grid correlation + route-window correlation |
| 375 | 0x004a42b0 | 79 | aux_route_entry_tracker_collection_allocate_entry | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Allocates one new tracker record in the auxiliary route-entry collection at `0x006cfcb4` and seeds it for one owner route-entry id. The helper resets a small local tracker template through `aux_route_entry_tracker_reset` `0x00494e40`, allocates one live record from the collection through `0x00518900`, resolves that record, seeds its owner entry id through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90`, and returns the new tracker id. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x0049e174`, `0x0049e3d8`, `0x0049e427`, `0x0049e45c`, `0x0049f1b0`, `0x0049f3b5`, `0x0049f91a`, `0x004a466d`, `0x004a4814`, `0x004a4966`, and `0x004a5054`, so this is now the clearest current allocator for the auxiliary route-entry tracker family. | objdump + caller xrefs + callsite inspection + tracker-family correlation |
| 376 | 0x004a4340 | 55 | aux_route_entry_tracker_collection_adjust_refcount_or_destroy | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Looks up one tracker record in the auxiliary route-entry collection at `0x006cfcb4`, adjusts its small refcount through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`, and destroys the record through the collection vtable when the resulting count reaches zero. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x00490da5`, `0x0049a9b8`, `0x0049abca`, `0x0049f178`, `0x0049f1a2`, `0x0049f1e0`, `0x0049f37e`, `0x0049f3a7`, `0x004a4f9c`, `0x004a4fb0`, and `0x004a5161`. This now looks like the shared refcount or destroy path for the auxiliary route-entry tracker family rather than another anonymous collection helper. | objdump + caller xrefs + callsite inspection + tracker-family correlation |
| 377 | 0x004a4380 | 619 | aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Broader prepass beneath the auxiliary route-entry tracker regrouping family at `0x006cfcb4`. Starting from one existing tracker id, the helper snapshots the source tracker's cached match tuple at `+0x18/+0x1c/+0x1e` plus its endpoint slots `+0x04/+0x08`, walks the adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family, and watches for a subchain whose route-key-like value from `0x0048aa70`, signature word `+0x22e`, or boolean class byte `+0x44` no longer matches the source tracker. When that mismatch survives the surrounding guards, it allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, seeds or binds the moved entries through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90` and `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, reassigns the traversed route entries through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalances the two trackers' counts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`, where this helper runs as the early split prepass keyed by the current route entry's tracker id. This now looks like the chain-splitting helper that carves a mismatching adjacent subchain into one fresh tracker group rather than a generic collection walk. | objdump + caller xrefs + callsite inspection + tracker-family correlation + regrouping prepass correlation |
| 378 | 0x004a45f0 | 1420 | aux_route_entry_tracker_collection_refresh_route_entry_group_membership | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavy regrouping pass over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper starts from one route-entry record, rejects the trivial case where both adjacent route-entry fields `[entry+0x206]` and `[entry+0x20a]` are unset, optionally runs `aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group` `0x004a4380` keyed by the route entry's current tracker id in `[entry+0x212]`, and then refreshes ownership around that id. On the simpler branch it can allocate one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, bind one or more route-entry ids into it through `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, assign the resulting tracker id back into route-entry field `+0x212` through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalance tracker refcounts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. The current endpoint-bind semantics are tighter now too: the bind helper groups entries only when their route-key-like value from `0x0048aa70`, route-entry signature word `+0x22e`, and boolean class latch derived from byte `+0x44` all agree. On the larger branch this pass walks adjacent route-entry links through the `+0x206/+0x20a/+0x20e` family, can re-enter `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate compatible neighboring subchains between tracker groups, uses `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` to rewrite compatible endpoint slots, and can re-enter the nearby cached-match refresh path `0x00495020` before dropping empty tracker records through the collection vtable. Current grounded caller is `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where this pass runs immediately after literal-policy-`2` route-anchor rebuild and bind. This now looks like the auxiliary tracker regrouping pass beneath the broader linked-site route-anchor rebuild lane rather than a generic collection sweep. | objdump + caller xrefs + callsite inspection + tracker-family correlation + linked-site refresh correlation + endpoint-match-tuple correlation + chain-transfer correlation |
| 379 | 0x004a4c00 | 224 | aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate | map | thiscall | inferred | objdump + callsite inspection + field-layout inspection | 3 | Compatibility gate used before adjacent tracker-chain transfers. Given two route-entry records, the helper validates both current tracker ids in the auxiliary tracker collection at `0x006cfcb4`, resolves the two tracker records, and then requires a matching cached comparison tuple across both trackers: byte `+0x1d` must be nonzero on both sides, dwords `+0x18` and `+0x1e` must match, and boolean latch byte `+0x1c` must match. It also requires both candidate route entries to keep their special side fields at `+0x20e` and `+0x222` unset at `-1`. Only when all of those checks pass does it return `1`; otherwise it returns `0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links` `0x004a6360`, where this gate sits directly above the adjacent-chain transfer helper `0x004a4ce0`. This now looks like the reusable adjacent-chain transfer compatibility gate rather than a generic pairwise predicate. | objdump + callsite inspection + field-layout inspection + tracker-family correlation + transfer-gate correlation |
| 380 | 0x004a4ce0 | 777 | aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Reusable cross-group migration helper beneath the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids plus one cached match tuple, the helper first verifies that collection-busy latches are clear, validates the destination tracker's cached fields at `+0x18/+0x1c/+0x1d/+0x1e`, then walks one adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family while using `aux_route_entry_tracker_contains_endpoint_entry_id` `0x00494ed0` to avoid trampling the destination tracker's existing endpoint entries. Compatible traversed entries are reassigned into the destination group through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, source and destination tracker populations are rebalanced through `aux_route_entry_tracker_collection_adjust_refcount_or_destroy` `0x004a4340` and the raw `+0x14` count field, and the destination endpoint slots can be rewritten through `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` before any emptied source tracker is destroyed. Current grounded callers include the owner-refresh family at `0x004a6360` plus neighboring route-state branches at `0x0049ac78`, `0x0049ff6e`, and `0x004a645a..0x004a65a3`. This now looks like the adjacent-chain transfer helper between compatible tracker groups rather than a generic collection mutator. | objdump + caller xrefs + callsite inspection + tracker-family correlation + adjacent-chain transfer correlation |
| 381 | 0x004a4ff0 | 454 | aux_route_entry_tracker_collection_reseed_group_from_route_entry_component | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Repair or reseed helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. Starting from one route-entry id whose current tracker membership is missing or invalid, the helper allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, assigns that tracker id into the starting entry through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, walks the connected route-entry component through `0x0048e140` and `0x0048e160`, and migrates each adjacent member that still carries the stale tracker id into the new group while counting the moved entries. It then updates the involved tracker populations, binds the new component's endpoint entries back into the fresh tracker through two calls to `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, and returns. Current grounded callers include the route-state repair branch at `0x0048b896` and the broader tracker traversal pass at `0x004a6244`. This now looks like the component-level tracker-group reseed helper used when a route-entry component has lost valid tracker ownership rather than a generic regrouping walk. | objdump + caller xrefs + callsite inspection + tracker-family correlation + reseed correlation |
| 382 | 0x004a5fc0 | 928 | aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Collection-wide traversal refresh for the auxiliary route-entry tracker family at `0x006cfcb4`. The helper clears the collection dirty latch at `[this+0x8c]`, allocates one temporary queue array at `[this+0x94]`, resets every live tracker's traversal label field at `+0x0c` to `-1`, and then repeatedly walks connected tracker groups until every live record has one stable component label. While traversing, it destroys dead tracker records whose active count has fallen nonpositive, follows adjacent route-entry links outward from each tracker endpoint through the `+0x206/+0x20a/+0x20e` route-entry family, and when one neighboring route entry carries an invalid tracker id it repairs that side immediately through `aux_route_entry_tracker_collection_reseed_group_from_route_entry_component` `0x004a4ff0` before continuing the walk. The refreshed component labels are stored back into tracker field `+0x0c`, and neighboring collection-side queries reuse them after the dirty latch has been cleared. Current grounded callers are the adjacent tracker-query helper at `0x004a6320` and neighboring owner-refresh branches that first test `[this+0x8c]` before trusting cached component labels. This now looks like the collection-wide connected-component refresh and invalid-group reseed pass rather than a generic sweep. | objdump + caller xrefs + callsite inspection + tracker-family correlation + traversal-label correlation + reseed correlation |
| 383 | 0x004a6360 | 592 | aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Owner-side adjacent-group refresh beneath the auxiliary route-entry tracker family at `0x006cfcb4`. Starting from one owner route-entry id, the helper validates the current tracker, requires its tracker-side enable byte `+0x1d` to be nonzero, resolves the two bound endpoint entries from tracker slots `+0x04` and `+0x08`, and first requires those endpoint entries to agree on the boolean class state derived from route-entry byte `+0x44`. It then inspects adjacent route-entry links hanging off both endpoint sides through the `+0x206/+0x20a` family and, whenever a neighboring route entry belongs to a different tracker group, runs `aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate` `0x004a4c00` before re-entering `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate that compatible adjacent chain into the owner's tracker group. Current grounded caller is `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0`, which invokes this helper only when the tracker's boolean class latch at `+0x1c` changes. This now looks like the owner-adjacent compatible-group refresh path triggered by latch changes rather than a generic tracker walk. | objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-refresh correlation + compatibility-gate correlation |
| 384 | 0x004a62c0 | 79 | aux_route_entry_tracker_query_tracker_component_labels_match | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Small dirty-aware equality test over tracker component labels in the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids, the helper first refreshes stale labels through `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when collection dirty latch `[this+0x8c]` is set, resolves both tracker records, and returns `1` only when both ids are live and tracker field `+0x0c` matches across the pair. Invalid tracker ids return `0`. Current grounded callers include the alternate recursive pair-metric branch at `0x004a5900`, where this helper gates same-component recursion before adjacent-neighbor expansion. | objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label equality correlation |
| 385 | 0x004a6320 | 64 | aux_route_entry_tracker_collection_query_component_label_by_tracker_id | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Dirty-aware query helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper first checks collection dirty latch `[this+0x8c]` and re-enters `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when the cached component labels are stale. It then validates the caller-supplied tracker id through the collection, resolves the live tracker record, and returns the connected-component label stored in tracker field `+0x0c`; invalid tracker ids return `-1`. Current grounded callers are the heavier pair-selection family around `0x004a6630`, where this helper is the reusable query side of the component-label sweep rather than another traversal owner. | objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label query correlation |
| 386 | 0x004a65b0 | 128 | aux_route_entry_tracker_dispatch_route_entry_pair_metric_query | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Build-compatibility-switched lower metric query beneath the auxiliary route-entry tracker pair-selection family. The helper forwards one fixed route-entry pair, one companion output pair, and the surrounding score or scratch arguments into one of two heavier internal algorithms: it dispatches to `0x004a5280` when the shared build-version query at `runtime_query_hundredths_scaled_build_version` `0x00482e00(0x006cec74)` reports at least `0x67`, and otherwise dispatches to `0x004a5900`. The recovered cutovers now line up with executable build values `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`, and the version source itself can come from either the local `RT3.EXE` version resource or the multiplayer session-side companion path at `0x0046a4b0`, so this branch now reads most safely as a pre-`1.03` versus `1.03+` route-metric compatibility dispatcher rather than any gameplay time or era gate. Current grounded caller is the broader chooser at `0x004a6630`, which can invoke this helper repeatedly across multiple endpoint combinations, keep the smallest non-`-1` returned score, and publish the chosen route-entry pair through out pointers. Current evidence is therefore tight enough to treat this as the reusable route-entry-pair metric dispatcher beneath that chooser, while the deeper user-facing meaning of the returned metric still lives mostly in the linked-transit and route-validation consumers rather than inside this switch itself. | objdump + caller xrefs + callsite inspection + tracker-family correlation + pair-metric correlation + version-gate correlation + multiplayer-session-version correlation |
| 387 | 0x004a5280 | 1664 | aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk. | objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation |
| 388 | 0x004a5900 | 1728 | aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan. | objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation |
| 389 | 0x004a6630 | 892 | aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep. | objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation |
| 390 | 0x004a9460 | 65 | train_current_route_context_uses_strict_reachability_mode | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open. | objdump + caller xrefs + callsite inspection + route-context correlation |
| 391 | 0x004a94b0 | 381 | train_finalize_aux_route_entry_buffer_preserving_subflags | simulation | thiscall | inferred | objdump + caller xrefs + route-entry inspection | 3 | One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open. | objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation |
| 392 | 0x004ab980 | 760 | train_set_route_operating_mode_and_scalar | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open. | objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation |
| 393 | 0x004b2b80 | 29 | train_route_list_count_live_site_reference_entries | simulation | thiscall | inferred | objdump + caller xrefs + route-entry inspection | 4 | Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter. | objdump + caller xrefs + route-entry inspection + callsite inspection |
| 394 | 0x004b2c10 | 656 | train_route_list_validate_reachability_and_station_pair | simulation | thiscall | inferred | objdump + caller xrefs + callsite inspection + RT3.lng strings | 4 | Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan. | objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split |
| 395 | 0x004b2f00 | 250 | train_route_list_select_entry_and_refresh_linked_site_state | simulation | thiscall | inferred | objdump + caller xrefs + state-layout inspection | 4 | Shared selector helper for one train-owned route-entry list whose records are `0x33` bytes wide. The helper clamps the requested selected index against the current count at `[this+0x4]`, stores the new selection in `[this+0x8]`, and only when route-entry flag byte `+0x28` has its sign bit clear does it extract the previous and new placed-structure ids from field `+0x29` and forward that old/new site pair into `0x004819b0`; sign bit set entries skip that placed-structure extraction path. It then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. When the caller requests it, it also marks the owning train record's byte `[train+0x1b9]`. Current grounded callers include the local `TrainDetail.win` route-entry branch at `0x00514a96`, the multiplayer-side route-entry handlers at `0x00471730` and `0x004097f9`, and the removal helper `train_route_list_remove_entry_and_compact` at `0x004b3000`. The same route family is now also tied to localized reachability warnings `3089..3091`, so this reads as a train route-stop or waypoint selection helper rather than a generic row selector. | objdump + caller xrefs + state-layout inspection + placed-structure-id correlation + route-warning correlation + route-entry flag split |
| 396 | 0x004b3000 | 341 | train_route_list_remove_entry_and_compact | simulation | thiscall | inferred | objdump + caller xrefs + state-layout inspection | 4 | Removes one entry from the same `0x33`-stride train-owned route list and compacts the remaining records. The helper validates the caller-supplied index against current count `[this+0x4]`, repairs the selected index `[this+0x8]`, re-enters `train_route_list_select_entry_and_refresh_linked_site_state` at `0x004b2f00` when the removed row was the selected one, allocates a shorter replacement buffer, copies the prefix and suffix segments around the removed row, decrements the list count, frees the old buffer, and then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. Current grounded callers include the local `TrainDetail.win` route-entry removal branch at `0x00515211` and the multiplayer-side handler at `0x00471823`. | objdump + caller xrefs + state-layout inspection + compacting-buffer correlation + route-list correlation |
| 397 | 0x004b3160 | 530 | train_route_list_insert_staged_entry_at_index | simulation | thiscall | inferred | objdump + caller xrefs + state-layout inspection + RT3.lng strings | 4 | Inserts one staged `0x33`-byte route-entry record into the same train-owned route list at one caller-selected index. Before insertion the helper seeds parts of the staged record from the prior terminal route entry and preserves the currently grounded lower route-entry subflags `0x40`, `0x20`, and `0x10` in field `+0x28`. That same flag byte also carries the top-level entry split: sign bit clear entries use one live placed-structure id in field `+0x29`, while sign bit set entries use one direct route-node payload in field `+0x2b`. Only the live site-reference branch can re-enter the narrower tutorial gate `tutorial_validate_train_route_station_indicator_step` at `0x00516d00`, and only when the staged placed-structure id is station-or-transit-like and the shell tutorial family rooted at `0x006d3b4c` is active. The helper then allocates a `(count+1)` replacement buffer, copies the prefix rows, writes the staged record at the requested insertion index, copies the suffix rows, frees the old buffer, bumps the count, repairs the selected index, and refreshes the linked train-side state. Current grounded callers include the local `TrainDetail.win` insertion or staging branch at `0x00515417`, the multiplayer-side handlers at `0x004718e5` and `0x004097eb`, and the nearby validation path that surfaces localized reachability warnings `3090` `This train cannot reach the station you've selected.` and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the route-stop or waypoint insertion helper above that validation family rather than as a generic record copier. | objdump + caller xrefs + state-layout inspection + RT3.lng strings + insertion-buffer correlation + route-warning correlation + route-entry flag split + subflag preservation |
| 398 | 0x00516be0 | 284 | tutorial_advance_step_and_refresh_expected_control_ids | shell | cdecl | inferred | objdump + caller xrefs + local disassembly + tutorial-table inspection | 4 | Advances one active shell tutorial step and refreshes the small expected-control cache under `0x00622b34..0x00622b3c`. The helper first returns immediately when the tutorial-active flag at `0x006d3b4c` is zero; otherwise it increments the current tutorial step index at `0x006d3b50`, consults the `0x40`-byte descriptor table rooted at `0x00622b48`, and skips several currently grounded step codes when their extra world or shell-state predicates fail. After choosing the next live step it copies the previous expected control id from `0x00622b34` into `0x00622b38`, then loads the new expected control id and one current alternate-accepted control id from descriptor offsets `+0x34` and `+0x38` into `0x00622b34` and `0x00622b3c`. Current shell-command correlation is now tight enough to support that narrower reading: the generic shell control path around `0x004de199` and `0x004de724` compares incoming control ids directly against `0x00622b3c` and suppresses the tutorial-only `3587` rejection when they match, which makes `0x00622b3c` look like a current companion control id rather than a page or mode selector. The helper also rate-limits one small shell-side nudge through `0x0045ea20` while the tutorial runs. Current grounded callers are the generic shell control path at `0x00540cca` and the train-route tutorial validator at `0x00516d93`, which makes this the current best owner for the tutorial step-advance and expected-control cache instead of leaving `0x00622b34/38/3c` as anonymous globals. | objdump + caller xrefs + local disassembly + tutorial-table inspection + control-cache correlation + shell-command correlation |
| 399 | 0x00516d00 | 143 | tutorial_validate_train_route_station_indicator_step | shell | thiscall | inferred | objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings | 4 | Small shell-side tutorial gate used before one live station-or-transit site id is committed into the train route-entry list. The helper only matters while the tutorial state family rooted at `0x006d3b4c` is active: it consults the current tutorial step index at `0x006d3b50`, reads that step's code from the `0x40`-byte tutorial descriptor table rooted at `0x00622b48`, and accepts only the currently grounded step codes `0x172` and `0x17c`, which align with localized tutorial prompts `3777` `Click on the yellow station indicator for Milan.` and `3778` `Now click on the station indicator for Turin`. For accepted steps it stages the caller-supplied site id into `0x006d3b5c` and, in the second step, advances the surrounding tutorial state through `0x00516be0` only when the incoming site differs from the currently staged one. For incompatible tutorial steps it opens one callback-driven shell modal through `0x004c98a0` and returns `0`, which causes `train_route_list_insert_staged_entry_at_index` at `0x004b3160` to abort before the record is inserted. Current evidence is therefore tight enough to treat this as the tutorial-side train-route station-indicator validator rather than a general `TrainDetail.win` row-kind gate. | objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings + modal correlation |
| 400 | 0x00517d40 | 66 | indexed_collection_entry_id_is_live | simulation | thiscall | inferred | objdump + caller inspection + collection-bitset inspection | 4 | Shared indexed-collection presence test over the common collection layout that uses `[this+0x14]` as the upper id bound and `[this+0x34]` as the tombstone or disabled-bitset. The helper rejects nonpositive or out-of-range ids and otherwise returns `1` only when the bit for the requested id is clear, i.e. when the entry is currently live. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it guards ordinary candidate ids before `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and neighboring collection walkers that treat the same ids as positive live-record selectors rather than zero-based dense ordinals. | objdump + caller inspection + collection-bitset inspection + callsite correlation |
| 401 | 0x00517cf0 | 3 | indexed_collection_slot_count | simulation | thiscall | inferred | objdump + caller inspection + collection-layout inspection | 4 | Tiny shared accessor that returns the current slot-count field `[this+0x18]` from the common indexed-collection layout. Current grounded callers use it as the upper bound for zero-based slot walks before resolving one nth live entry id through `indexed_collection_get_nth_live_entry_id` `0x00518380`. | objdump + caller inspection + collection-layout inspection + slot-walk correlation |
| 402 | 0x00518140 | 89 | indexed_collection_resolve_live_entry_by_id | simulation | thiscall | inferred | objdump + caller inspection + collection-layout inspection | 4 | Shared indexed-collection record resolver over the same common collection layout. The helper rejects nonpositive, out-of-range, or tombstoned ids through the `[this+0x14]` bound and `[this+0x34]` bitset, then returns one live record pointer from the payload rooted at `[this+0x30]`. When collection flag dword `[this+0x04]` is nonzero it treats that payload as a flat `stride=[this+0x08]` record array and returns `base + stride*id`; otherwise it treats the payload as an array of record pointers stored in `stride=[this+0x08]` slots and returns the pointer loaded from `base + stride*id`. Current grounded callers include the company, profile, train, and structure-candidate families, where it is the common bridge from one positive collection id to one concrete live record pointer. | objdump + caller inspection + collection-layout inspection + direct-vs-indirect payload correlation |
| 403 | 0x00518380 | 364 | indexed_collection_get_nth_live_entry_id | simulation | thiscall | inferred | objdump + caller inspection + collection-layout inspection | 4 | Shared nth-live-entry selector over the same indexed-collection layout. With traversal mode `0` it walks slot ids in forward order, skipping tombstoned ids through the bitset at `[this+0x34]`, and returns the positive entry id whose zero-based live ordinal matches the caller-supplied index; recent results are memoized in the small cache bands rooted at `[this+0x68]` and `[this+0x78]`. With nonzero traversal mode it reuses the auxiliary link banks rooted at `[this+0x38]`, `[this+0x48]`, and `[this+0x58]` to step through one alternate live-order chain before returning the resulting id. Current grounded callers across company, profile, structure-candidate, and placed-structure families mostly use traversal mode `0`, where this is the shared bridge from one zero-based live ordinal to one positive collection entry id. | objdump + caller inspection + collection-layout inspection + cache-band inspection + alternate-chain correlation |
| 404 | 0x0051c920 | 223 | localization_lookup_display_label_by_stem_or_fallback | shell | thiscall | inferred | objdump + caller inspection + language-table correlation + static-table inspection | 4 | Shared shell-side label helper that turns one ASCII stem string into one player-facing display label. The helper case-folds the first letter, scans the static `(stem, string-id)` table rooted at `0x006243c8`, compares candidate stems case-insensitively, and returns the localized text for the first matching string id through `0x005193f0` when that localized entry is nonempty. The current table correlation already grounds entries such as `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng ids `3202..3220`. When no table entry matches, the helper falls back to localized id `3866` `Could not find a translation table entry for '%1'`. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it sits directly above candidate field `[record+0x04]`, and several neighboring list and detail renderers that need one display label from the same stem family. | objdump + caller inspection + language-table correlation + static-table inspection + RT3.lng correlation |
| 405 | 0x0051d3c0 | 44 | calendar_point_pack_tuple_to_absolute_counter | support | fastcall | inferred | objdump + caller inspection + local arithmetic correlation | 3 | Tiny packed-calendar helper that converts one local tuple rooted at the caller pointer in `ECX` into the same absolute calendar counter family later stored at `[world+0x15]`. It reads one year word plus four packed calendar subfields from `[tuple+0x00/+0x02/+0x04/+0x05/+0x06]`, combines them as one mixed-radix `12 x 28 x 3 x 60` progression, and returns the resulting scalar for direct subtraction against `[0x006cec78+0x15]`. That is now the strongest current read for the world-side calendar model: a packed year-plus-subfield point converted into one absolute counter rather than a plain year or month stamp. Current grounded finance caller is the stock-issue cooldown gate inside `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, where it converts the current issue tuple at `[company+0x16b/+0x16f]` before comparing that scalar against the active world counter. | objdump + caller inspection + local arithmetic correlation + finance-cooldown correlation + world-calendar-counter correlation + mixed-radix decode |
| 406 | 0x0051d460 | 131 | calendar_point_unpack_absolute_counter_to_tuple | support | fastcall | inferred | objdump + caller inspection + local arithmetic correlation | 3 | Inverse packed-calendar helper for the absolute counter family rooted at `[world+0x15]`. It accepts one absolute calendar counter in `ECX`, decomposes it back into the same mixed-radix year-plus-subfield tuple, and returns the reconstructed pair of dwords in `EAX:EDX` for storage into fields such as `[world+0x0d]` and `[world+0x11]`. Current local arithmetic now bounds the inverse against the same `12 x 28 x 3 x 60` model as `0x0051d3c0`, which keeps this tuple in the world-side calendar-point family rather than as an unrelated packed timestamp. Current grounded callers are `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, which refreshes `[world+0x0d/+0x11]` from the selected absolute counter at `[world+0x15]`, plus the target-resolution wrappers `0x0051d550` and `0x0051d5f0` used by `simulation_advance_to_target_calendar_point` `0x0040ab50`. | objdump + caller inspection + local arithmetic correlation + world-calendar-tuple correlation + target-resolution correlation + mixed-radix decode |
| 407 | 0x004f2e80 | 14 | shell_has_live_overview_window | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Tiny presence probe for the shell-side `Overview.win` singleton rooted at `0x006d12bc`. The helper returns `1` when that live overview object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside other shell-window probes, and the overview family itself around `0x004f3a10`, which uses the same singleton to suppress duplicate opens. | objdump + caller inspection + nearby-family correlation + singleton correlation |
| 408 | 0x004f2e90 | 11 | shell_mark_overview_window_dirty | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Tiny dirty-latch setter paired with `shell_has_live_overview_window`. The helper stores `1` into `0x006d12cc`, which current nearby call patterns treat as the `Overview.win` refresh or service request latch once the live overview singleton at `0x006d12bc` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`. | objdump + caller inspection + nearby-family correlation + singleton correlation |
| 409 | 0x004f38a0 | 67 | shell_overview_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Constructs the shell-side `Overview.win` object later published at `0x006d12bc`. The constructor seeds the local vtable at `0x005d1368`, binds the shell window resource through `0x0053fa50`, clears the selected subject field at `[this+0x7c]`, and installs the shared control callback `0x004f3880` on control `0x88bf`. Current grounded caller is `shell_open_or_focus_overview_window` at `0x004f3a10`, and current string-table correlation leaves `Overview.win` as the strongest owner name for this singleton family. | objdump + caller inspection + strings correlation + singleton correlation |
| 410 | 0x004f38f0 | 562 | shell_overview_window_handle_message | shell | thiscall | inferred | objdump + caller inspection + control-flow inspection | 4 | Primary message dispatcher for the shell-side `Overview.win` family rooted at `0x006d12bc`. The handler processes the usual shell message ids `0`, `0xca`, and `0xcb`; uses the current subject object at `[this+0x78]`; opens follow-on detail lanes through `0x004f2ea0`; and raises simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when the requested drill-down path is currently invalid. It also consumes the family dirty latch at `0x006d12cc` on the recurring service path. Current grounded caller is the shell runtime after construction through `shell_open_or_focus_overview_window`. | objdump + caller inspection + control-flow inspection + dirty-latch correlation |
| 411 | 0x004f3a10 | 272 | shell_open_or_focus_overview_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Shared opener for the shell-side `Overview.win` singleton. When a valid overview subject exists under the live world-side owner at `0x006cea4c` and no current overview window is open, the helper allocates an `0x80`-byte shell object, constructs it through `shell_overview_window_construct` at `0x004f38a0`, publishes it through the shell runtime at `0x006d401c`, and stages the selected subject pointer into the live singleton at `0x006d12bc` before routing it into the family message path at `0x004f2ea0`. When an overview window already exists it leaves the current singleton in place. Current grounded callers include the world-side action branches at `0x004396ae` and `0x004414c6`, both of which pass one subject object resolved from `0x006cea4c` before opening the overview path. | objdump + caller inspection + strings correlation + singleton correlation + publish-path inspection |
| 412 | 0x004b99c0 | 88 | structure_candidate_collection_get_nth_active_candidate_id | map | cdecl | inferred | objdump + caller inspection + collection iteration | 4 | Returns the zero-based nth active candidate id from the structure-candidate collection at `0x0062ba8c`. The helper iterates the collection through `0x517cf0` and `0x518380`, skips candidates whose active byte in the returned record is clear, decrements the caller-supplied ordinal only across the surviving entries, and finally returns the matching candidate id or `0` when the requested active slot does not exist. Current grounded callers are the shell-side building-detail branches at `0x004ba01f`, `0x004bbcfd`, and `0x004bbd56`, where ordinals `page-3` are translated back into live candidate ids before the selected-building service and capability rows are refreshed. | objdump + caller inspection + collection iteration + active-candidate correlation |
| 413 | 0x004b9a20 | 833 | shell_building_detail_refresh_flagged_service_capability_rows | shell | thiscall | inferred | objdump + caller inspection + control-range inspection | 3 | Shared `BuildingDetail.win` refresh helper for the flagged service or capability row bands driven from the currently selected building subject at `0x006cfe04`. The helper repeatedly restyles controls in the `0x7d07..0x7d1c` range through `0x540120`, using route-entry flag byte `+0x28` from the selected building subject as the decision source. Current local control correlation now bounds that mask family more tightly than a generic bit consumer: `0x7d07/0x7d08` split the zero-versus-nonzero `0x30` mask, `0x7d11/0x7d12` split the bit-`0x20`-only case, `0x7d13/0x7d14` split the exclusive-or `0x20^0x10` case, `0x7d17/0x7d1a` track bit `0x20`, `0x7d18/0x7d1b` track bit-`0x10`-only, and `0x7d19/0x7d1c` track the combined `0x30` case. The later repeated row family rooted at `0x7f58..0x801f` also consults bit `0x40` together with the currently selected candidate or service id in subject field `+0x24`, but current evidence now narrows that lane too: it is a selected-ordinal highlight band rather than a generic restyle loop. The special express-side triplet at `0x7f58..0x7f5a` is the fixed table-driven branch; after that the helper falls through into the ordinary active-candidate/service rows. When the selected id is below `0x384`, the helper translates it through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0` and highlights ordinal `3 + active-candidate-rank` for the current subject id; otherwise it treats `0x384..` as the parallel express-side family directly. Current grounded callers include the broader building-detail refresh path at `0x004bae97`, the constructor-adjacent refreshes at `0x004bbcf3` and `0x004bbd0d`, and neighboring handler branches at `0x004bb8e3`, `0x004bbe5c`, and `0x004bc039`. Current evidence is therefore strong enough to treat this as the shared shell-side consumer of route-entry subflags `0x10`, `0x20`, and `0x40` even though the ordinary candidate-row captions still remain open. | objdump + caller inspection + control-range inspection + route-entry flag correlation + active-candidate correlation + control-family triplet correlation + row-mask partition correlation + selected-ordinal highlight correlation |
| 414 | 0x004ba3d0 | 2380 | shell_building_detail_refresh_subject_cargo_and_service_rows | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 3 | Large `BuildingDetail.win` refresh helper for the selected subject row families centered on controls `0x7d06`, `0x7d96..`, `0x7d0e`, and the adjacent `0x7d6a/0x7d6b` and `0x7d9d` visual lanes. The helper walks the selected building subject at `0x006cfe04`, iterates the per-subject id list rooted at `[subject+0x01]`, validates ordinary ids through the structure-candidate collection at `0x0062ba8c` with `indexed_collection_entry_id_is_live` `0x00517d40`, resolves them into concrete live candidate records through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then uses candidate field `[record+0x04]` as the shared stem for both the ordinary row asset path `%s.imb` and the neighboring display-label lookup through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. Only when that ordinary candidate branch fails does it fall back to the fixed express-side special ids `0x384..0x386`. Current table correlation now bounds that fixed branch more sharply: `0x00621df8` seeds the short-label controls `0x7dc8..0x7dca` with localized ids `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while `0x00621e10` seeds the adjacent asset-name controls `0x7e90..0x7e92` with `AnyCargo`, `AnyFreight`, and `PassMail` before `%1.imb` formatting. The helper also uses `Cargo.imb`, `Caboose.imb`, and the adjacent asset string `Dining.imb` while rebuilding the visible row payloads; current RT3.lng alignment now ties the longer descriptive popup/help side to `497/498` for freight/express and the two special service rows to localized labels `911` `Dining Car` and `912` `Caboose`. One resource-side boundary is tighter now too: the extracted `BuildingDetail.win` blob currently exposes only a sparse embedded text table with the help line `0xbb8`, the asset-name string `0xbb9`, and one standalone caption entry `0xbba` `Cargo`, which is the strongest current resource-side anchor for the row header around `0x7d06` and simultaneously reinforces that the deeper ordinary rows are being labeled from live candidate-record stems rather than from a larger hidden caption table. Current subflag correlation is tighter too: the extra visual lanes `0x7d6a`, `0x7d6b`, and `0x7d9d` are driven from the same selected-subject flag byte at `+0x28`, with `0x7d9d` on the bit-`0x20` branch using `Caboose.imb` and the sibling bit-`0x10` special lane using `Dining.imb`. The helper then re-enters both `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20` and the flagged-row helper `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current grounded callers include the main building-detail refresh at `0x004baedd`, constructor-adjacent and handler-side refreshes at `0x004bb8dc`, `0x004bbc89`, `0x004bbd6a`, and `0x004bc02b`. Current evidence is therefore strong enough to treat this as the selected-building cargo or service row owner even though several ordinary candidate-row captions remain unrecovered. | objdump + caller inspection + strings correlation + control-range inspection + candidate-id correlation + collection-helper correlation + stem-label correlation + subflag-row correlation + asset-string block correlation + RT3.lng correlation + table-entry correlation + win-resource extraction |
| 415 | 0x004ba270 | 311 | shell_building_detail_handle_subject_value_row_band_action | shell | cdecl | inferred | objdump + callsite inspection + local disassembly | 3 | Small `BuildingDetail.win` row-band action callback over the control-id family `0x7d07..0x7d14`. The helper switches on the clicked control id minus `0x7d07`, updates the selected building subject rooted at `0x006cfe04`, and treats subject bytes `+0x21`, `+0x22`, and `+0x23` as one current selection plus one bounded low/high pair. On change it increments the family dirty latch at `0x006cfe0c`, writes the refreshed current or bound value back through the shared shell control helper on code `0x66`, and when the side list helper at `0x006cfe08` is active it re-enters the neighboring follow-up refresh path at `0x004b9ec0`. Current direct installation site is the `0x7d0e` widget branch inside `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004bacc9`, which keeps this bounded as the live action owner for the paired value rows rather than another passive formatter. | objdump + callsite inspection + local disassembly + selected-subject field correlation |
| 416 | 0x004bad20 | 461 | shell_building_detail_refresh_subject_pair_value_rows | shell | thiscall | inferred | objdump + caller inspection + control-range inspection | 3 | Shared `BuildingDetail.win` helper for the mutually exclusive subject-value row pairs around controls `0x7d05..0x7d14`. The helper first styles the leading pair `0x7d05/0x7d06`, then chooses between the value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and `0x7d13/0x7d14` from the selected building subject at `0x006cfe04`, using the same flag byte at `+0x28` that drives the neighboring cargo or service rows. On the nonzero selector branch it instead refreshes the current-selection status around `0x7d0d/0x7d0e` from the subject count byte and the subject field at `+0x21`, then tails back into `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`. Current payload values for the mutually exclusive pairs come from subject fields `+0x22` and `+0x23`, and current grounded caller correlation keeps this bounded as one shared pair-value row owner rather than a separate top-level widget family. | objdump + caller inspection + control-range inspection + subject-field correlation + flag-branch correlation |
| 417 | 0x004b9d70 | 14 | shell_has_live_building_detail_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Tiny presence probe for the shell-side `BuildingDetail.win` singleton rooted at `0x006cfe00`. The helper returns `1` when that live detail object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, load-screen, settings, custom-modal, and file-options probes. | objdump + caller inspection + strings correlation + singleton correlation |
| 418 | 0x004b9d80 | 11 | shell_mark_building_detail_window_dirty | shell | cdecl | inferred | objdump + caller inspection + nearby-family correlation | 4 | Tiny dirty-latch setter paired with `shell_has_live_building_detail_window`. The helper stores `1` into `0x006cfe10`, which current nearby call patterns treat as the `BuildingDetail.win` refresh or service request latch once the live singleton at `0x006cfe00` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`. | objdump + caller inspection + nearby-family correlation + singleton correlation |
| 419 | 0x004b9e10 | 166 | shell_building_detail_submit_aux_owner_subject_sync_request | shell | cdecl | inferred | objdump + caller inspection + state-block inspection | 3 | Small side-owner sync helper for `BuildingDetail.win`. When the auxiliary owner at `0x006cd8d8` is present and the local dirty counter `0x006cfe0c` is nonzero, the helper allocates a `0x3f`-byte request block, stamps a small header through `0x005216c0` and `0x00513130`, stores one mirrored-subject mode bit in request word `+0x08`, stores the current building-detail ordinal from `0x00621df4`, then copies the full staged building subject record from `0x006cfe04` into the request body before queueing it through `0x00469d30` on the owner-local request list at `[0x006cd8d8+0x8f48]`. Current direct callers are the `0x7d01` and `0x7d09/0x7d0a` branches inside `shell_building_detail_window_handle_message` `0x004bb9e0`, and both now clearly source that mode bit from the side-list mirror latch at `[0x006cfe08+0x0c]`, which keeps this bounded as an auxiliary-owner subject-sync path that preserves local mirror-state rather than a generic widget refresh. The helper also currently suppresses submission when the neighboring live-flag dword at `0x006d3ae4` is nonzero. | objdump + caller inspection + state-block inspection + side-owner queue correlation + mirror-latch correlation |
| 420 | 0x004b9ec0 | 272 | shell_building_detail_propagate_selected_subject_state_into_side_list | shell | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Shared follow-up helper for `BuildingDetail.win` when the sibling side-list owner at `0x006cfe08` is active and its mirror latch at `+0x0c` is nonzero. The helper walks every indexed side-list subject through `0x004b2b60`, copies the currently selected subject state from `0x006cfe04` into each sibling record, mirrors the current service or capability id at `[subject+0x24]`, and propagates the mutable subflag family in byte `+0x28` with bits `0x40`, `0x20`, and `0x10` preserved from the active subject. It also copies the current-selection fields `+0x21/+0x22/+0x23` and the live id list rooted at `+0x01`, which is why the paired value-row action helper at `0x004ba270` and several handler-side selector branches re-enter this path after mutating the active subject. Current grounded callers are `shell_building_detail_handle_subject_value_row_band_action` at `0x004ba270` and the handler-side refresh branches at `0x004bbc9d`, `0x004bbd81`, and `0x004bbe55`. | objdump + caller inspection + local disassembly + selected-subject field correlation + side-list iteration correlation + mirror-latch correlation |
| 421 | 0x004b9fd0 | 672 | shell_building_detail_present_flagged_service_capability_popup | shell | cdecl | inferred | objdump + caller inspection + local disassembly | 3 | Popup callback installed on the larger `BuildingDetail.win` flagged-row band. The helper takes one clicked control id in the `0x7f58..0x801f` family, resolves either one fixed express-side descriptor from table `0x00621e04` for the first three rows or one active candidate/service id from the selected subject at `0x006cfe04+0x24`, and then formats an explanatory shell popup before returning through `0x538c70`. Current table correlation now closes that first triplet more cleanly: `0x00621e04` supplies localized ids `494`, `497`, and `498`, so the fixed popup/help branch is specifically `Any Cargo`, `Any Freight\\n(Freight is everything but Passengers, Mail, and Troops)`, and `Any Express\\n(Express is Passengers, Mail, and Troops)` for controls `0x7f58..0x7f5a`. Current language-table correlation also tightens the ordinary popup split: one single-line availability popup uses localized id `3922` `%1\\nLoads available at %2: %3`, while the ordinary candidate branch uses localized id `2981` `%1\\nLoads available at %2: %3 Current Price: %4` and can append localized id `2982` `Price at next station, %1: %2 (%3%4)`. On that ordinary branch it resolves the current candidate through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0`, compares the selected site against the current subject site at `+0x29`, queries local service metrics through `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and conditionally computes the nearby-site delta line before presenting the final text. Current direct installation sites are the callback-registration branches at `0x004bb43f` and `0x004bb8a6`, which keeps this bounded as the live explanatory popup owner for the `0x7f58..0x801f` selector rows rather than another passive formatter. | objdump + caller inspection + local disassembly + callback-registration correlation + popup-path correlation + candidate-metric correlation + RT3.lng correlation + table-entry correlation |
| 422 | 0x004bb9e0 | 2183 | shell_building_detail_window_handle_message | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Primary message dispatcher for the shell-side `BuildingDetail.win` family rooted at `0x006cfe00`. The handler switches over shell messages `0`, `0xca`, and `0xcb`; updates the staged building subject in `0x006cfe04` and its list helper at `0x006cfe08`; refreshes the visible control ranges `0x7d..0x8051`; and consumes the dirty latch at `0x006cfe10` on the recurring service path. Its action cases are now tighter than a generic navigation bucket. The `0x7d01` branch is no longer just an isolated oddball either: extracted `BuildingDetail.win` text now makes `Set the initial cargo amount for 'Disable Cargo Economy' scenarios.` the strongest current caption candidate for that control, the message path can mirror that action through `shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner live, and one later rejection path now clearly raises localized id `3587` `This option is only available by following the tutorial.` behind the active tutorial flag at `0x006d3b4c` plus the cached previous expected-control id at `0x00622b38`. The `0x7d02/0x7d03` pair flips selected-subject bit `0x40` and re-enters `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20`, which makes that pair the real top-level mode switch between the bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`. The `0x7d09/0x7d0a` pair steps neighboring building subjects through `0x004b2b60`, skipping disallowed subjects on the local iteration path, and the same branch can also mirror the new selected subject through `0x004b9e10` when that auxiliary owner is present. The `0x7d0f/0x7d10` pair flips selected-subject bits `0x20` and `0x10`, i.e. the same special-service subflags later rendered as `Caboose` and `Dining Car`, and then re-clamps the paired value widgets through the same shared refresh path. The `0x7f58..0x801f` selector band changes the current service or capability id at `[subject+0x24]` before re-entering `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20`; current refresh-side correlation now shows that band as one selected-ordinal picker over three fixed express rows plus the ordinary active-candidate rows rather than an undifferentiated list. The `0x8020..0x8051` action band is now tighter too: it is primarily a per-row removal family over the selected subject's live id list rooted at `+0x01`, zeroing one indexed entry, compacting the remaining dword ids, decrementing count byte `+0x00`, clamping the current-selection byte `+0x21`, and then refreshing the visible row bands. Two special row indices inside that same band re-route into the adjacent `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction when the current `0x20/0x10` service-bit state requires it. The handler can also open simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when one building-side action is disallowed. Current grounded callers are the shell runtime after construction and the explicit dirty-latch service path. | objdump + caller inspection + strings correlation + control-range inspection + dirty-latch correlation + selected-subject mutation correlation + RT3.lng correlation + selected-ordinal correlation + remove-entry compaction correlation + auxiliary-owner sync correlation + tutorial-rejection correlation + expected-control-cache correlation |
| 423 | 0x004baef0 | 2793 | shell_building_detail_window_refresh_controls | shell | thiscall | inferred | objdump + caller inspection + control-range inspection | 4 | Primary refresh path for the shell-side `BuildingDetail.win` family. The helper rebuilds the top-level control bands under `0x7d02..0x8051`, including the paired mode switch `0x7d02/0x7d03` from subject flag `0x40`, the smaller special-service toggles `0x7d0f/0x7d10` from subject bits `0x20` and `0x10`, the current-selection status widget around `0x7d0d/0x7d0e`, the selected-building cargo or service rows through `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`, the paired subject-value rows through `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20`, and the flagged service or capability rows through `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current control-building correlation now makes the leading special-row bands explicit too: the short-label triplet `0x7dc8..0x7dca`, its adjacent asset/icon triplet `0x7e90..0x7e92`, and the popup/selectable triplet `0x7f58..0x7f5a` are the fixed express-side branch before the broader ordinary candidate rows. Current branch structure is tighter too: when subject bit `0x40` is set the refresh ends on the selected-subject cargo/service family rooted at `0x004ba3d0`, while the clear branch instead ends on the flagged capability-selector family rooted at `0x004b9a20`. It also hides or shows the larger control ranges `0x7dc8..0x7f57`, `0x7f58..0x801f`, and `0x8020..0x8051` through the shared shell control toggles at `0x53fe00`. Current grounded callers are the main constructor-side and focus refreshes at `0x004bbace`, `0x004bc0cc`, and `0x004bc0de`, and the message dispatcher at `0x004bb9e0`. | objdump + caller inspection + control-range inspection + subject-flag correlation + helper-family correlation + branch-end correlation + control-family triplet correlation |
| 424 | 0x004bc0a0 | 71 | shell_building_detail_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings correlation | 4 | Constructs the shell-side `BuildingDetail.win` object later published at `0x006cfe00`. The constructor seeds the local vtable at `0x005d05e0`, binds the window resource through `0x0053fa50`, and immediately refreshes the visible subject and control bands through `0x004baef0`. Current grounded caller is `shell_open_or_focus_building_detail_window` at `0x004bc100`, and current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family. | objdump + caller inspection + strings correlation + singleton correlation |
| 425 | 0x004bc100 | 203 | shell_open_or_focus_building_detail_window | shell | cdecl | inferred | objdump + caller inspection + strings correlation | 4 | Shared opener for the shell-side `BuildingDetail.win` singleton. The caller supplies the building-detail list helper in `ECX`, one current building subject in `EDX`, and one selected ordinal on the stack. The helper seeds the shared family globals at `0x006cfe04`, `0x006cfe08`, and `0x00621df4`, validates that the supplied building subject resolves to one live world object through the placed-structure collection at `0x006cec20`, allocates a `0x78`-byte shell object when no detail window is live, constructs it through `shell_building_detail_window_construct` at `0x004bc0a0`, publishes it through the shell runtime at `0x006d401c`, and tears it back down on return while clearing `0x006cfe00`. Current grounded callers include the world-side branch around `0x004bbace`, which updates the current building subject before opening this detail family. Current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family. | objdump + caller inspection + strings correlation + publish-path inspection + singleton correlation |
| 426 | 0x004bcdd0 | 352 | shell_change_trees_window_construct | shell | thiscall | inferred | objdump + strings + detail-manager correlation | 4 | Constructs the shell-side `ChangeTrees.win` tool window. The constructor installs vtable `0x005d06bc`, binds `ChangeTrees.win` through `0x0053fa50`, seeds the current ordinal and paired scalar lanes from globals `0x00621ec0..0x00621ec8`, formats the visible scalar caption through `0x0051f070` and `0x00527de0`, copies one localized six-row label table from `0x005ef3ec`, stores the live singleton at `0x006cfe18`, and then refreshes the visible selection band through `0x004bccd0`. Current grounded caller is the detail-panel manager branch at `0x004ddf32`, which keeps this on the shell tool-window side rather than the larger company- or station-detail lanes. | objdump + strings + detail-manager correlation + control-table correlation + singleton correlation |
| 427 | 0x004bcc20 | 50 | shell_change_trees_window_select_scalar_and_refresh_caption | shell | thiscall | inferred | objdump + message-owner inspection + caption-table correlation | 4 | Small `ChangeTrees.win` setter for the scalar selection lane. The helper stores the requested scalar ordinal in `[this+0x78]`, looks up one float caption value through table `0x00621ecc`, converts that value into shell text through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`, and returns without touching the broader row bands. Current grounded caller is the message owner `0x004bcf30`, where controls `0x1389..0x138f` forward through this helper before the wider control refresh runs. | objdump + message-owner inspection + caption-table correlation + shell-presenter correlation |
| 428 | 0x004bcc60 | 80 | shell_change_trees_window_select_four_state_mode_and_publish_group_event | shell | thiscall | inferred | objdump + message-owner inspection + shell-presenter correlation | 4 | Small `ChangeTrees.win` mode selector beneath the broader control refresh. The helper stores the requested `0..3` value in `[this+0x84]` and then publishes one grouped selector event through `0x0053f000` on presenter `0x00ccbb20`: mode `0` maps to event `0x16`, mode `1` maps to `0x07`, mode `2` maps to `0x01`, and mode `3` currently falls through without publishing an event. Current grounded callers are the constructor `0x004bcdd0` and the message owner `0x004bcf30`, which keeps this as a shell-side mode-group selector rather than a world brush mutation path. | objdump + message-owner inspection + shell-presenter correlation + constructor correlation |
| 429 | 0x004bccd0 | 250 | shell_change_trees_window_refresh_control_bands | shell | thiscall | inferred | objdump + constructor correlation + message-owner inspection | 4 | Refreshes the visible row bands for the shell-side `ChangeTrees.win` family. The helper walks five grouped control strips and republishes them through `0x00540120` with the standard selected-vs-unselected style split `0x87/0x65`: the scalar strip `0x1389..0x138f` from `[this+0x78]`, the sibling strip `0x13ed..0x13f3` from `[this+0x80]`, the third strip `0x1451..0x1457` from `[this+0x7c]`, the four-state strip `0x14b5..0x14b8` from `[this+0x84]`, and the larger localized row band `0x139c..0x13b7` from `[this+0x8c]`. Current grounded callers are the constructor `0x004bcdd0` and the message owner `0x004bcf30`, which makes this the current owner-side refresh pass for `ChangeTrees.win` rather than one generic tree-paint helper. | objdump + constructor correlation + message-owner inspection + control-band correlation |
| 430 | 0x004bcf30 | 924 | shell_change_trees_window_handle_message | shell | thiscall | inferred | objdump + constructor correlation + caller inspection | 4 | Primary message dispatcher for the shell-side `ChangeTrees.win` tool window. Under message `0xc8`, controls `0x1389..0x138f` update the scalar lane through `shell_change_trees_window_select_scalar_and_refresh_caption` `0x004bcc20`, controls `0x13ed..0x13f3` update `[this+0x80]` and global `0x00621ec4`, controls `0x1451..0x1457` update the paired row lane through `0x004bcc60` and global `0x006cfe1c`, and controls `0x139c..0x13b7` update the larger localized row-band selection in `[this+0x8c]` and `0x006cfe20`; each of those branches re-enters `shell_change_trees_window_refresh_control_bands` `0x004bccd0`. Control `0x07d6` owns the shared world-surface latch `[this+0x88]`: it arms the latch after the standard hit-test gate `0x00448ac0`, snapshots anchor coords in `[this+0x90/+0x94]`, and then enters the broader brush-distance/math branch rooted at `0x004bd083`. Current grounded owner correlation is the constructor `0x004bcdd0` and the live shell message flow, which keeps this on the `ChangeTrees.win` tool-window side of the shared world-surface family rather than a generic terrain-detail page. | objdump + constructor correlation + caller inspection + world-surface latch correlation + control-band correlation |
| 431 | 0x004bc210 | 67 | shell_world_surface_brush_set_selected_ordinal_and_refresh_scalar_caption | shell | thiscall | inferred | objdump + caller inspection + local disassembly | 3 | Small setter beneath the shell world-surface brush family. The helper stores the caller-selected ordinal into `[this+0x78]`, resolves the corresponding dword from table `0x00621e24`, converts that value into a float caption through `0x0051f070` and `0x00527de0` under shell owner `0x006d4024`, and returns. Current grounded caller is the `0x0fa0..0x0fa7` ordinal-strip branch inside `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the selected-ordinal setter plus scalar-caption refresh rather than a generic text helper. | objdump + caller inspection + local disassembly + ordinal-strip correlation + scalar-caption correlation |
| 432 | 0x004bc260 | 43 | shell_world_surface_brush_query_cached_world_coords_and_selected_scalar | shell | thiscall | inferred | objdump + local disassembly + field correlation | 2 | Tiny cached-parameter getter beneath the same shell world-surface brush family. The helper copies cached world coordinates `[this+0x80]` and `[this+0x84]` into the two caller out-pointers and returns the current selected scalar from table `0x00621e24[ordinal]`, where the ordinal is stored at `[this+0x78]`, through the third out-pointer. Current local field correlation keeps this bounded as the brush-family cached-parameter query rather than a generic subject getter. | objdump + local disassembly + field correlation + ordinal-table correlation |
| 433 | 0x004bc290 | 192 | shell_world_surface_brush_refresh_ordinal_and_mode_button_rows | shell | thiscall | inferred | objdump + caller inspection + control-family correlation | 3 | Shared control refresh helper for the shell world-surface brush family. The first loop restyles the ordinal strip `0x0fa1..0x0fa7` through `0x00540120`, highlighting the current selected ordinal at `[this+0x78]`. The second loop restyles the mode strip `0x0faa..0x0faf` by mapping the current mode dword `[0x006d0818+0x8c]` from `0x0e..0x13` into local indices `0..5` and highlighting the matching button through the same shell control helper. Current grounded callers are the ordinal-strip branch at `0x004bc3fc` and the mode-change path beneath `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the ordinal and mode button-row refresh owner rather than a generic widget restyler. | objdump + caller inspection + control-family correlation + ordinal-mode-strip correlation |
| 434 | 0x004bc350 | 1496 | shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf | shell | thiscall | inferred | objdump + local disassembly + control-family correlation | 3 | Shell-side message owner for one world-surface brush family whose current grounded controls are the shared main-world surface `0x07d6`, the ordinal strip `0x0fa0..0x0fa7`, and the mode buttons `0x0faa..0x0faf`. The `0x07d6` branch first resolves world coordinates through `0x00448ac0`, latches drag-active byte `[this+0x7c]`, stores the accepted world coordinate pair into `[this+0x80/+0x84]`, and caches the incoming scalar at `[this+0x88]`. When that latch is active, the helper dispatches the current mode dword `[0x006d0818+0x8c]` across six grounded edit branches: mode `0x0e` and `0x13` re-enter `world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias` `0x0044da70`; mode `0x0f` re-enters `world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate` `0x0044d4e0`; modes `0x10` and `0x11` re-enter `world_raise_companion_float_grid_toward_center_sample_in_rect` `0x0044d880`; and mode `0x12` toggles the secondary-raster low nibble through `world_secondary_raster_xor_cell_byte2_low_nibble_mask` `0x00448e20` before re-entering `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`. The same owner also routes the ordinal strip `0x0fa0..0x0fa7` through `0x004bc210/0x004bc290` and updates the shared brush ordinal at `0x00621e20`, while the mode buttons `0x0faa..0x0faf` dispatch `0x004ddbd0` with mode ids `0x0e..0x13`. Current evidence is strong enough to treat this as a shell world-surface brush and mode dispatcher even though the exact window-family resource name is still open. | objdump + local disassembly + control-family correlation + world-surface correlation + brush-mode correlation |
| 435 | 0x004384d0 | 570 | world_run_post_load_generation_pipeline | map | cdecl | inferred | objdump + strings + caller xrefs | 4 | Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first runs the preliminary candidate-availability prepass at `0x00437743` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection pass `world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`. | objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation |
| 436 | 0x00437743 | 93 | world_preseed_named_candidate_availability_records_from_live_pool | map | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The helper iterates the live candidate pool at `0x0062b268` in reverse order, derives one small boolean mode from candidate bytes `[candidate+0xba]` and `[candidate+0x32]`, and then re-enters `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on the active scenario state `0x006cec78` using the candidate name at `+0x04`. The whole pass is skipped once global threshold `0x00620e94` reaches `0x26ad`. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass rather than another visible progress phase. | objdump + local disassembly + caller correlation + candidate-pool correlation |
| 437 | 0x00438890 | 644 | shell_active_mode_run_profile_startup_and_load_dispatch | map | thiscall | inferred | objdump + caller xrefs + debugger comparison | 4 | Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, posts several shell progress or status updates through `0x5193f0/0x540120`, enumerates one shell-managed list off `0x006d4020+0x429b0`, and then switches over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438a66..0x00438c00` that first refreshes one support-family type-`7` record from setup path buffer `0x006d1370` through `global_banked_type7_record_refresh_from_openable_path_basename_and_stem` `0x0053d130`, strips the basename extension into a local label buffer, briefly drops the nested mouse-cursor selection hold through `0x0053f310`, builds three progress-text payloads, re-enters the hold through `0x0053f2f0`, and only then allocates `0x0062c120` when absent, runs `0x0044faf0`, and forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(0, 0)` immediately after dismissing the current detail panel and servicing `0x004834e0(0, 0)`. `0x0046b8bc` remains the distinct multiplayer-preview relaunch owner, also entering as `(0, 0)` before a later staged `0x00445ac0` call. | objdump + caller xrefs + manual-load breakpoint comparison + owner-tail disassembly + caller-shape comparison + selector-jump-table decode + tutorial-string correlation + selector-writer correlation + selector2-support-record correlation + cursor-hold choreography correlation |
| 438 | 0x00435603 | 10 | scenario_state_ensure_derived_year_threshold_band | map | thiscall | inferred | objdump + local disassembly + caller correlation | 3 | Tiny guard wrapper over one derived scenario-state year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. When the small mode or threshold byte at `[this+0x3a]` is already `>= 2` the helper returns immediately; otherwise it falls back into the heavier rebuild body at `0x004351c0`, which refreshes those companion thresholds from the current year and shell-controller-side values before continuing. Current grounded callers are the post-fast-forward selected-year tail at `0x00437170`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, the compact runtime-effect side branch at `0x00431e03`, and the shell-command lane at `0x004661c0/0x004661e9`, so this is the safest current read for the small year-threshold ensure wrapper rather than a generic boolean probe. | objdump + local disassembly + caller correlation + year-threshold-band correlation |
| 439 | 0x00435630 | 648 | scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables | map | thiscall | inferred | objdump + caller xrefs + state-layout inspection | 4 | Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book payload at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared maximum annual production float that precedes the first line, counts active lines across five repeated `0x30`-byte line records, and then imports those five lines into one parallel runtime array of `0xbc`-byte descriptors. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves nonempty cargo strings through the global cargo collection at `0x0062ba8c`, and builds paired runtime halves for the mode families `2/3` and `1/3`. Current mode gating is now tight enough to treat the polarity as grounded rather than provisional: the source token at `line+0x08` is the supplied-cargo field because it is the branch activated for `Supply Only` and `Production Demand->Supply`, while the source token at `line+0x1c` is the demanded-cargo field because it is the branch activated for `Demand Only` and `Production Demand->Supply`. The constructor and handler now tighten the amount semantics too: `line+0x04` is the per-line annual-demand field only in mode `1`, but it becomes the annual-supply field in modes `2/3`. The importer matches that split by copying `line+0x04` directly into the supply-side runtime half for modes `2/3`, while the production-mode demand half is normalized to `1.0` rather than reusing the entered amount. That makes the five editor-side row entries look like generic cargo-line slots rather than five fixed named production roles. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`. | objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation |
| 440 | 0x00437b20 | 218 | simulation_run_chunked_fast_forward_burst | simulation | thiscall | inferred | objdump | 3 | Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `0x006cec74+0x178` and active-mode flag `[0x006cec78+0x4af7]`, then repeatedly advances the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path. | objdump + caller context + RT3.lng strings + phase ordering |
| 441 | 0x00434680 | 435 | world_set_game_speed_mode | simulation | thiscall | inferred | objdump + strings | 3 | Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.` | objdump + RT3.lng strings + multiplayer handoff |
| 442 | 0x00434850 | 19 | world_adjust_game_speed_mode_delta | simulation | thiscall | inferred | objdump | 3 | Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled. | objdump + callee inspection |
| 443 | 0x004338c0 | 12 | shell_mode_gate_is_active | shell | cdecl | inferred | objdump + local disassembly + caller correlation | 3 | Tiny boolean wrapper over the shell-side gate at `0x006d07b4`. The helper simply forwards `0x004d4150`, normalizes the result to `0/1`, and returns. Current grounded callers use it as a coarse mode gate before trusting several scenario-side and runtime-object fields, including the flag-byte readers at `0x0041f910`, `0x00461500`, and `0x00474430`, plus broader world or shell-side branches such as `0x004197e0`, `0x00440e4d`, and `0x0044ccdc`. The exact player-facing owner of `0x006d07b4` is still open, so the safest current name stays structural around one active shell-mode gate. | objdump + local disassembly + caller correlation + gate reuse correlation |
| 444 | 0x00433790 | 8 | scenario_state_set_selected_chairman_company_id | map | thiscall | inferred | objdump + global-state inspection + caller correlation | 4 | Tiny raw setter over the shell-side scenario state object at `0x006cec78`. The helper stores the caller-supplied company id directly into `[this+0x21]` and returns. Current grounded callers are the company and chairman reassignment flows at `0x00426dd4`, `0x00427d06`, `0x00427d93`, and the startup-company seeding or rotation paths around `0x0047d282`, `0x0047d409`, and `0x0047d609`, where it keeps the raw selected-company summary in sync with later chairman or ownership changes. This is therefore the direct id-level companion to the higher record accessor `scenario_state_get_selected_chairman_company_record` `0x00434870` rather than a broader state mutator. | objdump + global-state inspection + caller correlation + selected-company-summary correlation |
| 445 | 0x004337a0 | 4 | scenario_state_get_selected_chairman_company_id | map | thiscall | inferred | objdump + global-state inspection + caller correlation | 4 | Tiny raw getter over the shell-side scenario state object at `0x006cec78`. The helper returns company id field `[this+0x21]` directly without resolving it through the live company collection. Current grounded callers include the linked-site status formatter `0x0040e4e0`, the company or chairman reassignment families around `0x00426dd4`, `0x004427aac`, and `0x0047d462`, the startup-company seeding branches around `0x0047d4ed`, and many shell-side overview or ledger renderers that compare the current row against the scenario-selected company before choosing text or style. This is therefore the raw selected-company-id accessor beneath the higher record resolver `scenario_state_get_selected_chairman_company_record` `0x00434870`. | objdump + global-state inspection + caller correlation + selected-company-summary correlation |
| 446 | 0x004337b0 | 4 | scenario_state_get_selected_chairman_profile_id | map | thiscall | inferred | objdump + global-state inspection + caller correlation | 4 | Tiny raw getter over the shell-side scenario state object at `0x006cec78`. The helper returns chairman profile id field `[this+0x25]` directly without resolving it through the global persona collection. Current grounded callers include the company-detail and load-screen style selectors, chairman rotation or reassignment branches around `0x00427cf4`, `0x00427d80`, `0x004295ef`, and `0x0047d3f9`, and many shell-side renderers that compare the current row's linked chairman against the scenario-selected chairman before choosing visible styling. This is therefore the raw selected-chairman-profile-id accessor beneath the higher record resolver `scenario_state_get_selected_chairman_profile_record` `0x004348c0`. | objdump + global-state inspection + caller correlation + selected-chairman-summary correlation |
| 447 | 0x00433900 | 160 | shell_world_view_center_on_object_with_mode_specific_zoom_policy | shell | cdecl | inferred | objdump + caller xrefs + local disassembly | 3 | Mode-aware world-view centering helper above the live world-view owner at `0x0062be68`. The helper takes one object pointer plus one small mode argument. Except for the early mode-`2` no-op path, it first refreshes shell control `0x7922`, derives one `(distance,height)` preset from the target object's virtual classification through slots `+0x70`, `+0x6c`, and `+0x28`, optionally overrides that preset for mode `1`, and then re-enters `world_view_center_on_runtime_object` `0x0043c9a0` with the chosen preset and object pointer. Current grounded callers include the shell station and company list modifier paths, several detail-panel and window-side center actions, the tutorial or event-follow branches around `0x00435b2d` and `0x0044c75e`, and broader shell-side center helpers around `0x00505e0c`, `0x005060f7`, and `0x0051486b`. This is therefore the shared shell-facing center-on-object helper with one caller-selected zoom-policy mode rather than a station-only centering path. | objdump + caller xrefs + local disassembly + world-view-center correlation |
