start	end	status	object_id	object_name	c_type	initialization	evidence	notes
1028:0311	1028:0311	verified	alignment_0311	g_alignment_0311	const uint8_t	Static zero byte between independently terminated high-score strings.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte string-table alignment/reserve.
1028:0335	1028:0335	verified	alignment_0335	g_alignment_0335	const uint8_t	Static zero byte between independently terminated high-score strings.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte string-table alignment/reserve.
1028:0395	1028:0395	verified	alignment_0395	g_alignment_0395	const uint8_t	Static zero byte between the HighScore title and version-error text.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte string-table alignment/reserve.
1028:0459	1028:0459	verified	alignment_0459	g_alignment_0459	const uint8_t	Static zero separator between WAV and pal resource-type strings.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte resource-string separator.
1028:0561	1028:0561	verified	alignment_0561	g_alignment_0561	const uint8_t	Static zero before the packed WNDCLASS16 object.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte WNDCLASS alignment.
1028:0585	1028:0585	verified	alignment_0585	g_alignment_0585	const uint8_t	Static zero between TPWinCrt class name and HWND state.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte runtime-state alignment.
1028:066b	1028:066b	verified	alignment_066b	g_alignment_066b	const uint8_t	Static zero between dialog template byte and thunk selector.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte ObjectWindows alignment.
1028:068b	1028:068b	verified	alignment_068b	g_alignment_068b	const uint8_t	Static zero between thunk opcode template and TurboWindow class string.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte ObjectWindows separator.
1028:06f3	1028:06f3	verified	alignment_06f3	g_alignment_06f3	const uint8_t	Static zero between focus marker and heap-reserve size.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte runtime alignment.
1028:06fb	1028:06fb	verified	alignment_06fb	g_alignment_06fb	const uint8_t	Static zero between heap-reserve flags and WinMain instance words.	Exact binary byte; zero readers, writers, and relocations; complete verified referring-function closure	Explicit one-byte startup-state alignment.
1028:076c	1028:07be	verified	reserved_runtime_to_game_state	g_reserved_runtime_to_game_state	uint8_t[83]	Zero-fill gap between the 36-byte application object and Windows-version/game-state globals.	Complete reference, relocation, and defined-data inventories contain no address in the range; complete verified referring-function closure	Explicit unreferenced runtime/game-state reserve; all 83 bytes remain zero in-image.
1028:07c3	1028:07c3	verified	alignment_07c3	g_alignment_07c3	uint8_t	Zero-fill byte between Windows-version dword and palette-update state.	Complete zero-reader/zero-writer/zero-relocation inventory; complete verified referring-function closure	Explicit one-byte game-state alignment.
1028:4335	1028:43bd	verified	reserved_asset_to_wave_state	g_reserved_asset_to_wave_state	uint8_t[137]	Zero-fill gap between bitmap-handle tables and WAVEOUTCAPS16.	Complete reference, relocation, and defined-data inventories contain no address in the range; complete verified referring-function closure	Explicit unreferenced asset/sound reserve; all 137 bytes remain zero in-image.
1028:4785	1028:4789	verified	multimedia_state_alignment	g_multimedia_state_alignment	uint8_t[5]	Zero-fill gap between multimedia initialized byte and stored Windows version.	Complete zero-reader/zero-writer/zero-relocation inventory; complete verified referring-function closure	Explicit five-byte multimedia state alignment/reserve.
1028:486c	1028:486c	verified	multimedia_path_separator_486c	g_multimedia_path_separator_486c	uint8_t	Zero-fill byte between 200-byte system-directory buffer and CTL3D full-path buffer.	Complete zero-reader/zero-writer/zero-relocation inventory; complete verified referring-function closure	Explicit one-byte path-buffer separator.
1028:4a6d	1028:4a6d	verified	tpwincrt_separator_4a6d	g_tpwincrt_separator_4a6d	uint8_t	Zero-fill byte between CTL3DV2 full-path buffer and TPWinCrt title.	Complete zero-reader/zero-writer/zero-relocation inventory; complete verified referring-function closure	Explicit one-byte unit-state separator.
1028:4b38	1028:4d37	verified	tpwincrt_reserved_tail	g_tpwincrt_reserved_tail	uint8_t[512]	Zero-fill tail after the 64-byte TPWinCrt input queue and before Borland heap request state.	Complete reference, relocation, and defined-data inventories contain no address in the range; complete verified referring-function closure	Explicit unreferenced TPWinCrt/unit reserve; all 512 bytes remain zero in-image.
1028:0000	1028:000f	verified	compiler_data_prefix	g_compiler_data_prefix	const uint8_t[16]	Static exact bytes 00 00 00 00 05 00 followed by ten zero bytes; no relocation or direct reference.	Binary bytes plus complete zero-reader/zero-writer inventory; complete verified referring-function closure	Explicit compiler/module data prefix retained byte-for-byte; no semantic consumer exists in the image.
1028:006c	1028:009d	verified	main_window_dynamic_dispatch	g_main_window_dynamic_dispatch	const uint8_t[50]	Static 22-byte Borland dynamic-message descriptor followed by seven relocated far entry points.	Exact bytes and relocations at 0082..009a to entry ordinals 8..14; all targets and dispatcher verified; complete verified referring-function closure	Complete main-window dynamic dispatch descriptor, preserved separately from the VMT at 009e.
1028:009e	1028:00ed	verified	main_window_vmt	g_main_window_vmt	const uint8_t[80]	Static TWindow-derived VMT header plus eighteen relocated far methods.	Constructor uses VMT 009e; exact relocations 00a6..00ea; all method targets/window paths verified; complete verified referring-function closure	Exact main game-window VMT extent from size/header through final virtual slot.
1028:00ee	1028:010d	verified	highscore_dynamic_dispatch	g_highscore_dynamic_dispatch	const uint8_t[32]	Static 16-byte Borland dynamic-message descriptor followed by four relocated far entry points.	Exact bytes and relocations 00fe..010a to entry ordinals 20..23; high-score window behavior verified; complete verified referring-function closure	Complete dynamic dispatch descriptor paired with the verified high-score VMT at 010e.
1028:015e	1028:017d	verified	full_child_dynamic_dispatch	g_full_child_dynamic_dispatch	const uint8_t[32]	Static 16-byte Borland dynamic-message descriptor followed by four relocated far entry points.	Exact bytes and relocations 016e..017a to entry ordinals 29..32; full-child handlers verified; complete verified referring-function closure	Complete dynamic dispatch descriptor for the full-size child/help window class.
1028:017e	1028:01cd	verified	full_child_window_vmt	g_full_child_window_vmt	const uint8_t[80]	Static TWindow-derived VMT header plus eighteen relocated far methods.	Constructors use VMT 017e; exact relocations 0186..01ca; all window targets verified; complete verified referring-function closure	Exact full-child/help window VMT from object size/header through final paint/message slot.
1028:01ce	1028:0221	verified	text_dialog_vmt	g_text_dialog_vmt	const uint8_t[84]	Static dialog-derived VMT header plus nineteen relocated far methods.	High-score editor constructs VMT 01ce; exact relocations 01d6..021e; dialog lifecycle verified; complete verified referring-function closure	Exact modal text-dialog VMT including dialog-specific terminal slots 225 and 226.
1028:0470	1028:0521	verified	ctl3d_procedure_name_table	g_ctl3d_procedure_name_table	const uint8_t[178]	Eleven adjacent NUL-terminated CTL3D export names in exact GetProcAddress order.	Binary string units; verified 1010:01c2 loader resolves slots zero through ten and tests assert every name; complete verified referring-function closure	Exact symbol table from CTL3DAUTOSUBCLASS through CTL3DUNREGISTER; variable-length packed strings total 178 bytes.
1028:0522	1028:0537	verified	ctl3d_library_names	g_ctl3d_library_names	const char[2][11]	Adjacent NUL-terminated strings CTL3D.DLL and CTL3DV2.DLL.	Binary bytes and verified modern/legacy CTL3D search/load paths; complete verified referring-function closure	Exact primary and fallback helper DLL names, including both terminators.
1028:05c0	1028:05cb	verified	system_timer_vmt	g_system_timer_vmt	const uint8_t[12]	Static six-byte object descriptor plus relocated destructor entry at 05c8.	Setup constructs VMT 05c0; relocation to entry ordinal 129; verified SystemTimer lifecycle/tests; complete verified referring-function closure	Exact six-byte timer object size, negative size/header fields, and destructor virtual slot.
1028:060a	1028:064d	verified	object_windows_application_dispatch	g_object_windows_application_dispatch	const uint8_t[68]	Static 28-byte application dispatch descriptor followed by ten relocated far handlers.	Exact bytes and relocations 0626..064a to entry ordinals 178,179,181..188; application dispatch/tests verified; complete verified referring-function closure	Complete ObjectWindows application dynamic table retained with every target address-backed.
1028:065a	1028:0665	verified	object_windows_default_procedures	g_object_windows_default_procedures	const Win16FarPtr[3]	Loader-relocated USER procedure pointers for ordinals 107, 447, and 308.	NE relocations 136..138 and verified ObjectWindows default window/MDI procedure forwarding; complete verified referring-function closure	Exact three far import slots used as framework default procedure identities.
1028:06c5	1028:06f1	verified	borland_unit_descriptor_table	g_borland_unit_descriptor_table	const uint8_t[45]	Static Borland unit descriptor bytes followed by six relocated far initialization/finalization entries.	Exact bytes and relocations 06da..06ee to entry ordinals 227..232; complete verified startup/ExitProc chain; complete verified referring-function closure	Exact compiler-generated unit lifecycle table; all six targets and ordering are represented.
1028:07db	1028:07e2	verified	predicted_ball_position_milli	g_predicted_ball_position_milli	int32_t[2]	Zero-fill; each physics substep publishes current position plus velocity as predicted X/Y before broadphase.	Complete verified readers/writers 1000:c79c and 1000:9b69; reconstructed/tdkpin_physics.c and focused physics tests; complete verified referring-function closure	Exact X then Y signed dword extent, write order, trigger rewrite, and bounds use are fully represented.
1028:0869	1028:086a	verified	unused_setup_word_0869	g_unused_setup_word_0869	uint16_t	Zero-fill and explicitly written zero by game setup; never read anywhere in the complete reference inventory.	Sole write 1000:03ff in verified setup and zero-reader proof; complete verified referring-function closure	Explicit retained word is initialized state, not silently omitted padding; it has no in-image consumer.
1028:0871	1028:0872	verified	physics_substeps_per_tick	g_physics_substeps_per_tick	uint16_t	Configured from the clamped speed setting and snapshotted by physics before the one-based substep loop.	Verified setup speed table and 1000:c79c loop; game-setup and physics tests; complete verified referring-function closure	Exact unsigned zero-through-configured substep semantics and zero-substep rendering behavior are fully represented.
1028:4d38	1028:4d39	verified	borland_heap_request_bytes	g_borland_heap_request_bytes	uint16_t	Zero-fill; 1020:01ca stores the current allocation request before local/global attempts and reuses it across HeapError retries.	Complete sole-function references; verified borland_try_get_mem source and heap core/path tests; complete verified referring-function closure	Exact retry-stable uint16 request size, local/global threshold comparisons, and HeapError callback argument are fully represented.
1028:07ca	1028:07ca	verified	claw_animation_active	g_claw_animation_active	uint8_t	Zero-fill; setup clears it, collision logic arms it, and the timer clears it after the claw returns to frame ten with the primary bank selected.	Complete references; full timer state machine in reconstructed/tdkpin_timer_tick.c and test_timer_tick.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07e3	1028:07ea	verified	ball_slot_x_positions_milli	g_ball_slot_x_positions_milli	int32_t[2]	Zero-fill; indexed save/load transfers active ball X for slots zero and one.	Verified 1000:c36b/c426 stride plus full timer promotion/copy paths; gameplay-helper and timer tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07eb	1028:07f2	verified	ball_slot_y_positions_milli	g_ball_slot_y_positions_milli	int32_t[2]	Zero-fill; indexed save/load transfers active ball Y for slots zero and one.	Verified 1000:c36b/c426 stride plus full timer promotion/copy paths; focused tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0803	1028:080a	verified	ball_slot_auxiliary_state	g_ball_slot_auxiliary_state	int32_t[2]	Zero-fill; indexed save/load mirrors receiver +0bca for slots zero and one.	Verified 1000:c36b/c426 and full timer slot promotion; focused tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:080b	1028:0816	verified	ball_slot_real48_state	g_ball_slot_real48_state	BorlandReal48[2]	Zero-fill; indexed save/load mirrors receiver +0bce..0bd3 for slots zero and one.	Verified six-byte stride in 1000:c36b/c426 and full timer promotion; focused tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:086d	1028:086e	verified	claw_current_frame	g_claw_current_frame	uint16_t	Setup initializes ten; timer steps it toward the target and selects release state 1..9/18 or rest state ten.	Complete setup/timer references, exact claw table and test_timer_tick.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:086f	1028:0870	verified	claw_target_frame	g_claw_target_frame	uint16_t	Setup initializes ten; collision logic selects a target and timer resets it to ten after releasing a ball.	Complete references and full timer claw state machine; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0873	1028:0873	verified	claw_alternate_bank	g_claw_alternate_bank	uint8_t	Zero-fill; passed as the claw atlas bank while moving and cleared on release completion.	Complete references, verified claw renderer and full timer tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0876	1028:0879	verified	timer_tick_counter	g_timer_tick_counter	uint32_t	Zero-fill; incremented after timer guards, drives intro quotient/remainder schedules, and resets when a new game is initialized.	Setup and full 1000:eab1 disassembly/source; test_timer_tick.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:087a	1028:087d	verified	intro_marquee_counter	g_intro_marquee_counter	uint32_t	Zero-fill; increments on each six-tick intro marquee redraw and selects phase modulo 49.	Setup and full timer GDI path; test_timer_tick.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07c5	1028:07c5	verified	collision_refresh_pending	g_collision_refresh_pending	uint8_t	Zero-fill; setup clears it, adding a player sets it, and the next timer pass refreshes all 175 collision records before clearing it.	Writes at 1000:03e0/6959/eb2c and timer read at 1000:eb0b; exact add-player branch in reconstructed/tdkpin_key_input.c and reconstructed/tests/test_key_release.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07cf	1028:07cf	verified	debug_keys_enabled	g_debug_keys_enabled	uint8_t	Zero-fill and explicitly cleared on setup entry; no in-image writer enables it.	Complete reference inventory: verified setup 1000:0270 and both debug branches in verified 1000:638e; reconstructed/tests/test_game_setup.c and test_key_release.c; complete verified referring-function closure	Nonzero, possible only through external mutation, enables F2 target-rotation reset and F7 ball-position restore; normal execution leaves both paths dormant.
1028:07f3	1028:07fa	verified	ball_slot_velocity_x_milli	g_ball_slot_velocity_x_milli	int32_t[2]	Zero-fill; indexed ball-slot save/load stores horizontal velocity for slots zero and one.	Verified 1000:c36b/c426 slot stride and verified 1000:638e nudge updates; timer slot-one-to-zero transfer at 1000:f24d; gameplay-helper and key-release tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07fb	1028:0802	verified	ball_slot_velocity_y_milli	g_ball_slot_velocity_y_milli	int32_t[2]	Zero-fill; indexed ball-slot save/load stores vertical velocity for slots zero and one.	Verified 1000:c36b/c426 slot stride, verified 1000:638e launch publication and space-nudge updates, timer slot-one-to-zero transfer at 1000:f25b; focused tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0260	1028:02a9	verified	setup_low_memory_text	g_setup_low_memory_text	const char[74]	Static NUL-terminated German insufficient-memory message.	Binary bytes and sole verified MessageBox path in 1000:0270; reconstructed/tests/test_game_setup.c; complete verified referring-function closure	Exact owner-zero low-memory text shown before window Close and RuntimeExit(0).
1028:02aa	1028:02c2	verified	setup_dialog_caption	g_setup_dialog_caption	const char[25]	"Static NUL-terminated ""TDK Pinball Machine 1.00""."	Binary bytes and both verified setup MessageBox paths; reconstructed/tests/test_game_setup.c; complete verified referring-function closure	Exact shared setup error caption.
1028:02c3	1028:02c6	verified	setup_ini_suffix	g_setup_ini_suffix	const char[4]	"Static NUL-terminated ""INI""."	Binary bytes and verified parameter-string/extension replacement path in 1000:0270; complete verified referring-function closure	Exact suffix appended after the executable-name dot.
1028:02c7	1028:02cf	verified	setup_ini_section	g_setup_ini_section	const char[9]	"Static NUL-terminated ""Settings""."	Binary bytes and both verified GetPrivateProfileInt call sites; complete verified referring-function closure	Exact INI section shared by Language and Speed.
1028:02d0	1028:02d8	verified	setup_ini_language_key	g_setup_ini_language_key	const char[9]	"Static NUL-terminated ""Language""."	Binary bytes and verified default/clamp path in 1000:0270; complete verified referring-function closure	Returns 1..5; out-of-range values become one.
1028:02d9	1028:02de	verified	setup_ini_speed_key	g_setup_ini_speed_key	const char[6]	"Static NUL-terminated ""Speed""."	Binary bytes and verified default/clamp/timer mapping in 1000:0270; complete verified referring-function closure	Returns 1..5; out-of-range values become three.
1028:02df	1028:02f3	verified	setup_no_timer_text	g_setup_no_timer_text	const char[21]	"Static ""No timer available!"" followed by two NUL bytes."	Binary bytes and sole verified timer-construction failure MessageBox path; complete verified referring-function closure	Exact HWND-owned error followed directly by RuntimeExit(0), without window Close.
1028:0306	1028:0310	verified	help_window_title	g_help_window_title	const char[11]	"Static NUL-terminated ""HelpScreen""."	Binary bytes and sole verified full-child constructor use in 1000:6bf8; reconstructed/tests/test_key_input.c; complete verified referring-function closure	Exact title of the F1-created help window.
1028:0010	1028:0013	verified	highscore_xor_key	g_highscore_xor_key	const uint32_t	Static bytes 49 57 49 4b, interpreted little-endian as 0x4b495749.	Binary bytes; complete reader inventory 1000:a8ea/a99c; reconstructed/tdkpin_highscores.c; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact dword XOR key applied symmetrically to all ten serialized score values.
1028:0014	1028:0023	verified	highscore_file_header	g_highscore_file_header	const uint8_t[16]	"Static bytes ""TDK Highscores"" followed by two NUL bytes."	Binary bytes; complete save/write and load/ShortString-compare paths 1000:a8ea/a99c; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact 16-byte authentication header; both NUL bytes participate in comparison and serialization.
1028:010e	1028:015d	verified	highscore_window_vmt	g_highscore_window_vmt	TdkpinHighscoreWindowVmt	Static 0x45/-0x45 header, zero reserved dword, and eighteen loader-relocated far methods.	Binary bytes; relocations 6:46-63; all method targets including paint 1000:5c13 verified; reconstructed/tdkpin_highscores.h; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact 80-byte TWindow-derived VMT from destructor +08 through paint +4c, with every slot named and address-backed.
1028:02f4	1028:02ff	verified	highscore_heading	g_highscore_heading	const char[12]	"Static NUL-terminated ""HIGH SCORES""."	Binary bytes; heading TextOut in verified 1000:5c13; reconstructed/tests/test_highscores.c; complete verified referring-function closure	The terminal NUL at 02ff is also deliberately addressed as the empty rank-10 prefix.
1028:0300	1028:0305	verified	highscore_rank_affixes	g_highscore_rank_affixes	const char[2][3]	"Static consecutive C strings ""  "" and "". ""."	Binary bytes; rank construction in verified 1000:5c13; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Two leading spaces align ranks 1..9 with rank 10; dot-space follows every formatted rank.
1028:0312	1028:031f	verified	highscore_save_file_name	g_highscore_save_file_name	const char[14]	"Static ""HiScores.Dat"" followed by two NUL bytes."	Binary bytes; sole _lcreat argument at 1000:a8ee-a8f5; reconstructed/tests/test_highscores.c; complete verified referring-function closure	First NUL terminates the KERNEL filename; the adjacent second NUL is retained in the exact object extent.
1028:0320	1028:032c	verified	highscore_load_file_name	g_highscore_load_file_name	const char[13]	"Static NUL-terminated ""HiScores.Dat""."	Binary bytes; both _lopen mode call sites at 1000:a9a4-a9c0; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact shared filename for the mode-0 and mode-0x40 open attempts.
1028:032d	1028:0334	verified	highscore_default_name	g_highscore_default_name	const char[8]	"Static NUL-terminated ""No Name""."	Binary bytes; ten exact far-strcpy destinations in default path 1000:aaa2-ab33; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact fallback name copied independently into every 22-byte name slot.
1028:0336	1028:0348	verified	highscore_edit_initial_name	g_highscore_edit_initial_name	const char[19]	"Static NUL-terminated ""TDK Pinball Player""."	Binary bytes; sole selected-slot far-strcpy in verified 1000:ab3c; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact initial editable name installed before the modal text dialog.
1028:0349	1028:0372	verified	highscore_edit_caption	g_highscore_edit_caption	const char[42]	Static NUL-terminated congratulations caption.	Binary bytes; sole text-dialog caption argument in verified 1000:ab3c; reconstructed/tests/test_highscores.c; complete verified referring-function closure	"Exact caption ""Congratulations! This is a Top Ten Score!""."
1028:0373	1028:038a	verified	highscore_edit_label	g_highscore_edit_label	const char[24]	Static NUL-terminated input prompt.	Binary bytes; sole text-dialog label argument in verified 1000:ab3c; reconstructed/tests/test_highscores.c; complete verified referring-function closure	"Exact prompt ""Please input your name:""."
1028:038b	1028:0394	verified	highscore_window_title	g_highscore_window_title	const char[10]	"Static NUL-terminated ""HighScore""."	Binary bytes; sole centered-child title argument in verified 1000:ab3c; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact title of the modeless high-score list window.
1028:07d2	1028:07d2	verified	highscore_insert_index	g_highscore_insert_index	uint8_t	Zero-fill; set to the one-based inserted slot by 1000:abe5 and consumed by 1000:ab3c.	Verified insert/show lifecycle and complete reference inventory; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07d3	1028:07da	verified	ball_position_milli	g_ball_position_milli	int32_t[2]	Zero-fill; reset to 325000/413000 by verified 1000:9e85 and updated throughout physics/gameplay.	Verified reset, pixel projection 1000:9bca, bounds/dynamic-record and ball-slot helpers; complete reference inventory; reconstructed/tests/test_ball_render.c and test_gameplay_helpers.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:081f	1028:0828	verified	player_marker_counts	g_player_marker_counts	int16_t[5]	Zero-fill; indexed one-based by active player and initialized/updated by game-state paths.	Verified six-marker projection in 1000:a604; complete indexed reference inventory; reconstructed/tests/test_gameplay_helpers.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0817	1028:081a	verified	player_ready_flags	g_player_ready_flags	uint8_t[4]	Zero-fill; each configured one-based player slot is set to one by 1000:a72c.	Verified initialization and exact extent in 1000:a72c; reconstructed/tests/test_player_state.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:081b	1028:081e	verified	player_item_group_flags	g_player_item_group_flags	uint8_t[4]	Zero-fill; each configured one-based player slot is set to one after marker initialization.	Verified initialization and exact extent in 1000:a72c; reconstructed/tests/test_player_state.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0829	1028:0838	verified	player_marker_score_thresholds	g_player_marker_score_thresholds	int32_t[4]	Zero-fill then initialized by startup/game setup; read one-based by score-award level.	Verified indexed comparison in 1000:bc36 and exact boundary against marker counts/levels; reconstructed/tests/test_scoring.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0839	1028:0848	verified	player_marker_levels	g_player_marker_levels	int32_t[4]	Zero-fill; initialized to one for configured players and incremented when score thresholds are crossed.	Verified initialization 1000:a72c and increment/limit logic 1000:bc36; player-state/scoring tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0992	1028:09a1	verified	player_secondary_scores	g_player_secondary_scores	int32_t[4]	Zero-fill; reset for configured players and multiplied for active-player display.	Verified reset 1000:a72c and active redraw 1000:acc2; reconstructed/tests/test_player_state.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:09a2	1028:09a5	verified	player_score_multipliers	g_player_score_multipliers	uint8_t[4]	Zero-fill; initialized to one and used as unsigned byte factors for secondary-score display.	Verified reset 1000:a72c and multiply 1000:acc2; reconstructed/tests/test_player_state.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:09a6	1028:09ad	verified	player_sprite_indices	g_player_sprite_indices	uint16_t[4]	Zero-fill; reset to zero and consumed as indices into the 400-series sprite bitmap array.	Verified reset 1000:a72c and active-player composite 1000:acc2/0002; player-state/player-sprite tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0874	1028:0874	verified	score_double_active	g_score_double_active	uint8_t	Zero-fill; cleared by player initialization, set by sprite effect 7, and doubles score deltas while nonzero.	Verified lifecycle in 1000:a72c/bc36/c4e1; complete reference inventory; player-state/scoring tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0875	1028:0875	verified	special_respawn_active	g_special_respawn_active	uint8_t	Zero-fill; set only on the special collision-position respawn branch and cleared on normal ball end.	Verified both writes in 1000:ae6e and complete reference inventory; reconstructed/tests/test_turn_state.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0855	1028:0858	verified	target_rotation_state	g_target_rotation_state	int32_t	Zero-fill; selects DAT600 frames 1..5 and the rotation/composite branch at values 6 and above.	Verified full render/rotation consumer 1000:6f27 and complete reference inventory; reconstructed/tests/test_mechanism_render.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0851	1028:0854	verified	panel_animation_frame	g_panel_animation_frame	int32_t	Zero-fill; drives the nine-phase 1..281 panel animation and entry-frame sound events.	Verified complete render consumer 1000:7440 and reset writer 1000:9e85; full reference inventory; reconstructed/tests/test_panel_animation.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07c7	1028:07c7	verified	target_rotation_armed	g_target_rotation_armed	uint8_t	Zero-fill; event flag 0400 clears the rotation state and sets this byte only while both rotation bytes are zero.	Verified gate/writer in 1000:b476 and complete reference inventory; reconstructed/tests/test_collision_events.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07c8	1028:07c8	verified	target_set_complete	g_target_set_complete	uint8_t	Zero-fill; set when all five target record words are nonzero and suppresses rearming while set.	Verified writer 1000:9e85, gate 1000:b476, and complete reference inventory; ball-render/collision-event tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:087e	1028:08a5	verified	highscore_scores	g_highscore_scores	int32_t[10]	Zero-fill; loaded/defaulted by 1000:a99c, reordered by 1000:abe5, rendered by 1000:5c13, and XOR-serialized by 1000:a8ea.	Complete verified reader/writer inventory across 1000:5c13/a8ea/a99c/abe5; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact ten signed dwords, one-based addressing, persistence, ordering, comparison, and decimal rendering are fully proven.
1028:08a6	1028:0981	verified	highscore_names	g_highscore_names	char[10][22]	Zero-fill; directly read as 220 bytes or defaulted, shifted/edited by UI, rendered, and serialized.	Complete verified lifecycle 1000:5c13/a8ea/a99c/ab3c/abe5; reconstructed/tests/test_highscores.c; complete verified referring-function closure	Exact ten 22-byte slots, short-read behavior, defaulting, shift/edit, C-string display truncation, and persistence layout are fully proven.
1028:0024	1028:006b	verified	tdkpin_application_vmt	g_tdkpin_application_vmt	struct TdkpinApplicationVmt	Static eight-byte VMT header followed by sixteen relocated far methods.	Binary hash b6da1047d807ee6b4c7ba9aac27c80fa2c968c483abb80385a33e79d28ebe717; relocations 6:3-16; all method targets and program-entry VMT calls verified.; complete verified referring-function closure	Size 0x12, negative size 0xffee, reserved zero dword, destructor +08, Idle +0c, InitApplication +10, InitInstance +14, Setup +18, Run +1c, MessageLoop +20, PreProcess +24, dialog/accelerator/MDI +28/+2c/+30, MakeWindow +34, ExecDialog +38, ValidateWindow +3c, Error +40, CanClose +44.
1028:0396	1028:03c7	verified	tdkpin_version_error_text	tdkpin_version_error_text	const char[50]	Static NUL-terminated minimum-version message.	Binary bytes and verified indirect MessageBox path in ne_program_entry.; complete verified referring-function closure	Exact text states that Windows 3.10 or higher is required.
1028:03c8	1028:03e0	verified	tdkpin_version_dialog_title	tdkpin_version_dialog_title	const char[25]	Static NUL-terminated application caption.	Binary bytes and verified minimum-version MessageBox arguments.; complete verified referring-function closure	"Exact caption ""TDK Pinball Machine 1.00""."
1028:03e1	1028:03e9	verified	tdkpin_application_object_name	tdkpin_application_object_name	const char[9]	"Static bytes ""Lbmpapp"" followed by two NUL bytes."	Binary bytes and verified object_windows_application_construct name argument.; complete verified referring-function closure	Exact ObjectWindows application object name extent.
1028:046a	1028:046f	verified	multimedia_path_environment_name	multimedia_path_environment_name	const char[6]	"Static bytes ""PATH"" followed by two NUL bytes."	Binary bytes and verified environment lookup in multimedia_locate_library.; complete verified referring-function closure	Exact DOS environment variable name used for final CTL3D search-list fallback.
1028:06f2	1028:06f2	verified	object_windows_focus_event_marker	g_object_windows_focus_event_marker	uint8_t	Static value 1 and redundantly set to 1 by 1008:2c83.	Complete reference inventory proves one writer and no readers; focused handler tests.; complete verified referring-function closure	Exact write-only marker with no inferred role beyond its observed store.
1028:0652	1028:0655	verified	win16_create_dialog_param	g_win16_create_dialog_param	Win16FarPtr	NE loader relocation to USER ordinal 241.	Verified sole modeless call, bound-thunk callback ledger, and dialog tests.; complete verified referring-function closure	Exact far import pointer for CreateDialogParam16.
1028:0656	1028:0659	verified	win16_dialog_box_param	g_win16_dialog_box_param	Win16FarPtr	NE loader relocation to USER ordinal 239.	Verified sole modal call, bound-thunk callback ledger, and dialog tests.; complete verified referring-function closure	Exact far import pointer for DialogBoxParam16.
1028:066a	1028:066a	verified	dialog_alternate_template	g_dialog_alternate_template	uint8_t	Static zero with no in-image writer.	Verified sole reader and both synthetic branch cases.; complete verified referring-function closure	Selects integer dialog template 7f02 normally or 7f05 when externally nonzero.
1028:0748	1028:076b	verified	tdkpin_application_object	g_tdkpin_application_object	uint8_t[36]	Zero-fill static storage constructed in-place with VMT offset 0x0024.	Verified application constructor, VMT Run/destructor calls, static dispose mode zero, and program-entry tests.; complete verified referring-function closure	Exact process-lifetime ObjectWindows application instance.
1028:07bf	1028:07c2	verified	tdkpin_windows_version	g_tdkpin_windows_version	uint32_t	Full DX:AX return from GetVersion16.	Verified 2.x, 3.9, 3.10, and 4.x branches and full-dword publication.; complete verified referring-function closure	Low-byte major, next-byte minor; upper word retained but not used by threshold.
1028:07c9	1028:07c9	verified	gameplay_transition_pending	g_gameplay_transition_pending	uint8_t	Zero-fill; set by verified 1000:a70e and setup/input paths.	Verified writer plus complete reference inventory.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07d0	1028:07d0	verified	player_count	g_player_count	uint8_t	Zero-fill; configured during setup and cleared by verified 1000:a70e.	Verified clear and complete loop/reference evidence.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0849	1028:0850	verified	collision_path_continuation	g_collision_path_continuation	int32_t[2]	Zero-fill; updated after every accepted circle/segment and consumed by relative-mode records.	Complete sole-function read/write inventory, exact 32-bit wrap, and branch tests.; complete verified referring-function closure	X then Y continuation; circles retain point1 center, segments retain point2 endpoint.
1028:09ae	1028:4217	verified	collision_records_1_174	g_collision_records_1_174	TdkpinCollisionRecord[174]	Zero-fill; initialized by 174 indexed calls in the large setup routine.	Verified 83-byte writer 1008:0138; OBJECTS.tsv live dump for IDs 1..174; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:4218	1028:4262	verified	collision_record_175_prefix	g_collision_record_175_prefix	uint8_t[75]	Zero-fill; initialized as collision record 175.	Verified writer 1008:0138 and OBJECTS.tsv row 175; final eight bytes are separately shared with word-quad storage at 4263..426a.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:03ea	1028:0441	verified	sound_resource_byte_counts	g_sound_resource_byte_counts	uint32_t[22]	Static little-endian RIFF byte lengths for resource numbers 2001..2022; six absent resource IDs have zero entries.	Binary bytes 1028:03ea-0441; WAV payload lengths in assets/decoded/audio; indexed reads at 1008:1038-1048 and 113f-114d; reconstructed/tdkpin_data.c; reconstructed/tests/test_sound.c; complete verified referring-function closure	Exact 22-entry table and one-based address arithmetic are represented; play sound number zero deliberately reaches the preceding dword exactly as the binary does.
1028:0442	1028:0445	verified	sound_ini_suffix	sound_ini_suffix	char[4]	"Static NUL-terminated bytes ""INI""."	Binary bytes; far strcat at 1008:1080-1090; reconstructed/tests/test_sound.c; complete verified referring-function closure	Replaces the executable extension after the first dot found by the Borland ShortString Position call.
1028:0446	1028:044e	verified	sound_ini_section	sound_ini_section	char[9]	"Static NUL-terminated bytes ""Settings""."	Binary bytes; GetPrivateProfileInt16 call 1008:1095-10ac; reconstructed/tests/test_sound.c; complete verified referring-function closure	Exact INI section far pointer.
1028:044f	1028:0454	verified	sound_ini_key	sound_ini_key	char[6]	"Static NUL-terminated bytes ""Sound""."	Binary bytes; GetPrivateProfileInt16 call 1008:1095-10ac; reconstructed/tests/test_sound.c; complete verified referring-function closure	Exact sound-enable INI key with default value one.
1028:0455	1028:0458	verified	wave_resource_type	wave_resource_type	char[4]	"Static NUL-terminated bytes ""WAV""."	Binary bytes; FindResource16 type argument at 1008:105c-1066; reconstructed/tests/test_sound.c; complete verified referring-function closure	Exact custom NE resource type used for resource numbers 2001..2022.
1028:045a	1028:045d	verified	palette_resource_type	palette_resource_type	char[4]	"Static NUL-terminated bytes ""pal""."	Binary bytes; verified FindResource16 type argument 1008:1337-1340; reconstructed/tests/test_palette.c; complete verified referring-function closure	Exact lowercase custom NE resource type used to load palette resource 999.
1028:045e	1028:0461	verified	bitmap_resource_type	bitmap_resource_type	char[4]	"Static NUL-terminated bytes ""DAT""."	Binary bytes; verified FindResource16 type argument 1008:14ae-14b7; reconstructed/tests/test_bitmap_loader.c; complete verified referring-function closure	Exact uppercase custom NE resource type for bitmap/DIB resources.
1028:0462	1028:0469	verified	display_dc_driver	display_dc_driver	char[8]	"Static NUL-terminated bytes ""Display""."	Binary bytes; sole CreateDC16 driver argument 1008:1537-154c; reconstructed/tests/test_bitmap_loader.c; complete verified referring-function closure	Exact display-driver name; device, output, and initialization-data pointers are all null.
1028:07c6	1028:07c6	verified	game_tilted	game_tilted	uint8_t	Zero-filled; reset during game/ball setup and set after the nudge threshold is exceeded.	Verified sound-dispatch gate 1008:0002; complete reference inventory identifies readers in key, collision, timer, and gameplay paths plus writers 1000:638e and 1000:9e85.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0538	1028:053f	verified	tpwincrt_initial_placement	g_tpwincrt_initial_placement	INT16[4]	Four static words 0x8000.	Verified CreateWindow16 x/y/width/height arguments and lifecycle tests.; complete verified referring-function closure	Exact CW_USEDEFAULT placement tuple.
1028:0540	1028:054b	verified	tpwincrt_text_geometry	g_tpwincrt_text_geometry	struct TpWinCrtTextGeometry	Initialized to 80 columns, 25 rows, and zero cursor/view origins.	All readers/writers verified, including text output, line advance, create/destroy, paint, resize, caret, and circular addressing tests.; complete verified referring-function closure	Six exact uint16 values: columns, rows, cursor column/row, and viewport column/row.
1028:054c	1028:054f	verified	tpwincrt_inactive_format_pointer	g_tpwincrt_inactive_format_pointer	Win16FarPtr	Relocated pointer to 1028:0550.	DGROUP relocation and verified 1008:24a5 wvsprintf call.; complete verified referring-function closure	Exact far pointer to the inactive-caption format.
1028:0550	1028:055d	verified	tpwincrt_inactive_format	g_tpwincrt_inactive_format	const char[14]	"Static bytes for ""(Inactive %s)"" plus NUL."	Binary bytes and verified ExitProc formatting tests.; complete verified referring-function closure	Exact clean-shutdown caption template.
1028:055e	1028:055e	verified	tpwincrt_auto_scroll	g_tpwincrt_auto_scroll	uint8_t	Static value 1.	Verified final branch in 1008:1b11 and text-output tests.; complete verified referring-function closure	Keeps the output cursor visible after each bulk write.
1028:055f	1028:055f	verified	tpwincrt_ctrl_z_is_eof	g_tpwincrt_ctrl_z_is_eof	uint8_t	Static value 0.	Verified Ctrl-Z line-termination branch and focused tests.; complete verified referring-function closure	Optional DOS EOF semantics for TPWinCrt line input.
1028:0560	1028:0560	verified	tpwincrt_break_check_enabled	g_tpwincrt_break_check_enabled	uint8_t	Static value 1; cleared by the clean shutdown ExitProc.	All Ctrl-C/create readers and the ExitProc writer are verified.; complete verified referring-function closure	Exact active-runtime break-check lifecycle.
1028:0562	1028:057b	verified	wndclass_tpwincrt	tpwincrt_window_class	WNDCLASS16	Static style/zero fields plus runtime hInstance/icon/cursor stores in 1008:2554.	Wine 11.15 WNDCLASS16 layout; DGROUP relocation 0564 -> entry ordinal 119; relocation 0578 -> 1028:057c; assembly 1008:255e-2593.; complete verified referring-function closure	style=CS_VREDRAW|CS_HREDRAW; wndproc=1008:2219; no class/window extra bytes; application icon and arrow cursor; background brush COLOR_WINDOW+1; no menu; class name TPWinCrt.
1028:057c	1028:0584	verified	tpwincrt_class_name	tpwincrt_class_name	char[9]	Static initialized bytes 54 50 57 69 6e 43 72 74 00.	Relocation 1028:0578 -> 1028:057c; RegisterClass16 path 1008:2554.; complete verified referring-function closure	NUL-terminated TPWinCrt class name used by the verified WNDCLASS16 object.
1028:0586	1028:0587	verified	tpwincrt_window_handle	g_tpwincrt_window	HWND16	Static zero; assigned from every 1008:2219 callback entry.	Store at 1008:2230-2233 and all TPWinCrt USER call sites.; complete verified referring-function closure	Process-wide TPWinCrt HWND used by painting, caret, scrolling, focus, and teardown paths.
1028:0588	1028:0589	verified	tpwincrt_ring_row_origin	g_tpwincrt_ring_row_origin	uint16_t	Static zero; advanced/wrapped at bottom-row line advance.	Verified circular addressing and scrolling tests.; complete verified referring-function closure	Exact circular physical-row origin.
1028:058a	1028:058b	verified	tpwincrt_input_count	g_tpwincrt_input_count	uint16_t	Static zero; incremented by WM_CHAR and decremented by blocking dequeue.	Verified enqueue, poll, wait, dequeue, shift, and overflow paths.; complete verified referring-function closure	Exact signed-compared count for the 64-byte queue.
1028:058c	1028:058c	verified	tpwincrt_window_created	g_tpwincrt_window_created	uint8_t	Static zero; set on create and cleared after destroy.	Verified create/destroy and all lazy-window/scroll/shutdown gates.; complete verified referring-function closure	Exact process-wide live-window Boolean.
1028:058d	1028:058d	verified	tpwincrt_has_focus	g_tpwincrt_has_focus	uint8_t	Static zero; set/cleared only by verified 1008:21ba/21ce.	Reads in verified caret and size paths; exact focus handlers at 1008:21ba and 21ce.; complete verified referring-function closure	Boolean focus state with proven caret ordering.
1028:058e	1028:058e	verified	tpwincrt_caret_enabled	g_tpwincrt_caret_enabled	uint8_t	Static zero; set only across a blocking input wait.	Verified read/wait/focus/resize caret lifecycle.; complete verified referring-function closure	Exact Boolean controlling focus-owned caret lifetime.
1028:058f	1028:058f	verified	tpwincrt_paint_message_active	g_tpwincrt_paint_message_active	uint8_t	Static zero; set only around WM_PAINT drawing.	Branch in verified 1008:1779/17e2; stores in 1008:1dcc.; complete verified referring-function closure	Selects matched BeginPaint16/EndPaint16 instead of GetDC16/ReleaseDC16.
1028:0590	1028:05bf	verified	tpwincrt_key_bindings	g_tpwincrt_key_bindings	TpWinCrtKeyBinding[12]	Static 48-byte table represented verbatim in reconstructed/tdkpin_data.c.	Binary bytes 1028:0590-05bf; indexed loop disassembly 1008:2170-21b4.; complete verified referring-function closure	Ordered bindings for Left/Right/Home/End/Up/Down/PageUp/PageDown with exact Ctrl requirement, horizontal/vertical axis, and Win16 scroll command.
1028:05cc	1028:0609	verified	object_windows_base_message_table	g_object_windows_base_message_table	ObjectWindowsMessageTable9	Static parent/cache zero, count 9, ids 0115,0114,0111,0010,0002,0082,0006,0011,0014, and nine relocated far handlers.	Binary bytes; relocations 1028:05e6-0606; verified resolver and focused message/command/scroll tests.; complete verified referring-function closure	Exact 62-byte mutable-cache table layout represented in C; all nine handler functions and every id-to-address mapping are now verified.
1028:0222	1028:022b	verified	tdkpin_module_name	tdkpin_module_name	char[10]	"Static NUL-terminated bytes ""FLIPPER3D""."	Binary bytes; verified multimedia initialization call 1000:0100; path locator input tests.; complete verified referring-function closure	Exact module-name far argument used while locating CTL3D relative to the executable.
1028:022c	1028:0244	verified	tdkpin_application_title	tdkpin_application_title	char[25]	"Static NUL-terminated bytes ""TDK Pinball Machine 1.00""."	Binary bytes; verified MainWindow constructor and second-instance MessageBox frames.; complete verified referring-function closure	Exact application/window title and refusal-dialog caption.
1028:0245	1028:025f	verified	tdkpin_already_running_text	tdkpin_already_running_text	char[27]	"Static OEM/ANSI bytes ""Der Flipper läuft bereits!"" plus NUL."	Binary bytes; verified second-instance MessageBox frame 1000:0144-015f.; complete verified referring-function closure	Exact German already-running refusal text.
1028:064e	1028:0651	verified	object_windows_application	g_object_windows_application	Win16FarPtr	Static null; published by verified 1018:1a61 after root construction.	Write at 1018:1a93-1a99; reads in application/window routing across Code1, Code2, and Code4; constructor lifecycle tested.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:066c	1028:066d	verified	object_windows_thunk_code_selector	g_object_windows_thunk_code_selector	uint16_t	Static zero; updated to each newly allocated thunk pool's executable selector.	Disassembly 1018:01dc-02f9; reconstructed/tests/test_bound_thunks.c; complete verified referring-function closure	Stored in the next pool's header before replacement and used as the current pool selector lifecycle marker.
1028:0666	1028:0669	verified	win16_message_box	g_win16_message_box	Win16FarPtr	NE loader relocation binds USER ordinal 1 at startup.	Relocation record 139; all indirect readers inventoried; verified application-error call 1018:1f14 and focused test.; complete verified referring-function closure	Process-wide far import pointer for MessageBox16; argument semantics at the reconstructed ObjectWindows call site are exact.
1028:066e	1028:0671	verified	object_windows_free_thunk	g_object_windows_free_thunk	Win16FarPtr	Static null; populated with 35 generated thunks per 256-byte pool.	Disassembly 1018:01dc-0340; reconstructed/tests/test_bound_thunks.c; complete verified referring-function closure	Exact LIFO head across pool construction, allocation, release, and reallocation; each free thunk stores the previous far head at +3.
1028:0672	1028:0675	verified	object_windows_dispatch_proc	g_object_windows_dispatch_proc	Win16FarPtr	Static null; assigned the MakeProcInstance16 result by 1018:1a61 and consumed by new thunk pools.	Verified constructor write, thunk-pool copy/use, destructor FreeProcInstance, and focused application/thunk tests.; complete verified referring-function closure	Shared procedure reached by every generated bound thunk; exact MakeProcInstance/FreeProcInstance ownership lifecycle is represented.
1028:0676	1028:0679	verified	object_windows_creating_object	g_object_windows_creating_object	Win16FarPtr	Published immediately before native creation and consumed by bootstrap WNDPROC 1018:018b.	Verified writer 1018:134f, bootstrap reader/transition, exact extent, and creation tests.; complete verified referring-function closure	Exact temporary object handoff until HWND-to-object thunk binding completes.
1028:067a	1028:067d	verified	object_windows_selector_property	object_windows_selector_property_name	char[4]	Static initialized bytes 4f 57 31 00.	TDKPIN.EXE data bytes; SetProp16 call at 1018:004a-0059.; complete verified referring-function closure	NUL-terminated property name OW1; stores the bound object's selector.
1028:067e	1028:0681	verified	object_windows_offset_property	object_windows_offset_property_name	char[4]	Static initialized bytes 4f 57 32 00.	TDKPIN.EXE data bytes; SetProp16 call at 1018:005a-0069.; complete verified referring-function closure	NUL-terminated property name OW2; stores the bound object's offset.
1028:0682	1028:0685	verified	object_windows_message_hook	g_object_windows_message_hook	Win16FarPtr	Static null far pointer; the target image contains no writer.	Complete Ghidra reference inventory: reads only at 1018:0127, 015f, and 08de; binary zero bytes; reconstructed/tests/test_message_dispatch.c; complete verified referring-function closure	Optional generic ObjectWindows instrumentation hook. Normal TDKPIN execution always skips it because the selector word at 0684 remains zero; nonnull semantics are nevertheless reconstructed and branch-tested.
1028:0686	1028:068a	verified	object_windows_thunk_template	object_windows_thunk_template	uint8_t[5]	Static bytes 5b 2e c4 1f ea copied to each generated code block at offset +2.	Binary bytes; disassembly 1018:020e-0226; reconstructed/tests/test_bound_thunks.c; complete verified referring-function closure	POP BX; CS:LES BX,[BX]; JMP FAR immediate template: consumes the CALL return address, loads the embedded bound object, and jumps through the shared dispatch procedure appended at +7.
1028:068c	1028:0697	verified	object_windows_turbo_window_class_name	object_windows_turbo_window_class_name	char[12]	"Static NUL-terminated bytes ""TurboWindow""."	Binary bytes; four TWindow-derived VMTs select 1018:0d6a at +0x2c; focused far-pointer test.; complete verified referring-function closure	Exact registered class-name provider for the shared ObjectWindows window implementation.
1028:0698	1028:06b2	verified	object_windows_error_format	object_windows_error_format	char[27]	"Static NUL-terminated bytes ""Error code = %d. Continue?""."	Binary bytes and verified wvsprintf call at 1018:1f20-1f2c; reconstructed/tests/test_application_windows.c; complete verified referring-function closure	Signed decimal application error prompt; the sole conversion consumes the caller's uint16 word as int16.
1028:06b3	1028:06c4	verified	object_windows_error_caption	object_windows_error_caption	char[18]	"Static NUL-terminated bytes ""Application Error""."	Binary bytes and verified indirect MessageBox call at 1018:1f2f-1f3e.; complete verified referring-function closure	Exact caption for the ObjectWindows application error prompt.
1028:06fc	1028:06fd	verified	win16_previous_instance	g_win16_previous_instance	HINSTANCE16	Initialized from the hPrevInstance startup word by 1020:0002.	Startup write in 1020:0002; first-instance branch in verified 1018:1a61; reconstructed/tests/test_application.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:06fe	1028:06ff	verified	win16_instance	g_win16_instance	HINSTANCE16	Initialized from the current Win16 task instance by 1020:0002.	34 readers across resource/window/module paths; verified MakeProcInstance argument in 1018:1a61.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0700	1028:0701	verified	win16_show_command	g_win16_show_command	uint16_t	Initialized from DX by Win16 startup 1020:0002.	Startup write at 1020:0015; read by verified application initialization 1018:1b57; reconstructed/tests/test_application.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0702	1028:0705	verified	borland_command_line	g_borland_command_line	Win16FarPtr	Initialized exactly from startup ES:BX by verified 1020:0002.	Verified startup capture and command-token scanner 1020:0871; reconstructed/tests/test_borland_startup.c; complete verified referring-function closure	Exact far pointer to the NUL-terminated DOS command tail, including independent selector and wrapping offset semantics.
1028:0706	1028:0707	verified	borland_heap_segment_head	g_borland_heap_segment_head	uint16_t	Static zero; points to current selector in the circular local-heap segment ring.	Reads/writes in 1020:0167, 0195, 023c, 026a, 02d7; reconstructed/tests/test_heap_core.c; reconstructed/tests/test_heap_paths.c; complete verified referring-function closure	Circular insertion, successful-segment rotation, predecessor unlink, and final zeroing are represented and verified across one- and two-segment lifecycles.
1028:0708	1028:0709	verified	borland_local_heap_limit	g_borland_local_heap_limit	uint16_t	Static value 0x0400.	Threshold branches in 1020:01ca; reconstructed/tests/test_heap_paths.c; complete verified referring-function closure	Below-threshold local-first and above-threshold global-first paths, including fallback, are represented and branch-tested.
1028:070a	1028:070b	verified	borland_heap_segment_bytes	g_borland_heap_segment_bytes	uint16_t	Static value 0x2000.	Header/free-size construction and full-segment release tests.; complete verified referring-function closure	Exact 8-KiB local heap segment allocation size.
1028:06f4	1028:06f5	verified	borland_heap_reserve_size	g_borland_heap_reserve_bytes	uint16_t	Static value 0x2000.	Binary bytes and reads in 1008:2dff/2e22.; complete verified referring-function closure	Configured 8-KiB emergency heap reserve size.
1028:06f6	1028:06f9	verified	borland_heap_reserve	g_borland_heap_reserve	Win16FarPtr	Static null; allocated by 2dff and cleared by 2e22.	Verified null/allocation/free/clear lifecycle tests for 1008:2de0, 2dff, and 2e22.; complete verified referring-function closure	Emergency allocation released on OOM so the allocator can retry; underlying allocator is tracked separately.
1028:06fa	1028:06fa	verified	borland_heap_reserve_disabled	g_borland_heap_reserve_disabled	uint8_t	Static zero.	Branch in 1008:2e22 and writers in runtime setup/teardown.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:070c	1028:070d	verified	borland_global_alloc_flags	g_borland_global_alloc_flags	uint16_t	Static value 2.	Push at 1020:0222 and verified GlobalAlloc16 argument test.; complete verified referring-function closure	Exact flags passed for Borland global heap blocks.
1028:070e	1028:0711	verified	borland_heap_error_handler	g_borland_heap_error_handler	Win16FarPtr	Set by 1008:2e76 relocation to 1008:2e22.	Verified NE-segment binding to selector:2e22; indirect call at 1020:020c-0210.; complete verified referring-function closure	Allocator callback returns 0 stop, 1 no retry, or 2 retry after emergency-reserve release.
1028:0712	1028:0715	verified	borland_exit_proc	g_borland_exit_proc	Win16FarPtr	Static zero; mutable ExitProc head.	Reads/clears in 1020:00d2; writers throughout shutdown setup.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0716	1028:0717	verified	borland_exit_code	g_borland_exit_code_word	uint16_t	Static zero; AX store on runtime-exit entry.	Stores/reads in 1020:0061 and related runtime entries.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0718	1028:071b	verified	borland_error_location	g_borland_error_location	struct BorlandErrorLocation	Static zero; cleared by Halt and populated by run-error paths.	Reads/writes in 1020:0002, 005d, 0061, and runtime error helpers.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:071c	1028:071d	verified	borland_windows_mode	g_borland_windows_mode	uint16_t	Initialized from startup ES by verified 1020:0002.	Verified startup capture, termination consumer 1020:0061, and focused tests.; complete verified referring-function closure	Exact Win16 selector-valued mode word; nonzero selects ExitProc execution and GUI error reporting.
1028:071e	1028:071f	verified	borland_io_result	g_borland_io_result	_Atomic uint16_t	Static zero; 1020:0388 uses one locked-equivalent XCHG read-and-clear.	Atomic exchange in verified 1020:0388; reads/writes in runtime I/O and ExitProc paths.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0720	1028:0723	verified	borland_random_seed	g_borland_random_seed	uint32_t	Static zero; seeded from DOS time and advanced by the verified LCG.	Reads/writes in 1020:14a4, 14c1, 14de, 1501, and 1539; multiplier 0x08088405 proved from assembly.; complete verified referring-function closure	Exact modulo-2^32 Borland RandSeed state, stored low word then high word.
1028:0724	1028:0725	verified	borland_huge_pointer_increment	g_borland_huge_pointer_increment	uint16_t	Assigned the relocated KERNEL ordinal 114 equate __AHINCR by verified startup.	Relocation 5:4 at 1020:0051; Wine 11.15 __AHINCR=8; reconstructed/tests/test_borland_startup.c; complete verified referring-function closure	Exact selector increment used by Borland huge-pointer normalization; this import is runtime data, not a callable function.
1028:0726	1028:0726	verified	borland_cpu_level	g_borland_cpu_level	uint8_t	Set by verified startup from returned GetWinFlags AL.	Verified startup branches and consumers 1020:08a9, 08e6, 098c, and 09af; arithmetic and startup tests.; complete verified referring-function closure	Exact levels 0 for 086/186, 1 for 286, and 2 for 386-plus instruction selection.
1028:0727	1028:0727	verified	borland_file_mode	g_borland_file_mode	uint8_t	Static value 2.	Binary byte; sole read by verified generic open entry 1020:06ab; focused DOS-open test.; complete verified referring-function closure	Exact DOS AH=3d access mode passed for nonempty generic-file names.
1028:0728	1028:0747	verified	borland_runtime_error_text	g_borland_runtime_error_text	char[32]	Static string Runtime error 000 at 0000:0000. including NUL.	TDKPIN.EXE bytes; fixed write endpoints 0739, 0741, 0746 in 1020:0061.; complete verified referring-function closure	Mutable decimal error-code and uppercase hexadecimal segment/offset fields are written backward into fixed placeholders before MessageBox16.
1028:07c4	1028:07c4	verified	palette_update_active	g_palette_update_active	uint8_t	Zero-filled; reset by variant A wParam zero and set before synchronous invalidate/update in both verified handlers.	All palette-message readers/writers 1000:58e7,5956,59a0,5a37 are verified; palette message tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07cb	1028:07cb	verified	scene_ready	g_scene_ready	uint8_t	Zero-filled; set to one after verified scene redraw, score/status update, and DC release in 1000:5390.	Verified writer 1000:5390; asset-initializer tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07cc	1028:07cc	verified	assets_pending	g_assets_pending	uint8_t	Set during game initialization; nonzero selects the verified one-time asset-loading phase and is cleared at loading stage 34.	Verified reader/clear in 1000:5390; asset-initializer tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07cd	1028:07ce	verified	board_index	g_board_index	uint16_t	Zero-filled; selects DAT resource 1000+value in verified 1000:6129.	Verified setup reader; reconstructed/tests/test_board_overlay.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:07d1	1028:07d1	verified	current_player	g_current_player	uint8_t	Zero-filled; values 1..4 identify the active player and zero disables the status display.	Verified gating/index use in 1008:0b9e; status tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0867	1028:0868	verified	overlay_bitmap	g_overlay_bitmap	HBITMAP16	Zero-filled; assigned by verified DAT loaders 1000:5be5/6129 and deleted by verified destructors 5ba6/60e7 without clearing the slot.	Complete verified setup/destructor, 616e 640x460 drawing, and 5c13 high-score source-region lifecycle; overlay and high-score tests; complete verified referring-function closure	Exact global HBITMAP provenance, replacement, 32/204 high-score source, whole-overlay drawing, and ownership endpoints are fully proven.
1028:085b	1028:085c	verified	background_bitmap	g_background_bitmap	HBITMAP16	Zero-filled; assigned DAT 998 by verified asset initialization and selected by all verified low-level background blits.	Verified writer and readers 1008:07b6,0837,08bb,093f,0996/1000:5390; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:085d	1028:085e	verified	background_overlay_b	g_background_overlay_b	HBITMAP16	Zero-filled; assigned DAT 998 by verified asset initialization and consumed only by verified restore variant B.	Complete writer/reader inventory 1000:5390 and 1008:08bb; asset/render tests.; complete verified referring-function closure	Exact overlay-B resource, publication, restore role, and DGROUP extent are fully proven.
1028:085f	1028:0860	verified	background_overlay_a	g_background_overlay_a	HBITMAP16	Zero-filled; assigned DAT 997 by verified asset initialization and consumed only by verified restore variant A.	Complete writer/reader inventory 1000:5390 and 1008:0837; asset/render tests.; complete verified referring-function closure	Exact overlay-A resource, publication, restore role, and DGROUP extent are fully proven.
1028:0861	1028:0862	verified	digit_sprite_bitmap	g_digit_sprite_bitmap	HBITMAP16	Zero-filled; assigned BITMAP resource 500 by verified asset initialization and consumed by verified score renderer.	Complete writer/reader inventory 1000:5390 and 1008:0996; asset/score tests.; complete verified referring-function closure	Exact HBITMAP slot, resource ID, 16-pixel horizontal digit stride, and 28x16 SRCAND use are fully proven.
1028:0859	1028:085a	verified	dat600_bitmap	g_dat600_bitmap	HBITMAP16	Zero-filled; assigned DAT resource 600 at loading stage 33 by verified asset initialization.	Complete verified load/render/delete lifecycle 1000:5390,6f27,7440,51f5; mechanism and panel-animation tests; complete verified referring-function closure	Exact DAT600 atlas provenance, 91-pixel target frames, panel-animation mask/image regions, publication, and ownership lifecycle are fully proven.
1028:0863	1028:0864	verified	claw_sprite_bitmap	g_claw_sprite_bitmap	HBITMAP16	Zero-filled; assigned DAT resource 900 at loading stage 29 and deleted at asset shutdown.	Complete writer/reader/deletion inventory 1000:5390,1008:0e08,1000:51f5; asset/claw/cleanup tests; complete verified referring-function closure	Exact resource, atlas geometry, frame mapping, publication, rendering, and ownership lifecycle are fully proven.
1028:0865	1028:0866	verified	board_decoration_bitmap	g_board_decoration_bitmap	HBITMAP16	Zero-filled; assigned DAT resource 901 at loading stage 32 and deleted during asset shutdown without clearing the slot.	Complete verified lifecycle 1000:5390,638e,6b37,51f5; asset, key-release, gameplay-helper, and cleanup tests; complete verified referring-function closure	Exact DAT901 provenance, launch-decoration and velocity-row atlas geometry, presentation, and ownership endpoint are fully proven.
1028:086b	1028:086c	verified	displayed_status_level	g_displayed_status_level	uint16_t	Zero-filled; initialized/reset to 99 and assigned computed levels 0..4 by verified status renderer.	All renderer reads/writes in 1008:0b9e verified; status tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:0982	1028:0991	verified	player_scores	g_player_scores	int32_t[4]	Zero-filled; initialized/reset by game setup and updated by scoring paths.	Verified one-based reader 1008:0996; score-render tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:431b	1028:4322	verified	status_level_bitmaps	g_status_level_bitmaps	HBITMAP16[4]	Zero-filled; DAT resources 701..704 are loaded one-based by verified asset initialization.	Complete writer/reader/deletion inventory in 1000:5390,1008:0b9e,1000:51f5; asset/status/cleanup tests; complete verified referring-function closure	Exact four HBITMAP slots, resource mapping, threshold-level mapping, primary 146x142 blit use, and ownership lifecycle are fully proven.
1028:430b	1028:431a	verified	sprite_bitmaps_400_407	g_sprite_bitmaps_400_407	HBITMAP16[8]	Zero-filled; DAT resources 400..407 are loaded zero-based at stages 7..14 and deleted zero-based at shutdown.	Verified writer/deletion and ID order; asset initializer/cleanup tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:4323	1028:4334	verified	item_bitmaps_801_809	g_item_bitmaps_801_809	HBITMAP16[9]	Zero-filled; DAT resources 801..809 are loaded and deleted one-based.	Verified writer/deletion and ID order; asset initializer/cleanup tests; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:4263	1028:430a	verified	tdkpin_word_quads	g_tdkpin_word_quads	TdkpinWordQuad[21]	Zero-filled table; setup 1000:0270 writes indices 1..20 through verified 1008:0787.	Twenty direct calls with exact constants; byte-complete zero-fill range and writer tests.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:43be	1028:43ed	verified	wave_output_capabilities	wave_output_capabilities	WAVEOUTCAPS16	Zero-filled 48-byte buffer populated by waveOutGetDevCaps for device zero.	Windows 3.1 packed field offsets; call 1008:0fca-0fda; dwSupport read at 1008:0fe6-0ffe; strict size assertion and reconstructed/tests/test_sound.c; complete verified referring-function closure	Exact Win16 layout is wMid, wPid, 16-bit driver version, 32-byte name, formats, channels, and support; WAVECAPS_VOLUME is bit 4 at offset 44.
1028:43ee	1028:43ef	verified	wave_output_device_count	wave_output_device_count	uint16_t	Zero-filled; assigned from waveOutGetNumDevs and reset on entry or capability-query failure.	Complete verified lifecycle in 1008:0f2e,10e3,1131,118f and sound-toggle reader 1000:638e; reconstructed/tests/test_sound.c and test_key_release.c; complete verified referring-function closure	The word is the actual device count, not a Boolean initialized flag; nonzero permits keyboard re-enabling after sound has been disabled.
1028:43f0	1028:43f1	verified	wave_output_device_id	wave_output_device_id	uint16_t	Static zero and never written in the image.	Reads before the sole waveOutGetDevCaps and waveOutGetVolume calls at 1008:0fca and 1008:1008; reconstructed/tests/test_sound.c; complete verified referring-function closure	Selects wave-output device zero for both capability and volume queries.
1028:43f2	1028:43f2	verified	sound_enabled	sound_enabled	uint8_t	Zero-filled; cleared on every sound initialization entry, set after successful capability/resource setup, and toggled by F12 only when a device exists.	Complete verified readers/writers 1008:0002,0f2e,1131 and 1000:638e; sound and key-release tests; complete verified referring-function closure	Exact Boolean enable lifecycle, playback gates, disable behavior, and device-gated re-enable behavior are fully proven.
1028:43f3	1028:43f3	verified	sound_playing	sound_playing	uint8_t	Zero-filled; cleared by initialization/unload and assigned from sndPlaySound's BOOL16 result.	All reads/writes in verified 1008:0f2e, 10e3, 1131, and 118f; reconstructed/tests/test_sound.c; complete verified referring-function closure	Exact current-playing flag, including stop-without-clear behavior in 118f and failure-to-play clear in 1131.
1028:43f4	1028:43f4	verified	sound_volume_step	sound_volume_step	uint8_t	Zero-filled; set to ff when volume control is unsupported, otherwise the left-channel high byte rounded down to a multiple of ten.	Disassembly 1008:0fe6-102e; exact byte extraction/divide/multiply path; reconstructed/tests/test_sound.c; complete verified referring-function closure	Written during successful initialization and otherwise retained; no in-image reader exists.
1028:43f5	1028:43f5	verified	sound_state_padding	sound_state_padding	uint8_t	Zero-filled and never referenced directly.	Byte lies between the verified one-byte volume state and aligned far-pointer array; complete reference inventory contains no reader or writer.; complete verified referring-function closure	Explicit alignment/padding byte retained so the first sound pointer begins at 43f6.
1028:43f6	1028:444d	verified	sound_buffers	sound_buffers	Win16FarPtr[22]	Zero-filled; sound setup stores locked global-memory blocks for resource numbers 2001..2022.	All indexed accesses in verified 1008:0f2e, 10e3, and 1131; exact one-based addressing and focused lifecycle tests in reconstructed/tests/test_sound.c; complete verified referring-function closure	Exact 22 far-pointer slots, load overwrite behavior, inclusive release order, lack of pointer clearing, and play selection are represented.
1028:444e	1028:444f	verified	tdkpin_palette_handle	tdkpin_palette_handle	HPALETTE16	Zero-filled; assigned the CreatePalette16 result by verified 1008:11c5.	Complete reader inventory spans rendering/window functions; verified writer and bitmap loader 1008:149d; reconstructed/tests/test_palette.c; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:4450	1028:474f	verified	tdkpin_palette_rgb	tdkpin_palette_rgb	uint8_t[256][3]	Zero-filled then overwritten byte-for-byte from custom PAL resource 999 by verified 1008:1326.	All consumers verified: LOGPALETTE RGB projection 1008:11c5 and BITMAPINFO BGR0 projection 1008:13a8; reconstructed/tests/test_palette.c; complete verified referring-function closure	Exact 768-byte RGB triplet table, resource provenance, copy extent, palette-entry projection, RGBQUAD channel reversal, and full read/write inventory are proven.
1028:4750	1028:477b	verified	multimedia_procedures	g_multimedia_procedures	Win16FarPtr[11]	Static zero; populated in exact CTL3D name order by verified loader 1010:01c2.	Verified load/use/legacy-slot-8/clear lifecycle and focused tests.; complete verified referring-function closure	Slots are AutoSubclass, ColorChange, CtlColorEx, Enabled, DlgFramePaint, GetVer, Register, SubclassDlg, SubclassDlgEx, SubclassCtl, Unregister.
1028:477c	1028:477d	verified	multimedia_version	g_multimedia_version	uint16_t	Static zero; assigned from CTL3DGETVER after successful registration.	Verified loader version >=9 gate and version-8 cleanup test.; complete verified referring-function closure	Exact CTL3D compatibility version word.
1028:477e	1028:477e	verified	multimedia_auto_subclassed	g_multimedia_auto_subclassed	uint8_t	Static zero; set from CTL3DAUTOSUBCLASS only on modern/nonzero-request path.	Verified modern success and legacy/disabled zero branches.; complete verified referring-function closure	Boolean records whether process auto-subclassing succeeded.
1028:477f	1028:477f	verified	multimedia_argument_2	g_multimedia_argument_2	uint8_t	Stored from loader second byte argument after full initialization.	Disassembly 1010:0373; focused export/loader test.; complete verified referring-function closure	Exact parameter publication order is second argument first.
1028:4780	1028:4780	verified	multimedia_argument_1	g_multimedia_argument_1	uint8_t	Stored from loader first byte argument after full initialization.	Disassembly 1010:0376; focused export/loader test.; complete verified referring-function closure	Exact parameter publication order is second argument then first.
1028:4781	1028:4782	verified	multimedia_module	g_multimedia_module	HINSTANCE16	Static zero; assigned by LoadLibrary16 and retained after FreeLibrary16.	Verified <32 error, modern/legacy load, failure unload, and explicit cleanup tests.; complete verified referring-function closure	Unaligned module handle; values below 32 are Win16 load errors rather than unloadable handles.
1028:4783	1028:4783	verified	multimedia_pending	g_multimedia_pending	uint8_t	Static zero; cleared by unit startup and every exported initialization return.	Verified stores in 1010:03af/0472 and multimedia tests.; complete verified referring-function closure	Exact transient pending byte; no reader exists in this image.
1028:4784	1028:4784	verified	multimedia_initialized	g_multimedia_initialized	uint8_t	Static zero; set only after Register, GetVer >=9, and Enabled all succeed; cleared by cleanup.	Complete verified loader/finalizer/unload lifecycle and branch tests.; complete verified referring-function closure	Gates every dynamic helper use with exact boolean semantics.
1028:478a	1028:478b	verified	multimedia_windows_version	g_multimedia_windows_version	uint16_t	Low word returned by GetVersion16 during unit startup.	Verified 3.0/3.10/4.0 major-minor branches and startup tests.; complete verified referring-function closure	Low-byte major, high-byte minor; upper GetVersion word is discarded.
1028:478c	1028:478c	verified	multimedia_legacy_windows	g_multimedia_legacy_windows	uint8_t	Set exactly for Windows 3.0 through 3.9.	Verified writer and all loader branch consumers.; complete verified referring-function closure	Selects path probing, legacy procedure policy, and AutoSubclass suppression.
1028:478d	1028:47a1	verified	multimedia_library_path	g_multimedia_library_path	char[21]	Zero-fill; populated with CTL3DV2.DLL or CTL3D.DLL according to exact existence policy.	Verified unit writer, loader readers, all selection branches, and tests.; complete verified referring-function closure	Exact 21-byte NUL-terminated selected DLL basename/path buffer.
1028:47a2	1028:47a3	verified	multimedia_system_directory_length	g_multimedia_system_directory_length	uint16_t	Return from GetSystemDirectory16 with maximum 200.	Verified zero/nonzero path-probe gate and tests.; complete verified referring-function closure	Exact length for adjacent system-directory buffer.
1028:47a4	1028:486b	verified	multimedia_system_directory	g_multimedia_system_directory	char[200]	Zero-fill; populated by GetSystemDirectory16 during unit startup.	Verified two ShortString path constructions and maximum size.; complete verified referring-function closure	Exact transient NUL-terminated system directory buffer.
1028:486d	1028:496c	verified	multimedia_ctl3d_full_path	g_multimedia_ctl3d_full_path	uint8_t[256]	"Constructed as system directory + ""\\"" + CTL3D.DLL."	Verified ShortString helpers, file probe, and startup tests.; complete verified referring-function closure	Exact Pascal ShortString classic DLL full path.
1028:496d	1028:4a6c	verified	multimedia_ctl3dv2_full_path	g_multimedia_ctl3dv2_full_path	uint8_t[256]	"Constructed as system directory + ""\\"" + CTL3DV2.DLL."	Verified ShortString helpers, preferred file probe, and startup tests.; complete verified referring-function closure	Exact Pascal ShortString V2 DLL full path.
1028:4a6e	1028:4abd	verified	tpwincrt_window_title	g_tpwincrt_window_title	char[80]	Zero-fill; populated with the module filename and converted in-place OEM to ANSI.	Verified unit initialization, CreateWindow title, ExitProc formatting, and lifecycle tests.; complete verified referring-function closure	Exact TPWinCrt application caption buffer.
1028:4abe	1028:4ac1	verified	tpwincrt_saved_exit_proc	g_tpwincrt_saved_exit_proc	Win16FarPtr	Zero-fill; receives the prior Borland ExitProc.	Verified predecessor save/restore ordering and lifecycle tests.; complete verified referring-function closure	Exact mutable ExitProc chain link.
1028:4ac2	1028:4ac5	verified	tpwincrt_screen_buffer	g_tpwincrt_screen_buffer	Win16FarPtr	Static zero; allocated on WM_CREATE and released on WM_DESTROY.	Verified allocation/fill, circular readers, free/clear lifecycle, and tests.; complete verified referring-function closure	Exact far pointer to columns*rows character cells.
1028:4ac6	1028:4ad3	verified	tpwincrt_view_metrics	g_tpwincrt_view_metrics	struct TpWinCrtViewMetrics	Static zero; populated from client size/font metrics.	All arithmetic, caret, paint, scroll, size, and initialization paths are verified.; complete verified referring-function closure	Seven exact uint16 fields: visible dimensions, max origins, character dimensions, and caret y offset.
1028:4ad4	1028:4ad5	verified	tpwincrt_paint_dc	g_tpwincrt_paint_dc	HDC16	Static zero; assigned by GetDC16 or BeginPaint16.	Verified 1008:1779/17e2 and paint/render consumers.; complete verified referring-function closure	Exact object boundary, type, initialization, and full in-image reader/writer lifecycle are verified.
1028:4ad6	1028:4af5	verified	tpwincrt_paint_struct	g_tpwincrt_paint	PAINTSTRUCT16	Zero-filled persistent structure populated by BeginPaint16.	Wine 11.15 PAINTSTRUCT16 layout; fixed pointer in 1008:1779/17e2; rcPaint reads in verified 1008:1dcc.; complete verified referring-function closure	Exact HDC, erase flag, RECT16, restore/update flags, and 16 reserved bytes; extent ends immediately before saved font at 4af6.
1028:4af6	1028:4af7	verified	tpwincrt_previous_font	g_tpwincrt_previous_font	HGDIOBJ16	Static zero; receives SelectObject16 result.	Verified paired stores/reads in 1008:1779 and 17e2.; complete verified referring-function closure	Stock-font replacement is restored exactly before releasing the drawing context.
1028:4af8	1028:4b37	verified	tpwincrt_input_buffer	g_tpwincrt_input_buffer	uint8_t[64]	Zero-filled DGROUP storage.	Verified append, signed-capacity suppression, blocking dequeue, overlapping shift, line editing, and focused tests.; complete verified referring-function closure	Exact fixed 64-byte FIFO input queue.