XModels and Surfaces

Status

Root loader family: strong static cross-reference. Member layout and surface serialization: partial. These findings identify loader responsibilities and selected call paths; they do not establish that Game-Test and Replay share serialized offsets.

Game-Test source evidence

The source PDB has exact Load_XModel, Preload_XModel, Postload_XModel, and Mark_XModel roots. XAssetHeader dispatch associates XModel with source type case 0x9. See root crosswalk and source member offset evidence.

Replay 1.20 evidence

Replay asset phase switches also use case 0x9; observed wrapper routes reach generic XModel roots at RVAs 0xE29820, 0xE2E9C0, 0xE2CEA0, and 0xE2B620 for the documented phases. A 0x2B0 stream advance is observed in the root route. These are Replay-build observations, not source offsets. The root crosswalk report records target rows and call evidence.

Current evidence also includes XModel pointer marking and always-loaded/surface allocation work. Treat each helper as its own function and confirm target row ownership before reusing a candidate.

Integration and safe use

The map/asset root reaches XModel through asset-type dispatch; later rendering consumers use model and surface data. The evidence supports tracing that route and locating candidate child loaders. It does not yet establish the complete model/surface serialization contract or a portable header layout.

Open questions

Which surface allocation and stream helpers have an independently verified source-to-Replay caller chain?
Which Replay field accesses confirm each proposed source member offset?
Do source and Replay counts/strides agree for every XModel subarray?

Evidence

XModel root crosswalk
XModel source member offset leads
Cross-reference symbol register

Alwaysloaded flags and XModel surface pointers

A separately reviewed source/Replay path follows XModelSurfsPtrArray into Load_AlwaysloadedFlagSet. The Game-Test source PDB identifies Load_AlwaysloadedFlagSet at RVA 0x8DBFF0 (383 bytes) and AllocLoad_XModelSurfsPtr at 0x897A40 (33 bytes). The root reads a 0x38-byte record in the source body, loops through XModel and flag children, then processes the trailing surface-pointer array.

Replay rows are ID 20385 at RVA 0xE2F9B0 (q_Load_AlwaysloadedFlagSet, stored size 376) and ID 20319 at RVA 0xE28540 (q_AllocLoad_XModelSurfsPtr, stored size 26). Parent ID 20385 calls the allocator and then existing q_Load_XModelSurfsPtrArray ID 20338. Replay performs the same observed 0x38-byte root read and accesses the count/pointer pair at +0x18/+0x20, then the pointer/count pair at +0x30/+0x28. These are per-build code observations, not a cross-build structure definition.

The Replay chained unwind coverage totals 380 bytes for ID 20385 while its SQLite size remains 376; preserve the stored size and prototype. The source parent has three wrapper callers, while the current indexed Replay graph exposes one generic parent. Both names therefore remain q-prefixed. See the full AlwaysloadedFlagSet report and coordinator apply manifest.

XSurface Load candidate

Replay ID 20339 is named q_Load_XSurface (RVA 0xE2ABA0, SQLite size and standalone .pdata extent 1013 bytes; Replay prototype unchanged: __int64 __fastcall sub_140E2ABA0(__int64 a1)). Its source PDB anchor is unique Load_XSurface ID 24847 at RVA 0x8B3F90, size 1077, signature void __cdecl Load_XSurface(DBStreamStart). The paired Load_XModelSurfs parent calls the candidate in a count-controlled loop in both builds; each advances per element by 0xC0. The matching stride is a code observation only, not a portable layout or serialized ABI.

Keep q_: source has five indexed direct callers, while the Replay callgraph export shows one direct caller and the Replay row's indegree=81 remains unreconciled. The parent pair and body similarity support the scalar-loader role, but caller/wrapper coverage remains incomplete. No source prototype, field offsets, or layout are transferred.

Evidence: XSurface loader review, proposal row, and coordinator render-asset applied batch.

Fastfile-to-runtime map

See XModel Fastfile to DObj Flow for the verified XModel/XModelSurfs fastfile paths, the source DObj/render consumer chain, Replay runtime anchors, and the unresolved cross-build edge.

XSurface subdivision-level array child

Replay ID 20342 at RVA 0xE2B130 is now q_Load_XSurfaceSubdivLevelArray, paired provisionally with Game-Test source PDB/Atlas ID 24866, Load_XSurfaceSubdivLevelArray, RVA 0x8B5770, 85 bytes. The earlier imported Preload_XSurfaceSubdivLevelArray label was corrected: the Replay target is called by the Load-phase parent ID 20341 and its own bytes show a counted traversal. Replay multiplies the supplied count by target-local 0x238, streams that block, then iterates records with 0x238 pointer increments and per-record pointer/sentinel handling. Its SQLite size 810 is preserved; three adjacent PDATA fragments total 810: [0xE2B130,0xE2B161), [0xE2B161,0xE2B44E), and [0xE2B44E,0xE2B45A).

The source array wrapper ID 24866 has an 85-byte PDATA extent and uses source-local stride 0x128, then calls the separate scalar Load_XSurfaceSubdivLevel ID 24865. Its source Load_XSurfaceSubdivInfo parent calls that scalar child directly; the paired Replay q_Load_XSurfaceSubdivInfo ID 20341 instead calls ID 20342 as a counted child. Thus the array-level role is supported by Replay's own loop and parent call, but source and Replay child granularity changed. Body ranking is weak: the highest mnemonic-sequence score is only 0.4489 against the prior Preload candidate, with scalar Load at 0.4046; the old exact-looking label was not reliable evidence. Keep q_ and do not transfer stride, layout, ABI, prototype, or serialization details across builds.

Evidence: coordinator review, applied-name manifest, existing XSurface scalar-loader review, subdivision-info parent review, and BlendShapes child review.

XModel decal-volume info child — q-candidate

The coordinator review proposes Replay ID 20331 at RVA 0xE2A270 (sub_140E2A270, current report snapshot; size 162; prototype __int64 __fastcall sub_140E2A270(__int64 a1)) as q_Load_XModelDecalVolumesInfo, paired with exact Game-Test PDB/Atlas ID 24807 Load_XModelDecalVolumesInfo at RVA 0x8B1870 (284 bytes). This remains a q-candidate; no SQLite name change is claimed by this page.

Independent evidence includes a global source-code-symbol body ranking: source ID 24807 ranks 1st of 72,922 source functions with exact source .pdata starts (sequence ratio 0.973451, normalized token Jaccard 0.975610); next candidates score substantially lower. Source and Replay complete chained PDATA ranges are 284 and 291 bytes respectively, although Replay SQLite exports only 162 bytes and omits calls visible in the full target extent. Under the paired q_Load_XModel parents, the source and Replay sibling order matches: Load_XModelBlendShapeInfo/its paired Replay child, then the decal-volume-info candidate. Source call targets go through linker stubs resolved by Atlas to exact function starts; Replay calls target the direct function entries. Nearby member displacements differ (0x2A0 source, 0x2A8 Replay) and are not cross-build offsets.

There is a nested-child caveat: source ID 24807 calls Load_GfxDecalVolumeMaskPtr, but its primary 103-byte wrapper range normalizes to the same wrapper pattern as source Load_MapEdgeListPtr; Replay ID 20331 visibly calls Load_MapEdgeListPtr ID 20008. That structural alias does not make the source field types semantically interchangeable, and it does not justify renaming Replay ID 20008 to a decal-volume-mask loader. Keep that child identity unresolved.

The source signature void __cdecl Load_XModelDecalVolumesInfo(DBStreamStart), source members/types, and source-side offsets do not establish Replay prototype, ABI, serialized layout, stride, or field semantics. Replay function ownership, SQLite export coverage, and source/Replay child granularity differences are why the parent remains q-qualified. See the coordinator cross-reference report, global scan manifest, global ranking CSV, and reproduction scripts for callsite windows and PDATA ranges. The general XModel root pairing is documented in the root cross-reference report.

XModel Mark pointer-array route

Replay ID 20351 at RVA 0xE2BC60 is now named Mark_XModelPtrArray, paired with source Atlas/PDB ID 25025 at RVA 0x8B9EC0 (172-byte source body). The body scan ranks it 33rd among the globally compared source functions because many generated typed Mark_*PtrArray bodies share the same 0.989011 ordered-sequence ratio and 0.970588 instruction-token Jaccard score. Its call constellation—Mark_XModelAsset, Mark_XModel, then Mark_XModelAsset—also occurs in source Mark_GfxStaticModelArray ID 24949 and Mark_XModelPtr ID 25024, so the body/callee pattern alone does not decide the type.

Two independently paired named parents distinguish the Replay target. Source Mark_ScriptableDef ID 10639 and Replay ID 18574 have exact normalized body agreement; each calls its pointer-array child at parent offset +0xAE. Source Mark_WeaponAttachment ID 21859 and Replay ID 20101 call the same child twice at matching parent offsets +0xC4 and +0xF2. These paired caller routes, not the generated-body score or provisional child labels, support the XModel pointer-array identity. A provisional q_Mark_StreamTreeGrid parent is only corroboration.

Replay PDATA for ID 20351 is [0xE2BC60,0xE2BD10), a standalone 176-byte range. Its SQLite size remains 172 bytes, four bytes shorter; the name-only batch preserved the SQLite size, prototype, and mangled name. The source PDATA/body size is 172 bytes. Keep the PDATA/SQLite mismatch explicit. This mapping does not transfer signature, calling convention, argument meaning, structure layout, count stride, or serialized-size assumptions between builds.

Evidence: coordinator cross-reference and applied decision, applied-row CSV, guarded apply manifest, global body-scan manifest, and global body-ranking CSV.