# City world-entry track ID cross-check, r400

This audit connects the installed executable's track lookup to the installed
`GLOBALB.BUN` metadata. It narrows the default stream choice; it does not prove
that one stream contains every retail city district.

## Executable lookup

In the installed `SPEED2.EXE` (SHA-256
`f9dd86c054878ce6276beb07c1fd61874f7a1e4bf1f241b084c65b73e24168a7`), the
world-entry path at `0x00581580` reads the selected key from `0x0089e7a0` and
passes it to `0x005d3e40`. That helper scans the loaded `0x128`-byte track
records at `0x00883da0` (count at `0x00883da4`) and compares the key with the
signed 16-bit field at record `+0x8a`. The matching record is stored at
`0x00883dac`. The stream setup at `0x0057a580` reads that record's string at
`+0x40` and formats `TRACKS\STREAM%s.BUN`.

The startup entry path provides a more specific cross-check. At `0x00581820`,
the executable checks mode global `0x00850078`; when it is `1` and the world
override pointer at `0x00863470` is null, it calls `0x00540780`. That routine
sets the selected-key global `0x0089e7a0` to `0x0fa0` (decimal 4000), then
loads the matching record. The same caller uses the selected record's `+0x40`
string to validate the stream name before handing off to the load path. Thus
track 4000 is the executable's fallback world entry for this mode-1/no-override
startup path. The gameplay name of mode value 1 is not identified in this
trace, and other paths can supply a selected track or override.

## Installed data cross-check

The matching `GLOBALB.BUN` record is at byte offset 7,562,776. Its label is
`(40XX-41XX) Circuit/Sprint`, its path is `Location4\Track_4000`, its region
field is `L4RA`, and both serialized 16-bit track IDs are 4000. The extracted
file SHA-256 is
`07e1c37a2e5ba4b3e6a17b257e653409c31d5f0b3f9df3464aec36adbbced9d0`.

L4RA is also the strongest recovered free-roam scene candidate in the local
assets: `L4RA.BUN` has a `FREE_ROAM` group with 54 member references and the
`RoutesFreeRoam-L4RA` export has 832 route records. L4RD has a `FREE_ROAM` group
as well, but 26 route records. Several other streams have free-roam route
exports without a named `FREE_ROAM` scenery group; that distinction is not
proof of their runtime availability.

## Viewer implication and remaining gap

The viewer's default L4RA scene agrees with the installed track-4000 record
and the executable's mode-1/no-override fallback, so it is a source-backed
default for that path. The 8-stream union remains unsupported by
the executable's one-active-track lookup and by the heavy overlap in the
regional geometry. The available evidence still does not prove whether L4RA
alone contains the full Bayview world or when the game changes the active
track ID during free roam. The current player start at L4RA route 450, distance
525, is a checked viewer start, not a recovered retail spawn.

Next, trace which menu/save state selects track 4000, whether free roam can
switch active track records while the player moves, and where retail stores the
player spawn. Until that is established, keep L4RA as the default drive scene
and treat other streams as separate scene previews rather than adjacent tiles.