acdream/docs/research/2026-08-10-options-panel-structure.md

Retail Options panel — structure, open path, Apply/Reset/Defaults, Chat + Config tab contents

Date: 2026-08-10 Lane: Settings-track RESEARCH LANE A (handoff questions Q1 and Q3, plus the Chat/Config tab derivation). Status: RESEARCH ONLY — no production code changed, nothing built, nothing launched. Handoff this answers: docs/research/2026-08-10-settings-track-handoff.md §"Research questions" items 1 and 3, with partial pre-work on items 5 and 6.

Primary sources and evidence discipline

• docs/research/named-retail/acclient_2013_pseudo_c.txt (Binary Ninja pseudo-C, Sept 2013 EoR build, PDB names) and docs/research/named-retail/symbols.json.
• Byte-verified against the PDB-paired binary C:\Users\erikn\Downloads\acclient.exe. py tools/pdb-extract/check_exe_pdb.py "C:/Users/erikn/Downloads/acclient.exe" reports === MATCH: this exe pairs with our acclient.pdb === (linker UTC 2013-09-06T00:17:56, CodeView GUID 9e847e2f-777c-4bd9-886c-22256bb87f32). Every load-bearing constant below that BN rendered as 0 or as a zero-idiom was re-read from the raw section bytes with a throwaway PE reader (scratchpad peread.py / decode_addchild.py, not committed).
• The installed DATs at %USERPROFILE%\Documents\Asheron's Call\ read through Chorizite.DatReaderWriter 2.1.7 via DatCollection — the same reader production uses. Throwaway scratchpad probe (not committed); recipe per docs/research/2026-08-10-retail-ui-text-style.md §tooling. NOTE: a standalone PortalDatabase/LocalDatabase throws on LayoutDesc unpack (writer.Database.DatCollection is null!) — you must open a DatCollection.
• The retail UserPreferences.ini sitting next to the user's DATs — a live retail artifact that independently cross-checks the Config tab's preference keys and default values.

Everything marked UNKNOWN / UNVERIFIED below is genuinely not established. Nothing is guessed.

---

0. Headline

Retail's Options panel is one LayoutDesc — 0x2100002B — that carries the tab control, the four mounted tab pages, and the option-row template list, all in one file. The four pages are four separate UIElement classes registered by class id, each authored in its own LayoutDesc and mounted into the tab host by BaseLayoutId/BaseElement. The panel is opened by input action 0x1000001A = ToggleOptionsPanel (F11 by default, and the toolbar's options button fires the same action).

The Apply model is the opposite of what a modern designer would build: every LED click applies immediately. "Apply" only commits the undo baseline (and flushes the character-options blob); "Reset" reverts to that baseline; "Defaults" loads the retail default and applies it live without committing. Hiding a page auto-reverts uncommitted edits.

---

1. The class family and the layout inventory (Q1)

1.1 Classes

Retail class	Element class id	Register	Create	InitOptions	Purpose
OptionPage	— (abstract)	—	—	—	base: registered-option array + save/restore/changed
PlayerOptionPage : OptionPage	— (abstract)	—	—	—	base: ListBox-backed row builders
gmGameplayOptionsUI	0x10000029	0x0049E0F0	0x0049E060	(none — pure button list)	Tab 1 "Gameplay Options"
gmCharacterSettingsUI	0x10000027	0x004A02D0	0x004A01D0	0x004A02F0	Tab 2 "Character"
gmChatOptionsUI	0x10000042	0x0049FC40	0x0049FBA0	0x0049FC60	Tab 3 "Chat"
gmConfigUI	0x10000028	0x0049E8D0	0x0049E340	0x0049E400	Tab 4 "Config"
gmKeyboardUI	0x1000000E	0x004DCF70	0x004DC080	0x004DD8B0	"Configure Keyboard" screen (separate window)

OptionPage members (symbols.json): RegisterOption 0x004F2E90, SaveCurrentValues 0x004F2C60, RestoreSavedValues 0x004F2D00, RestoreDefaultValues 0x004F2CB0, Changed 0x004F2D60.

PlayerOptionPage members: AddHeader 0x004F28B0, AddSeperator 0x004F2730 (retail's own spelling), AddToggleOption two overloads 0x004F2990 (PStringBase<char> prefName) and 0x004F2A00 (enum PlayerOption), AddToggleWithSliderOption 0x004F2930, AddSliderOption 0x004F2A70, AddMenuOption 0x004F2AF0, SetToggleLabel 0x004F2750, SetSliderLabel 0x004F2B80, OnOptionChanged 0x004F27D0, OnOptionChangeConfirmed 0x004F2850, OnVisibilityChanged 0x004F26E0, SaveCurrentValues 0x004F2710.

UIOption widget classes (the row leaves), by DynamicCast id:

DynamicCast id	Class	Row child element looked up
0x10000035	UIOption_Checkbox	0x10000219
0x10000036	UIOption_CheckboxSlider	(the row root itself)
0x10000037	UIOption_Slider	0x1000021C
0x10000038	UIOption_Menu	0x10000224
0x10000044	UIOption_CheckboxBitfield64	(the row root itself)

There is also UIOption_ActionKeyMap (keyboard screen) and UIOption_CheckboxBitfield (32-bit variant, Apply 0x00486490 — not used by any of the four Options tabs).

1.2 LayoutDescs (all in client_local_English.dat)

LayoutDesc	Root element	Root Type	Size	What it is
0x2100002B	0x10000208	0x00000008 (TabControl)	300 × 600	The Options panel: tab strip + 4 mounted pages + 7 row templates
0x2100002A	0x10000202	0x10000029	300 × 337	Gameplay Options page
0x21000028	0x100001F9	0x10000027	292 × 600	Character page
0x2100005C	0x1000050A	0x10000042	292 × 600	Chat page
0x21000029	0x100001FF	0x10000028	292 × 600	Config page
0x21000009	0x1000001F	3	800 × 600	Configure Keyboard full-screen screen (contains 0x10000020 T=0x1000000E, 590 × 462)

Each page root also carries P0x58 = enum 1 and a P0x57 enum — see §2.3.

1.3 The tab control — element 0x10000208, Type 8

Authored properties on the tab-host root:

P0x58 = enum 1
P0x57 = enum 0x1000001A          <- the input action that toggles this window (see §2)
P0x2E = ARRAY of 4 StructBaseProperty (MasterPropertyId 0x2F), each:
          0x30 = <tab button element id>
          0x31 = <tab page element id>
          0x32 = bool  (true on exactly one entry = the initially selected tab)

The four decoded entries, in authored array order:

#	0x30 tab button	0x31 page slot	0x32 default	Tab label (StringId, table 0x23000001)
0	0x1000020D (0,0) 106×25	0x10000212	True	0x0AFFD072 → "Gameplay Options"
1	0x1000020E (106,0) 64×25	0x10000211	False	"Character"
2	0x1000050B (172,0) 50×25	0x1000050C	False	"Chat"
3	0x1000020F (222,0) 56×25	0x10000213	False	"Config"

Left-to-right x order = 0, 106, 172, 222 → Gameplay Options | Character | Chat | Config, exactly matching the user's screenshot. Tab buttons all inherit base 0x2100004D/0x1000043A.

Additional children of 0x10000208:

Element	Geometry	Notes
0x10000209	(0,25) 2×575, image	left border strip beside the page area
0x10000210	(276,0) 24×25	close (X) button; P0x12 = enum 0x1000001A; has Normal + Normal_pressed media
0x10000211	(2,25) 298×575	Character page slot ← base 0x21000028/0x100001F9
0x10000212	(2,25) 298×575	Gameplay page slot ← base 0x2100002A/0x10000202
0x1000050C	(2,25) 298×575	Chat page slot ← base 0x2100005C/0x1000050A
0x10000213	(2,25) 298×575	Config page slot ← base 0x21000029/0x100001FF

1.4 Where the Options panel is hosted

0x2100002B/0x10000208 is mounted (by base reference) into exactly two host layouts, both at slot element 0x1000018D inside a shared page-stack container 0x10000180:

Host LayoutDesc	Root	Root type	Root size	Container	Slot key P0x10000029
0x21000017	0x1000017B	0x10000008 = gmPanelUI (Register 0x004BC9AA)	309×482 @ (491,28), ZLevel 800	0x10000180 (9,120) 300×362	0x1000018D → 10 (0xA)
0x2100006E	0x100005FE	0x1000004F = gmFloatyPanelUI (Register 0x004D1A1A)	310×372	0x10000180 (5,5) 300×362	0x1000018D → 10 (0xA)

0x21000017 is the legacy docked right-hand panel (it also carries the radar, 0x1000003D T=0x10000010 = gmRadarUI). 0x2100006E is the modern floating, resizable window frame — eight 5 px border strips (0x10000653–0x1000065A) plus T=9 resize grips / T=2 dragbar, which is the same shell family Campaign CH6 ported. The page-stack slot is authored 300×362; the panel content is authored 300×600, so retail's parent-resize policy scales it — and because the floaty frame is resizable, the user's tall screenshot is the resized state, not a third layout. The whole panel is 300 px wide and the option ListBox is 276 px wide with a 16 px scrollbar.

The same 0x10000180 stack holds ~16 sibling panels (allegiance, skills, attributes, inventory, character info …), each keyed by P0x10000029. The Options panel's key is 10.

1.5 The row mechanism — a ListBox with an authored template list

PostInit on each page fetches its ListBox and stores it as m_pOptionBox:

Page	GetChildRecursive(this, …)	ListBox element	Cast
Character	0x100001FA (gmCharacterSettingsUI::PostInit @0x004A0280)	0x100001FA 276×560, T=5	DynamicCast(5)
Config	0x10000200 (gmConfigUI::PostInit @0x0049E840)	0x10000200 276×560, T=5	DynamicCast(5)
Chat	0x1000050D (gmChatOptionsUI::PostInit @0x0049F100)	0x1000050D 276×560, T=5	DynamicCast(5)

Every row is created by UIElement_ListBox::AddItemFromTemplateList(m_pOptionBox, <index>, nullptr). The template list is authored on the ListBox as property 0x64 — an array of StructBaseProperty where 0x63 = template LayoutDesc DID and 0x62 = template element id. All templates live in 0x2100002B.

Template arrays as authored (index → element):

idx	Character (0x100001FA)	Config (0x10000200)	Chat (0x1000050D)	Template element	Builder
0	0x10000216	0x10000216	0x10000216	292×22, base 0x2100003F/0x1000038C	AddHeader
1	0x10000217	0x10000217	0x10000217	292×8, image	AddSeperator
2	0x10000218	0x10000218	0x10000218	272×20, child 0x10000219 (checkbox)	AddToggleOption
3	—	0x1000021A	0x1000021A	272×20, label 0x1000021B + slider 0x1000021C	AddSliderOption(arg3 == 0)
4	—	0x10000222	0x10000222	272×20, label 0x10000223 + menu 0x10000224	AddMenuOption
5	—	0x10000220	0x10000220	272×20, T=0x10000036	AddToggleWithSliderOption
6	—	0x1000021D	0x1000021D	272×36, + range labels 0x1000021E/0x1000021F	AddSliderOption(arg3 != 0)
7	—	0x10000221	0x10000221	272×36, T=0x10000036 + range labels	(unused by the four tabs)
8	—	—	0x10000520	272×100, T=0x10000044	CheckboxBitfield64 block

0x10000521 (272×20, child 0x10000219 with base 0x21000044/0x10000329) exists in 0x2100002B but is not in any of the three template arrays — UNKNOWN consumer.

Byte-verified slider index selection. BN renders PlayerOptionPage::AddSliderOption's index as (((eax - eax) & 3) + 3), which is the known neg/sbb zero-idiom artifact class. The real instruction sequence at 0x004F2A80–0x004F2A90 is neg eax; sbb eax,eax; and eax,3; add eax,3, i.e. index 6 when arg3 != 0, index 3 when arg3 == 0. This is corroborated behaviourally: every AddSliderOption(..., 1) call in gmConfigUI::InitOptions is followed by a SetSliderLabel (which writes children 0x1000021E/0x1000021F — present only on template 6), and the one AddSliderOption(..., 0) call (Input_MouseLookSensitivity) is not.

PlayerOptionPage::AddHeader casts the created row to 0xC (UIElement_Text) and writes StringInfo::SetStringIDandTableEnum(&si, arg2, 0x10000003). Table enum 0x10000003 resolves to StringTable DID 0x23000003 — confirmed by hashing every ID_* label name below and finding it in that table. SetToggleLabel writes the same table for both label (UIElement_Text::SetStringInfo) and tooltip (vtable+0x2B4).

---

2. How the panel opens and closes (Q1c)

2.1 Keybind — action 0x1000001A = ToggleOptionsPanel, default F11

• docs/research/named-retail/keymap-default.txt:139 — F11 (scan=0x57, dev=0) Action=0x1000001A Activation=0x03
• docs/research/named-retail/retail-default.keymap.txt:148 — ToggleOptionsPanel [ "" [ 0 DIK_F11 ] ] under the UICommands group.

acdream's KeyBindings.RetailDefaults() already carries this row (F11 opens the current non-retail settings panel).

2.2 Toolbar button — 0x1000019B in LayoutDesc 0x21000016

From the committed fixture tests/AcDream.App.Tests/UI/Layout/fixtures/toolbar_21000016.json:

/0x10000191/0x1000019B   T=0x00000001 (UIElement_Button)   pos=(204,0)  34x27
   P0x12 = Enum 268435482 = 0x1000001A
   Normal    media 0x0600051C
   Highlight media 0x0600051E

Property 0x12 on a UIElement_Button is the input-action enum the button fires — already established by Campaign CH (docs/research/2026-08-09-chat-retail-window-shell.md lines 208-214, UIElement_Button reading its own 0x12 at 0x00471E65). The dispatch is UIElementManager::BroadcastGlobalMessage(inst, 1, <actionId>) — global message 1 = "an input action fired", param = the action id (confirmed by gmToolbarUI::ListenToGlobalMessage @0x004BE4E0, which switches on arg3 in 0x10000042…0x1000004D to fire shortcut slots).

For orientation, the toolbar's full action row (same fixture):

Element	x	Action P0x12
0x10000197	55	0x1000000D
0x10000198	85	0x10000010
0x10000199	115	0x10000013
0x1000055A	145	0x100001E7
0x1000019A	175	0x10000016
0x1000019B	204	0x1000001A — Options
0x100001B1	238	0x10000019

2.3 Close — the same action

The tab-host close button 0x10000210 carries P0x12 = 0x1000001A, i.e. it fires the same ToggleOptionsPanel action. The tab-host root 0x10000208 carries P0x57 = 0x1000001A. Each page root carries its own P0x57: Gameplay 0x1000001B, Character 0x1000001C, Config 0x1000001D, Chat 0x10000113.

UNVERIFIED: the exact semantics of property 0x57. The correlation (host 0x57 == close button's 0x12) makes "the toggle action this element registers itself under" the obvious reading, but I did not locate the GetAttribute_Enum(this, 0x57, …) read site in the decomp. Treat as strongly-indicated, not proven.

---

3. Apply / Reset / Defaults (Q3)

3.1 The three buttons

gmCharacterSettingsUI::ListenToElementMessage @0x0049E3A0 — the same address is bound to gmChatOptionsUI::ListenToElementMessage and gmConfigUI::ListenToElementMessage in the PDB (identical-COMDAT folding; all three pages share one handler body):

0049e3b5   if (idElement == 0x100001FC)  this->vtable->SaveCurrentValues();     // APPLY
0049e3b8   if (idElement == 0x100001FD)  this->vtable->RestoreSavedValues();    // RESET
0049e3bb   if (idElement == 0x100001FE)  this->vtable->RestoreDefaultValues();  // DEFAULTS

Authored geometry (identical on all three pages that have them — Character 0x21000028, Config 0x21000029, Chat 0x2100005C; all base 0x21000040/0x100002CD, 80×32, y = 564):

Element	x	Label
0x100001FC	16	Apply (0x00A09C49 on Character, 0x09BA3C39 on Config/Chat — different StringIds, same literal)
0x100001FD	106	Reset (0x00D024B4 / 0x09CA84C4)
0x100001FE	196	Defaults (0x051FC993 / 0x0F183833)

The Gameplay Options page (0x2100002A) has no Apply/Reset/Defaults — it is a pure button list. This matches the user's screenshot note ("Apply / Reset / Defaults at the bottom of (at least) the Character tab").

3.2 Per-tab, not global

Each page is its own OptionPage with its own m_UIOptionArray. Apply/Reset/Defaults act on that page's registered options only. The Character page's Apply does not touch the Config page's sliders.

3.3 What each one does

OptionPage (all three iterate m_UIOptionArray and &= the results, then call this->vtable->OnOptionChanged(0)):

Button	OptionPage method	Per-option call	Gated on Changed()?
Apply	SaveCurrentValues @0x004F2C60	vtable +0x2C8 = SaveCurrentValue()	No — every option
Reset	RestoreSavedValues @0x004F2D00	vtable slot RestoreSavedValue()	Yes — only options whose +0x2BC Changed() is true
Defaults	RestoreDefaultValues @0x004F2CB0	vtable +0x2C4 = RestoreDefaultValue()	No — every option

OptionPage::Changed @0x004F2D60 returns true if any registered option's Changed() is true.

Leaf semantics (UIOption_Checkbox, the canonical case):

Changed            @0x004868C0   return m_saved != m_current;
SaveCurrentValue   @0x004868E0   m_current = GetValue(); m_saved = m_current; return 1;
RestoreSavedValue  @0x00486900   m_current = m_saved;    Apply(0); Refresh();
RestoreDefaultValue@0x00486930   m_current = m_default;  Apply(0); Refresh();
SetDefaultValue    @0x00486960   m_default = arg2;
SetCurrentValue    @0x00486970   m_current = arg2; SetAttribute_Bool(this, 0xE, arg2); Apply(1);

The load-bearing consequence: SetCurrentValue — which is what the user's click on the LED runs — calls Apply(1) immediately. The option takes effect in the live game the instant you click it. Apply is therefore not "now do the thing"; it is "commit this as the new undo baseline".

• Apply = m_saved = m_current per option ⇒ Changed() goes false ⇒ Reset can no longer undo. (Plus the blob flush, §3.5.)
• Reset = m_current = m_saved and re-Apply(0) ⇒ reverts the live game state to the last committed baseline.
• Defaults = m_current = m_default and Apply(0) ⇒ pushes the retail default into the live game state, but does not commit; Changed() becomes true, so Apply/Reset light up and Reset still undoes it. Defaults comes from SetDefaultValue, which is authored in code in each page's InitOptions (Config and Chat) or is UNKNOWN-defaulted (Character — see below).

3.4 Button enable/disable

PlayerOptionPage::OnOptionChanged @0x004F27D0:

eax   = GetChildRecursive(<the gm*UI element>, 0x100001FC);   // Apply
eax_1 = GetChildRecursive(<the gm*UI element>, 0x100001FD);   // Reset
if (OptionPage::Changed(...) == 0) { SetState(0x0D) on both }  // disabled
else                               { SetState(0x01) on both }  // enabled

Defaults (0x100001FE) is never enable-gated — it is always clickable. PostInit calls InitOptions() then OnOptionChanged(0) so the buttons start disabled.

PlayerOptionPage::OnOptionChangeConfirmed @0x004F2850 calls back into the owning element when arg3 != 0.

3.5 What Apply sends — the character-options blob and its dirty timer

PlayerOptionPage::SaveCurrentValues @0x004F2710 overrides the base and does two things:

004f271d   CPlayerModule::SaveToServer(&CPlayerSystem::GetPlayerSystem()->playerModule, 0);
004f2725   return OptionPage::SaveCurrentValues(this);      // tailcall

CPlayerModule::SaveToServer @0x0059A660:

if (m_bDirty != 0 || arg2 != 0)
    CM_Character::Event_CharacterOptionsEvent(&this->vtable);   // 0x006A10C0 — the full blob
m_bDirty = 0;

CM_Character::Event_CharacterOptionsEvent @0x006A10C0 is the full-blob SetCharacterOptions sender (the 0x01A1 builder that CH3 deleted — exact field layout is Lane B / handoff Q4).

The dirty flag is set by CPlayerModule::OnChanged:

• OnChanged(BaseProperty*, uint32) @0x0059A890 — sends CM_UI::SendNotice_GameplayOptionChanged, then, only if not already dirty, sets m_bDirty = 1 (offset +0x1A8) and stamps m_timeFirstDirtied (offset +0x1AC, double) with Timer::cur_time.
• OnChanged(PlayerOption) @0x0059A8E0 — sends CM_UI::SendNotice_PlayerOptionChanged, applies the immediate local side effects (case 4 → SmartBox::EnableWeather, case 5 → LScape::SetDay, case 7 → ClientCombatSystem::TrackTarget, case 0x30 → LScape::m_fFogEnabled, cases 2/0x12 → the mutual exclusion between IgnoreFellowshipRequests and FellowshipAutoAcceptRequests), then:

  0059a99d   if (CPlayerModule::IsAutoSaveOption(this-4, arg2))
  0059a9ac       CM_Character::Event_PlayerOptionChangedEvent(arg2, GetOption(this, arg2));  // SINGLE-option send
  0059a9c1   else  { if (!dirty) { dirty = 1; m_timeFirstDirtied = Timer::cur_time; } }
  

  So retail has BOTH paths. An option that CPlayerModule::IsAutoSaveOption returns true for is sent immediately as a single-option event (this is the SetSingleCharacterOption 0x0005 family acdream already implements). Everything else is batched into the blob. Which options are auto-save is UNKNOWN here — enumerate CPlayerModule::IsAutoSaveOption in Lane B; it is the discriminator for "0x0005 per change vs one 0x01A1 blob".

Byte-verified auto-flush timer — CPlayerModule::UseTime @0x0059A710:

0059a713  mov  al, [esi+0x1A8]          ; m_bDirty
0059a719  test al, al
0059a71b  jz   0059a749                 ; not dirty -> return
0059a71d  fld  qword [0x007E5358]       ; constant
0059a723  fadd qword [esi+0x1B0]        ; + m_timeFirstDirtied
0059a729  fcomp qword [0x008369A8]      ; vs Timer::cur_time
0059a72f  fnstsw ax
0059a731  test ah, 0x41
0059a734  jp   0059a749                 ; ST0 > cur_time (or unordered) -> skip
0059a736  lea  eax,[esi+4] / push / call CM_Character::Event_CharacterOptionsEvent
0059a742  mov  byte [esi+0x1A8], 0

Raw bytes at 0x007E5358 = 00 00 00 00 00 00 7e 40 = 480.0. So: if any non-auto-save option is dirty, the blob is flushed automatically 480 seconds (8 minutes) after the first change, measured from the first dirtying, not the last.

Other SaveToServer callers: CPlayerSystem::LogOffCharacter @0x00563520 calls SaveToServer(&playerModule, 0) before ExecuteLogOff. Those are the only two call sites in the binary.

3.6 Showing/hiding a page auto-applies / auto-reverts

PlayerOptionPage::OnVisibilityChanged @0x004F26E0:

UIElement::OnVisibilityChanged(this, arg2);
if (arg2 != 0)  this->vtable->SaveCurrentValues();     // becoming visible  -> APPLY
else            this->vtable->RestoreSavedValues();    // becoming hidden   -> RESET

Switching tabs, or closing the Options window, silently reverts any uncommitted edits on the page you left. This is a real, user-visible retail behaviour and must be ported, not "improved".

3.7 UIOption::Apply — the three write targets

UIOption_Checkbox::Apply @0x00486C60 branches on how the option was bound:

1. m_propName != 0 → gameplay-option property bag: BaseProperty::SetPropertyName(&p, m_propName), set value = m_current, then PlayerModule::SetOption(pm, &p) (0x005D52C0 — HashTable::set into m_colGameplayOptions then OnChanged(prop, 0)).
2. m_prefName path → UIPreferences::ModifyPreference(m_prefName, m_current), and on success CM_UI::SendNotice_UserPreferenceChanged(m_prefName). This is the UserPreferences.ini path used by the whole Config tab. Nothing goes over the wire. (BN renders the branch predicate as m_playerOption == ~AutoRepeatAttack_PlayerOption, which is a not/cmp artifact. The branch's BODY is unambiguous; the exact predicate is UNVERIFIED. It is almost certainly "no PlayerOption bound", i.e. the prefName binding.)
3. else → PlayerModule::SetOption(pm, m_playerOption, m_current) (0x005D3EB0 — a switch over enum PlayerOption writing the options_ word bits and calling OnChanged(option)). This is the Character tab path.

All three then call this->vtable->HandleDialogAndNotices(arg2).

UIOption::HandleDialogAndNotices @0x004EFB90:

if (m_confirmChange && arg2)          UIOption::HandleDialog(this);
if (m_shouldReloadOptions)            CM_Character::SendNotice_ReloadOptions();
if (m_shouldRefreshOptionsPanel)      CM_UI::SendNotice_RefreshOptionsPanel();
if (m_noticeFuncPtr)                  m_noticeFuncPtr();
if (m_pOCH && arg2)                   m_pOCH->OnOptionChanged(this);

So Apply(1) (user click) may raise the confirmation dialog and notifies the page (which re-runs Changed() and lights up Apply/Reset). Apply(0) (from Reset/Defaults) skips both — the page calls OnOptionChanged(0) itself afterwards.

UIOption::SetConfirmChange is used exactly once on the four tabs: gmConfigUI::InitOptions @0x0049E5BF sets it on the Display_Resolution menu.

UIOption_CheckboxBitfield64::Apply @0x00485FF0 has the same shape but dispatches on m_propType:

004860b3   if (m_propType == Normal_PropType)  PlayerModule::SetOption(pm, &prop);
004860c4   else if (m_propType == 1)           PlayerModule::SetChatWindowOption(pm, m_nUserData, &prop);

m_nUserData is set by UIOption::SetUserData(option, <retail window id>). The other SetChatWindowOption call sites in the binary pass this->m_eWindowID — which independently confirms Campaign CH6's identity model (main = 8, floaties = 2..5) and confirms that the Chat tab's SetUserData argument is the retail window id.

---

4. The Config tab — complete row map (gmConfigUI::InitOptions @0x0049E400)

Six sections, 6 headers / 5 interior separators + 1 trailing / 27 option rows (corrected 2026-08-11 at the OP6 re-review — the original 24 was a miscount; the decomp has 27 Add*Option calls and the OP6 slice's 39-item count pin (6+6+27) is the authoritative tally). Bindings are PStringBase<char> preference-key globals whose names are Section_Key; they map one-to-one onto UserPreferences.ini sections (verified against the user's live retail UserPreferences.ini). All headers byte-verified from mov eax,[global]; push eax operands.

#	Header global (VA)	StringId	Literal
1	ID_Sound_SoundSection (0x0083E750)	0x09FB638E	Sound Options
2	ID_Camera_CameraSection (0x0083E754)	0x08A8429E	Camera Options
3	ID_Graphics_GraphicsSection (0x0083E758)	0x0D95A11E	Graphics Options
4	ID_Graphics_TextureSection (0x0083E75C)	0x018580EE	Rendering Quality Options
5	ID_Input_InputSection (0x0083E760)	0x01BAE38E	Input Options
6	ID_UI_UISection (0x0083E764)	0x0D25AC1E	UI Options

Section	#	Widget	Preference key	SetDefaultValue	Decomp VA
Sound Options	1	Menu (UIPreference)	Sound_SoundFeatures	0	0x0049E418
	2	Toggle+Slider	Sound_SoundDisabled / Sound_SoundVolume	1, 0x3F800000 = 1.0f	0x0049E435
	3	Toggle+Slider	Sound_AmbientSoundDisabled / Sound_AmbientSoundVolume	1, 1.0f	0x0049E457
	4	Toggle+Slider	Sound_InterfaceSoundDisabled / Sound_InterfaceSoundVolume	1, 1.0f	0x0049E479
	5	Toggle	Sound_PlaySoundOnlyWhenActive	1	0x0049E496
Camera Options	6	Slider (labelled)	Camera_Stiffness	0x3EE66666 = 0.45f	0x0049E4C4
	7	Slider (labelled)	Camera_AdjustmentSpeed	0x42200000 = 40.0f	0x0049E501
	8	Slider (labelled)	Render_FieldOfView	0x42B40000 = 90.0f	0x0049E53E
	9	Toggle	Camera_AlignToSlope	1	0x0049E571
Graphics Options	10	Menu (UserPreference, arg3 == 0)	Display_Resolution	0x03200258 = 800 × 600; SetConfirmChange(1)	0x0049E5A5
	11	Toggle	Display_FullScreen	1	0x0049E5CB
	12	Toggle	Display_SyncToRefresh	0	0x0049E5E3
	13	Slider (labelled)	Render_ScreenBrightness	0 = 0.0f	0x0049E5FD
	14	Toggle	Render_AutomaticDegrades	0	0x0049E62C
	15	Slider (labelled)	Render_GraphicsPerformance	0 = 0.0f	0x0049E646
	16	Slider (labelled)	Render_DegradeDistance	0x42480000 = 50.0f	0x0049E677
Rendering Quality	17	Menu	Render_LandscapeTextureDetail	2	0x0049E6BF
	18	Menu	Render_EnvironmentTextureDetail	1	0x0049E6D9
	19	Menu	Render_TextureFiltering	1	0x0049E6F3
	20	Menu	Render_LandscapeDrawDistance	8	0x0049E70D
	21	Toggle	Render_BuildingDetailTextures	1	0x0049E725
	22	Toggle	Render_MultiPassAlpha	0	0x0049E73D
Input Options	23	Slider (unlabelled, arg3 == 0)	Input_MouseLookSensitivity	0x3F0CCCCD = 0.55f	0x0049E76B
	24	Toggle	Input_InvertMouseLookYAxis	0	0x0049E78C
	25	Toggle	Input_UseMouseTurning	0	0x0049E7AA
UI Options	26	Menu	UI_ChatFontFace	2	0x0049E7DE
	27	Menu	UI_ChatFontSize	1	0x0049E7F8

(27 Add* calls; the three toggle+slider rows are one widget each, so the visible row count is 27.)

Cross-validated against the user's live retail UserPreferences.ini: Camera Stiffness = 0.45, AdjustmentSpeed = 40.00, FieldOfView = 90.00, SoundVolume/AmbientSoundVolume/ InterfaceSoundVolume = 1.00, ScreenBrightness = 0.00. Every decomp default that the ini still holds at its default value matches exactly.

Slider range labels come from ID_Graphics_Value_* globals at 0x0083E768–0x0083E794: Dark/Bright, Speed/Detail, Close/Far, Narrow/Wide, Slow/Fast, Soft/Hard (six labelled sliders, six label pairs — the pairing order is UNVERIFIED; the exact SetSliderLabel operand pairs would need the same push-imm decode I ran on AddHeader).

gmConfigUI extras:

• PostInit also RegisterNoticeHandler(0x4DD276, …) and UIListener::RegisterForGlobalMessage(this, 0x0C).
• ListenToGlobalMessage @0x0049EB90: if (arg2 == 0x0C) SetMouseTurningDefaults(this).
• SetMouseTurningDefaults @0x0049E8F0 clamps m_pStiffness to 0.95f (when below) and prints a chat line ("Camera Stiffness was changed fro…"), plus the same treatment on m_pAdjustmentSpeed, m_pSensitivity, m_pInvert, m_pMouseTurn, m_pSlope. Exact clamp set is out of Lane A scope.
• RecvNotice_UserPreferenceChanged_Menu @0x0049EBA0 reacts to Render_LandscapeTextureDetail changes.

Not on the 2013 Config tab, though present in UserPreferences.ini: Render_SceneryDrawDistance, Render_DisplayAdapter, Render_AspectRatio, Render_LandscapeDetailTextures, Display_RefreshRate, Net_*, Misc_TooltipDelay, Misc_TooltipEnable (globals exist at 0x0083EAA4/0x0083EAA8 and strings "Tooltip Delay" exists in table 0x23000003), International_UseIME, Input_MouseLookSmoothingAmount, Input_KeymapFile. Those are either the external config/launcher's surface or a later build's rows. UNKNOWN which.

---

5. The Chat tab — complete row map (gmChatOptionsUI::InitOptions @0x0049FC60)

Six sections. Headers byte-verified from the mov <reg>,[global] operands:

#	Header global (VA)	Section content
1	ID_ChatOption_GeneralOptions_Section (0x0083E810)	the two opacity sliders
2	ID_ChatOption_MainChatWindow_Section (0x0083E814)	filter block, SetUserData(8)
3	ID_ChatOption_FloatyChatWindow1_Section (0x0083E818)	filter block, SetUserData(2)
4	ID_ChatOption_FloatyChatWindow2_Section (0x0083E81C)	filter block, SetUserData(3)
5	ID_ChatOption_FloatyChatWindow3_Section (0x0083E820)	filter block, SetUserData(4)
6	ID_ChatOption_FloatyChatWindow4_Section (0x0083E824)	filter block, SetUserData(5)

(Table 0x23000003 also holds "Chat Window 1"…"Chat Window 4" at 0x0DC3B9FE/0x0DC3B8FE/ 0x0DC3B7FE/0x0DC3B6FE; the six headers above are the ones actually pushed.)

5.1 General Options — two linked opacity sliders

Slider	Template idx	Gameplay option property	Notes
1	3 (unlabelled row)	0x10000080 Option_DefaultOpacity_Property	UIOption_Slider::SetGameplayOptionProperty @0x0049FCC0
2	6 (labelled row)	0x10000081 Option_ActiveOpacity_Property	@0x0049FD1A; then SetSliderLabel(this, slider2, <min>, <max>)

Range labels come from ID_UI_Value_Transparent (0x0083E828) and ID_UI_Value_Opaque (0x0083E82C). The two sliders are then linked:

0049fd5c   DualHash<UIOption_Slider*,UIOption_Slider*>::add(&this->m_hashSliderLinks, &slider1, &slider2);

which is the "linking DRAGS the other value (never clamps)" behaviour CH6c already ported.

5.2 The five per-window text-type filter blocks

Each block is one UIOption_CheckboxBitfield64 created from template index 8 (0x10000520, T=0x10000044, 272×100), bound with SetGameplayOptionProperty(opt, 0x1000007F, Chat_PropType) (Chat_PropType == 1, so Apply routes through PlayerModule::SetChatWindowOption(pm, m_nUserData, prop)), SetUserData(<windowId>), SetDefaultValue(<low>, <high>), then N AddChild(lowMask, highMask, labelId, tooltipId) and one CreateChildren.

Windows 2/3/4 go through the shared helper gmChatOptionsUI::AddCheckboxBitfield64Option @0x0049EDA0; windows 8 and 5 are written inline in InitOptions (the helper is inlined at those two sites — the helper's own switch covers cases 2/3/4/5/8, so the semantics are identical).

Defaults, byte-verified from the helper's switch and the inline blocks:

Retail window id	Default filter (high:low)	Site
8 (main)	0x00000000_FBFFFFFF	0x0049FDD1 / helper case 8 0x0049EE16
2 (floaty 1)	0x00000000_0000101C	helper case 2 0x0049EE2B
3 (floaty 2)	0x00000000_00040C00	helper case 3 0x0049EE34
4 (floaty 3)	0x00000000_00080000	helper case 4 0x0049EE3D
5 (floaty 4)	0x00000000_78000000	helper case 5 0x0049EE46 / inline 0x004A0010

The main window's default 0xFBFFFFFF matches CH6's finding exactly (Society bit 0x20… opt-in).

The checkbox rows — byte-decoded from the mov <reg>,[global]; push; push; push high; push low; call AddChild sequences (decode_addchild.py over the raw section bytes; masks are 64-bit, high:low):

Row	Mask (high:low)	Label global	Label literal (table 0x23000003)
0	0x00000000_83912021	ID_ChatOption_TextFilter_Gameplay (0x0083E840)	Gameplay
1	0x00000000_00600040	ID_ChatOption_TextFilter_Combat (0x0083E830)	Combat
2	0x00000000_00020080	ID_ChatOption_TextFilter_Magic (0x0083E848)	Magic
3	0x00000000_00001004	ID_ChatOption_TextFilter_AreaSpeech (0x0083E838)	Area Speech
4	0x00000000_00000018	ID_ChatOption_TextFilter_Tells (0x0083E850)	Tells
5	0x00000000_00040C00	ID_ChatOption_TextFilter_Allegience (0x0083E858)	Allegiance (retail's own misspelling in the symbol)
6	0x00000000_00080000	ID_ChatOption_TextFilter_Fellowship (0x0083E860)	Fellowship
7	0x00000000_08000000	ID_ChatOption_TextFilter_General (0x0083E868)	General
8	0x00000000_10000000	ID_ChatOption_TextFilter_Trade (0x0083E870)	Trade
9	0x00000000_20000000	ID_ChatOption_TextFilter_LFG (0x0083E878)	LFG
10	0x00000000_40000000	ID_ChatOption_TextFilter_Roleplay (0x0083E880)	Roleplay
11	0x00000001_00000000	ID_ChatOption_TextFilter_Society (0x0083E888)	Society
12	0x00000000_04000000	ID_ChatOption_TextFilter_Error (0x0083E890)	Error

Every row's tooltip is the matching …_Desc global at label+4.

Row 0 ("Gameplay") is present on windows 2/3/4/5 and ABSENT on window 8 (main). Verified two ways: the inline main-window block at 0x0049FDF6–0x0049FF1C emits exactly 12 AddChild calls starting at Combat, while the inline window-5 block at 0x004A002D– 0x004A016F emits 13 starting at Gameplay; and in the helper, case 8 breaks past the Gameplay AddChild at 0x0049EE6C while cases 2/3/4/5 fall through the shared label_49EE4F into it. Retail does not let you switch gameplay text off in the main chat window.

So the Chat tab is: 2 sliders + 5 blocks × (12 or 13) checkboxes = 2 + 12 + 13×4 = 66 interactive controls, in 6 sections.

---

6. The Gameplay Options tab — complete map (LayoutDesc 0x2100002A)

Seven buttons, all base 0x21000040/0x10000618, all 240×32 at x = 26, no LEDs, no Apply/Reset/Defaults. Handler: gmGameplayOptionsUI::ListenToElementMessage @0x0049E110 (only reacts to idMessage == 1).

y	Element	Label (table 0x23000001)	What retail does
20	0x10000203	0x071D9AC4 Exit to Character Selection	CM_UI::SendNotice_EndCharacterSession(1) @ 0x0049E1D0
60	0x10000617	0x0BB75264 Exit Game	BroadcastGlobalMessage(inst, 1, 0x10000027) @ 0x0049E298–0x0049E2AB — fires input action 0x10000027
110	0x10000204	0x0694E944 Configure Keyboard	not handled in C++; authored P0x12 = enum 0x1000001F → the button self-fires action 0x1000001F
150	0x100005CC	0x0A35EE57 Use Mouse Turning Settings	BroadcastGlobalMessage(inst, 0x0C, 0) @ 0x0049E2A1–0x0049E2AB → gmConfigUI::SetMouseTurningDefaults
190	0x10000205	0x0BB03250 In-Game Help Files	not handled in C++; authored P0x12 = enum 123 (0x7B) = the ToggleHelp action (F1 in keymap-default.txt:132)
240	0x10000206	0x0145FCA5 Urgent Assistance	ShellExecuteA(nullptr,"open", "http://support.turbine.com/ics/s…", …) @ 0x0049E154–0x0049E16B; on failure MessageBoxA(…, "Asheron's Call Error", MB_OK)
280	0x10000207	0x02F2FD45 Report Abuse	same ShellExecuteA shape @ 0x0049E1F0–0x0049E207, different URL

The button-branch dispatch is byte-verified (0x0049E28C: sub eax,0x100005CC; jz → push 0 / push 0x0C; sub eax,0x4B; jnz → fall through; push 0x10000027 / push 1 — 0x100005CC + 0x4B == 0x10000617 ✓).

Neither "Urgent Assistance" nor "Report Abuse" sends a game message. Both are external browser launches. The two URLs are support.turbine.com support-ticket links (both truncated at BN's ~33-char preview; the full strings were not extracted because they are dead links today and acdream will not open them — flagged for the planner as a deliberate divergence candidate).

UNKNOWN / UNVERIFIED:

• Action 0x10000027 ("Exit Game") — no default keybind, and I did not identify its consumer. That it means "quit" rests on the button's authored label only.
• Action 0x1000001F ("Configure Keyboard") — no default keybind. Strongly corroborated: the Configure Keyboard screen's own OK (0x1000002C) and Cancel (0x1000002D) buttons also carry P0x12 = 0x1000001F, which is exactly the toggle-window pattern.

---

7. The Character tab — structural inventory (full option map is Lane B / Q2)

gmCharacterSettingsUI::InitOptions @0x004A02F0 — 6 headers, 5 interior separators + 1 trailing, 49 toggle rows, no sliders, no menus. Every row is SetToggleLabel(this, AddToggleOption(this, <PlayerOption>), ID_PlayerOption_X, ID_PlayerOption_X_Help) (the enum PlayerOption overload, 0x004F2A00), so the tab is homogeneous.

Header global (VA)	StringId	Literal	Rows
ID_CharacterOption_UIBehavior_Section (0x0083EA5C)	0x06489B6E	User Interface Behavior	3
ID_CharacterOption_UIDisplay_Section (0x0083EA60)	0x0A9BC99E	User Interface Display	15
ID_CharacterOption_Grouping_Section (0x0083EA64)	0x0CBAAFAE	Grouping	6
ID_CharacterOption_OtherPlayers_Section (0x0083EA68)	0x0872DFFE	Other Players	11
ID_CharacterOption_CharacterBehavior_Section (0x0083EA6C)	0x08674D5E	Character Behavior	7
ID_CharacterOption_Chat_Section (0x0083EA70)	0x0987FE8E	Chat	7

All six header globals byte-verified from their mov eax,[0x0083EA5C+4n]; push eax operands at 0x004A02EA, 0x004A0431, 0x004A0ABF, 0x004A0D63, 0x004A122A, 0x004A154B, and all six hashes verified name→compute_str_hash→string-table entry.

Rows in authored order (the PlayerOption enumerator names, for Lane B to bind):

1. ViewCombatTarget, SalvageMultiple, MainPackPreferred
2. VividTargetingIndicator, ShowTooltips, CoordinatesOnRadar, SideBySideVitals, SpellDuration, DisableMostWeatherEffects, DisableDistanceFog, PersistentAtDay, DisableHouseRestrictionEffects, UseCraftSuccessDialog, ConfirmVolatileRareUse, DisplayTimeStamps, FilterLanguage, ShowHelm, ShowCloak
3. IgnoreAllegianceRequests, IgnoreFellowshipRequests, DisplayAllegianceLogonNotifications, FellowshipShareXP, FellowshipShareLoot, FellowshipAutoAcceptRequests
4. AcceptLootPermits, UseDeception, AllowGive, IgnoreTradeRequests, DragItemOnPlayerOpensSecureTrade, DisplayDateOfBirth, DisplayAge, DisplayChessRank, DisplayFishingSkill, DisplayNumberDeaths, DisplayNumberCharacterTitles
5. ToggleRun, AdvancedCombatUI, AutoTarget, AutoRepeatAttack, UseChargeAttack, LeadMissileTargets, UseFastMissiles
6. StayInChatMode, HearAllegianceChat, HearGeneralChat, HearTradeChat, HearLFGChat, HearRoleplayChat, HearSocietyChat

This is a 1:1 match with the user's transcribed screenshots — with exactly one exception.

⚠ Build-version divergence: "Listen to PK death messages"

The user transcribed an 8th row in the Chat group. The 2013 EoR build's gmCharacterSettingsUI::InitOptions has only 7 — it ends at HearSocietyChat and then AddSeperator. However, StringTable 0x23000003 does contain 0x0D16E9A3 = "Listen to PK death messages.", and compute_str_hash("ID_PlayerOption_HearPKDeaths") == 0x0D16E9A3 exactly. There is no HearPKDeath* reference anywhere in the 2013 pseudo-C.

Conclusion: the row was added after the Sept 2013 build; the user's screenshot is from a later client. The installed DATs carry the string, so acdream can render it, and ACE exposes the matching option. Lane B must decide whether acdream ships 49 or 50 rows — this is a real fork, not a transcription error.

Note also ID_PlayerOption_ShowHelm resolves differently in the two tables (0x23000003: "Show Your Helm or Head Gear" = the label; 0x23000005: "Your helmet or head gear is visible." = a status line). The options UI uses table enum 0x10000003 → 0x23000003.

No SetDefaultValue call appears anywhere in gmCharacterSettingsUI::InitOptions — so every Character-tab checkbox's m_default stays at whatever UIOption_Checkbox's constructor leaves it. That means the Defaults button on the Character tab does not restore ACE's CharacterOptions1.Default = 0x50C4A54A; its behaviour is UNVERIFIED and must be established before implementing (read UIOption_Checkbox's ctor, or UIOption::InqDefaultGameplayOptionProperty @ symbols.json). This is the single biggest open unknown in the Apply/Reset/Defaults story.

---

8. Configure Keyboard (pre-work for handoff Q5)

LayoutDesc 0x21000009 — a full-screen 800×600 layout (root 0x1000001F, T=3), frame 0x10000451 (600×476 @ 100,62, base 0x21000042/0x100002B0), containing 0x10000020 T=0x1000000E = gmKeyboardUI, 590×462 @ (5,7).

Element	Geometry	Content
0x1000049B	586×388, T=8 (TabControl)	6 tabs: Movement 0x05330A42, Camera 0x0F5EE5E2, Combat 0x0F1E0AC2, UI 0x06FF16E2, Emotes 0x0A3A04A2, CharacterSettings 0x03765382
0x100004A7	586×363	the binding grid: column headers Command 0x0FDD849C, Mapping 1 0x0D11C1CC, Mapping 2 0x0D41C1CC, Mapping 3 0x0D31C1CC; ListBox 0x10000025 (570×345, T=5) + scrollbar 0x10000026
0x1000002F	570×40, T=0x10000034	the UIOption_ActionKeyMap row template
0x10000027	(50,390) 100×32	Load File… 0x06E9046E
0x10000028	(150,390) 290×32	current keymap filename label
0x10000029	(440,390) 100×32	Save As… 0x048840AE
0x1000002A	(0,430) 100×32	Defaults 0x039D522E
0x1000002B	(100,430) 100×32	Revert 0x077FC0AE
0x1000002C	(390,430) 100×32	OK 0x0055D40E, P0x12 = 0x1000001F
0x1000002D	(490,430) 100×32	Cancel 0x08653BBE, P0x12 = 0x1000001F

Supporting decomp: gmKeyboardUI::AddActionKeyMap 0x004DB2F0, GetKeymapDirectory 0x004DA8E0, GetStringInfoFromInputMapID 0x004DA980, SaveKeymap 0x004DCF90 (appends .keymap when the extension is missing), MakeLoadKeymapDialog 0x004DC0B0, MakeSaveKeymapDialog 0x004DC5B0, MakeOverwriteKeymapDialog 0x004DCA20, MakeCantOverwriteReadOnlyKeymapDialog 0x004DC7B0, RestoreDefaultValues 0x004DA850, UpdateKeymapFilenameLabel 0x004DB290, and the UIOption_ActionKeyMap family (InitiateBinding, SetBinding, EraseBinding, ClearAllBindings, KeyHitHandler, OpenOverwriteBindingDialog, OpenMapWarnDialog, SetMouseTurningDefaults). Storage is the on-disk .keymap file named by [Input] KeymapFile in UserPreferences.ini — nothing keyboard-related goes over the wire. The user's own DAT dir currently holds acclient.keymap and test.keymap.

Note the retail keyboard screen is NOT one of the four Options tabs — it is a separate 800×600 modal screen reached by the "Configure Keyboard" button.

---

9. Binary-Ninja artifacts encountered (add to the DO-NOT-RETRY class list)

1. AddHeader(this, 0) is never literally 0. BN prints the argument as 0 because it is mov eax, [<global>]; push eax. The real values are the twelve ID_*_Section string-hash globals at 0x0083E750+, 0x0083E810+, 0x0083EA5C+. Every header in this document was recovered from the raw operand bytes.
2. AddChild(..., 0, 0) likewise drops the label/tooltip operands. They too are mov <reg>,[<global>]; push <reg> pairs. All 13 Chat-filter labels came from a push-operand decode, not from the pseudo-C.
3. (((eax - eax) & 3) + 3) in AddSliderOption is the neg/sbb zero-idiom class already in the chat digest. Real result: arg3 ? 6 : 3.
4. Identical-COMDAT folding aliases symbols. gmCharacterSettingsUI::ListenToElementMessage, gmChatOptionsUI::ListenToElementMessage, and gmConfigUI::ListenToElementMessage all resolve to 0x0049E3A0; gmGameplayOptionsUI::ListenToGlobalMessage and gmKeyboardUI::ListenToGlobalMessage both to 0x004F5860; gmGameplayOptionsUI::PostInit is listed at 0x004BFA00, which the pseudo-C prints as gmCGProfessionPage::PostInit. A shared address does not mean the class actually implements that behaviour — verify the body is generic before attributing it.
5. BN field-name mush. CPlayerModule::OnChanged writes what BN calls this->m_TimeStampFormat.m_buffer; the byte-level truth is mov byte [esi+0x1A8], 1 — the m_bDirty flag that UseTime reads. Trust the offsets, not the names.
6. m_playerOption == ~AutoRepeatAttack_PlayerOption in UIOption_Checkbox::Apply is a rendering of a not/cmp pair. The branch body is unambiguous (the UIPreferences path); the predicate is not.

---

10. For the planner

10.1 Structural inventory in one place

Thing	Value
Options panel LayoutDesc	0x2100002B (client_local_English.dat)
Tab-control root element	0x10000208, Type 8, authored 300 × 600
Tab table property	0x2E = array of Structs {0x30 = button id, 0x31 = page id, 0x32 = isDefault}
Tab buttons (L→R)	0x1000020D Gameplay(default) · 0x1000020E Character · 0x1000050B Chat · 0x1000020F Config
Close button	0x10000210, fires action 0x1000001A
Page slots	0x10000212 · 0x10000211 · 0x1000050C · 0x10000213, all (2,25) 298×575
Page layouts	0x2100002A · 0x21000028 · 0x2100005C · 0x21000029
Page classes	0x10000029 · 0x10000027 · 0x10000042 · 0x10000028
Option ListBoxes	— · 0x100001FA · 0x1000050D · 0x10000200 (all 276 × 560, T=5)
Scrollbars	— · 0x100001FB · 0x10000201 · 0x10000201 (16 × 560; ListBox P0x72 names it)
Row template list	ListBox property 0x64, entries {0x63 = layout DID, 0x62 = element id}
Row templates (all in 0x2100002B)	header 0x10000216 · separator 0x10000217 · toggle 0x10000218 · slider 0x1000021A/0x1000021D · menu 0x10000222 · toggle+slider 0x10000220/0x10000221 · bitfield64 0x10000520
Apply / Reset / Defaults	0x100001FC / 0x100001FD / 0x100001FE, 80×32 at y 564
Host windows	0x21000017 (gmPanelUI, docked) and 0x2100006E (gmFloatyPanelUI, floating + resizable), slot 0x1000018D, stack key P0x10000029 = 10
Open action	0x1000001A ToggleOptionsPanel, default F11; toolbar button 0x1000019B in 0x21000016
Row counts	Gameplay 7 buttons · Character 6 headers / 49 toggles · Chat 6 headers / 2 sliders / 5 bitfield blocks (12+13+13+13+13 = 64 checkboxes) · Config 6 headers / 27 rows
String tables	tab/button labels → 0x23000001; option labels + tooltips + section headers → 0x23000003 (table enum 0x10000003)

10.2 What acdream can reuse from CH6 as-is

• LayoutImporter already handles the exact mechanisms this panel needs: BaseLayoutId/BaseElement cross-layout inheritance (every page mounts that way), the ElementDesc::Incorporate child merge, ShouldMountBaseChildren + the ZLevel correction for pure-container sub-window mounts (the four page slots are exactly that shape), and the parent-resize policy that scales a 300×600 page into a 300×362 slot.
• RetailWindowManager / UiRoot / the floating-window shell — the Options panel's real host 0x2100006E (gmFloatyPanelUI) is the same 8-border-strip + resize-grip frame CH6 already imports for the chat windows. Opacity, all-corner resize and drag come free.
• RetailLayoutFixtureGenerator — add 0x2100002B, 0x21000028, 0x21000029, 0x2100002A, 0x2100005C and pin them, exactly as CH6 pinned 0x2100006F/0x2100005B.
• DatWidgetFactory already maps 0x10000035 → BuildCheckbox — the LED option row's leaf widget class exists today.
• DatStringResolver.ComputeHash is already the exact compute_str_hash, so every ID_PlayerOption_* / ID_ChatOption_* / ID_*_Section label in this doc resolves at runtime by name with no hard-coded ids.
• CH6's window-identity model (main = 8, floaties = 2–5) is confirmed by the Chat tab's SetUserData arguments — no rework needed there.
• RuntimeCharacterOptionsState + the 0x0005 codec (CH3) is the right seam for the Character tab; the 0x1000008C per-window blob (CH6) is the right seam for the Chat tab's filter blocks.

10.3 What acdream does NOT have yet

• Element Type 8 — the tab control. DatWidgetFactory has no case for it (falls to the generic UiDatElement), and no reader for property 0x2E's struct array. This is the one genuinely new widget the campaign needs. It is also needed by the Configure Keyboard screen.
• Element Type 5 — UIElement_ListBox with an authored template list (property 0x64) and AddItemFromTemplateList. Also absent; also the mechanism that makes the whole options page work.
• UIOption_Slider (0x10000037), UIOption_Menu (0x10000038), UIOption_CheckboxSlider (0x10000036), UIOption_CheckboxBitfield64 (0x10000044) — none mapped in DatWidgetFactory.
• The OptionPage / PlayerOptionPage model: a per-page registered-option array with m_current / m_saved / m_default triples and the four verbs. This is small and self-contained; it is what makes Apply/Reset/Defaults correct rather than approximated.
• A UserPreferences.ini-shaped preference store for the Config tab (acdream's settings live in %LOCALAPPDATA%\acdream\; the Config tab's 27 rows are all Section_Key preferences, not wire options). This is where the "retail options vs acdream client settings" design call lands — see §10.5.

10.4 Behaviours that MUST be ported, not improved

1. Clicking an LED applies immediately (SetCurrentValue → Apply(1)). Apply/Reset/Defaults operate on an undo baseline, not on a staging buffer.
2. Apply is per-tab. Each page owns its own option array.
3. Defaults is never disabled; Apply and Reset are disabled whenever nothing changed.
4. Hiding a page reverts uncommitted edits (OnVisibilityChanged(false) → RestoreSavedValues). Switching tabs or closing the window discards.
5. Showing a page applies + commits (OnVisibilityChanged(true) → SaveCurrentValues, which also flushes the blob).
6. The main chat window has no "Gameplay" filter checkbox (12 rows), the four floaties do (13 rows).
7. The default tab is Gameplay Options, not Character (0x32 = true on entry 0).
8. Retail's spelling in the UI-facing strings: "Allegiance" in the string table but Allegience in the symbol name — use the string table value for anything user-visible.

10.5 Open unknowns for the planner to close or accept

#	Unknown	Where to look / suggested disposition
U1	What m_default is for the Character tab's 49 checkboxes. InitOptions never calls SetDefaultValue, so "Defaults" behaviour on the biggest tab is unestablished.	Read UIOption_Checkbox's ctor and UIOption::InqDefaultGameplayOptionProperty / InqGameplayOptionNameAndTooltip. Blocking for the Defaults button.
U2	Which options are "auto-save" (immediate 0x0005) vs batched into the 0x01A1 blob.	CPlayerModule::IsAutoSaveOption — enumerate it. This is exactly handoff Q4's discriminator.
U3	Whether acdream ships the 50th Character row ("Listen to PK death messages", ID_PlayerOption_HearPKDeaths, string 0x0D16E9A3 present in the DAT, absent from the 2013 code).	Design call. The string and ACE support exist; only the 2013 wiring is missing.
U4	The exact SetSliderLabel operand pairs for the Config tab's six labelled sliders. CLOSED 2026-08-11 (OP6 review + rework). An intermediate OP6 claim that retail ships ZERO captions was the SAME BN zero-fold artifact as AddHeader (the review byte-decoded the mov ecx/edx,[disp32] string-id loads at 0x0049E4C6 etc.; the rework independently re-read 2 of 6 sites + the PDB global sequence 0x0083E768–0x0083E794). The six pairs, in declaration order: Stiffness Soft/Hard, Adjustment Speed Slow/Fast, FOV Narrow/Wide, Screen Brightness Dark/Bright, Graphics Performance Speed/Detail, Degrade Distance Close/Far. Implemented in the OP6 rework (472525b9).	Evidence: docs/research/2026-08-11-op6-review.md M1; the rework commit's own byte log.
U5	Semantics of layout property 0x57 (page/window registration) and 0x58 (enum 1 on every options root).	Find the GetAttribute_Enum(this, 0x57 …) read. Not blocking — the toggle action can be driven from 0x12 on the buttons.
U6	Consumer of input actions 0x10000027 ("Exit Game") and 0x1000001F ("Configure Keyboard").	Neither has a default keybind. 0x1000001F is well corroborated by the keyboard screen's OK/Cancel; 0x10000027 rests on the label alone.
U7	The two support.turbine.com URLs behind Urgent Assistance / Report Abuse.	Dead endpoints. Recommend a register row: acdream shows a "not available" notice rather than launching a browser at a dead Turbine host. Extract the exact strings only if the register row needs to quote them.
U8	gmConfigUI::SetMouseTurningDefaults's full clamp set (only the Camera_Stiffness → 0.95f clamp was read).	0x0049E8F0. Needed only if "Use Mouse Turning Settings" ships.
U9	Whether the Config tab's 27 preference rows map onto acdream's existing quality/audio settings or need a new retail-shaped preference store.	Design call — see §10.3. The UserPreferences.ini key names are all established above, so a faithful store is cheap.
U10	Which 0x2100002B template 0x10000521 serves (present in the layout, in no template array).	Probably a later-build or unused row style. Non-blocking.

10.6 A suggested slice shape (non-binding)

The natural seams fall out of the structure: (a) the two missing widget primitives — Type 8 tab control + Type 5 ListBox-with-template-list — are a shared prerequisite for every tab and for Configure Keyboard; (b) the OptionPage/PlayerOptionPage model with its four verbs is one small, testable unit with no DAT dependency; (c) each tab is then a thin InitOptions transcription against a binding table. The Gameplay tab is the smallest end-to-end vertical (7 buttons, no option model at all) and would prove the tab host, the mounting, and the open path in one slice before any option plumbing exists.

---

Appendix — reproduction notes

• Byte reads: a throwaway peread.py in the session scratchpad maps VA → file offset through the PE section table of C:\Users\erikn\Downloads\acclient.exe (image base from the optional header) and dumps raw bytes. decode_addchild.py walks a VA range decoding a1 imm32 / 8b 0d|15|1d|35|3d imm32 global loads, 50..57 register pushes, 6a xx / 68 imm32 immediate pushes and e8 rel32 calls, then prints the last four pushed arguments per call — that is how all 25 AddChild rows and all 18 AddHeader operands were recovered.
• DAT reads: a throwaway OptProbe console (net8.0, Chorizite.DatReaderWriter 2.1.7) with modes find (hunt element ids / types across every 0x21xxxxxx LayoutDesc), hosts (find layouts referencing a given BaseLayoutId), dump (full recursive element + property dump), str (resolve a name or hash across every 0x23xxxxxx StringTable) and dumpstr. It must construct a DatCollection, not a bare PortalDatabase/ LocalDatabase — LayoutDesc.Unpack needs the collection to resolve master properties.
• Nothing in the repo was modified except this document.