docs(render): recover camera reflection factory ABI

2 files changed, 20 insertions, 3 deletions

diff --git a/docs/reference/render-frame.md b/docs/reference/render-frame.md
index 54bcf9a..ec78020 100644
--- a/docs/reference/render-frame.md
+++ b/docs/reference/render-frame.md
@@ -57,6 +57,16 @@ selector `18` on the supplied object and invokes slot `+12` on that result. It
 does not store the supplied pointer in `stdGetCurrentCamera2`; that getter
 returns a Terrain global populated by selector `8` during Terrain initialization.
 
+`Terrain.dll!LoadCamera` adds a separate factory-side contract. Its GOG entry
+at RVA `0x4EBE0` is `__stdcall` with four machine-word arguments, allocates
+`0x1A4` bytes, calls the constructor at RVA `0x4EC60`, and returns the interface
+at object offset `+0x134`. The constructor passes arguments 3 and 4 into base
+initialization at `this + 4`, writes argument 3 to `this + 0x138`, and calls a
+helper at RVA `0x4CEF0` with arguments 1, 2 and 4 plus `this`. Argument 1 is a
+mode string: only `REFLECTION` and `REFLECTION_SHIFTED` produce a non-zero mode
+value at `this + 0x1A0`. This is factory ABI evidence, not a recovered view or
+projection matrix contract.
+
 ## Parity risks
 
 - x87 precision and rounding;
diff --git a/docs/tomes/05-render.md b/docs/tomes/05-render.md
index 2d529fc..96b7e52 100644
--- a/docs/tomes/05-render.md
+++ b/docs/tomes/05-render.md
@@ -1009,9 +1009,16 @@ thunk: it jumps through IAT `0x10020148` to `Terrain.dll!LoadCamera`. The
 Terrain export is at RVA `0x4EBE0` and is a `__stdcall` entry with `ret 0x10`,
 so it receives four machine-word arguments. It allocates a `0x1A4`-byte object,
 forwards those four words to its constructor, and returns a pointer at object
-offset `+0x134`; the meaning and concrete types of those arguments are not yet
-established. `Terrain.dll!stdGetCurrentCamera2` returns a global camera pointer,
-and `stdSetCurrentCamera2` updates it through the object's interface methods.
+offset `+0x134`. The constructor is at RVA `0x4EC60`: it passes arguments 3 and
+4 to the base initialization at `this + 4`, stores argument 3 at `this + 0x138`,
+and passes arguments 1, 2 and 4 plus `this` to its helper at RVA `0x4CEF0`.
+Argument 1 is a NUL-terminated mode string at this call boundary: only the
+embedded literals `REFLECTION` and `REFLECTION_SHIFTED` select a non-zero value
+stored at `this + 0x1A0`. This proves that `LoadCamera` supports reflection
+variants, but not the semantic types of its remaining arguments or the meaning
+of the resulting value. `Terrain.dll!stdGetCurrentCamera2` returns a global
+camera pointer, and `stdSetCurrentCamera2` updates it through the object's
+interface methods.
 
 This establishes that original camera creation/selection is Terrain-owned and
 not a field that can safely be inferred from a TMA transform. It does **not**