Here are the data structures with brief descriptions:

C[struct].s_subscriptions	The (event -> FSM handler) subscription table: the single place that says which state machine(s) react to a given event. One row per (event, subscriber) pair; an event with two subscribers has two rows (see AB_GP_SESSION_EVENT_TRAIN_DATA_VALIDATED below). Rows are visited top to bottom, so ordering here is the handler call order for a multi-subscriber event - keep the more "primary" FSM first (session before the procedure-specific one) so ab_gp_dispatch()'s aggregate bool still tracks the session FSM's own result where a caller relies on that
C[struct].s_transitions	The full transition set as { from, event, to } triples - every (state, event) pair NOT listed here has no outcome (the event does nothing from that state; not an error)
Cab_gp_channel_context_t	Central application context owned by composition root (main.c)
C[struct].neg_peer_extra
Cab_gp_channel_payload_collector_t
Cab_gp_com_t	Communication transport abstraction holding only network service channels
Cab_gp_config_channel_t
Cab_gp_config_t
Cab_gp_config_timers_t
Cab_gp_ctc_pending_output_t
Cab_gp_cycle_ticks_t	Tick count and the mutex that guards it. Not volatile: every access to count holds the mutex
Cab_gp_db_route_t	One track section A/B's simplified layout knows about
Cab_gp_db_t
Cab_gp_db_train_t	One train A/B's simplified database knows about
Cab_gp_ertms_emergency_stop_t	Active emergency stop command and acknowledgement status
Cab_gp_ertms_handover_record_t	RBC-to-RBC handover session tracking
Cab_gp_ertms_ma_record_t	Computed Movement Authority profile along track layout
Cab_gp_ertms_position_record_t	Live train position and track segment occupancy tracking
Cab_gp_ertms_text_msg_record_t	Driver plain text message transmission and ack tracking
Cab_gp_ertms_train_context_t	Complete ERTMS state and procedure context for one train slot
Cab_gp_ertms_train_data_t	Parameters declared by the train via Msg 129 during Start of Mission
Cab_gp_ertms_tsr_record_t	Active TSR entry affecting train path
Cab_gp_il_pending_output_t
Cab_gp_route_context_t
Cab_gp_saf_result_t	Output of ab_gp_saf_train_on_frame() / _on_peer_rb()
Cab_gp_saf_train_slot_t	Per-train-slot state
Cab_gp_saf_train_t	One channel's train-link SaF termination
Cab_gp_sibling_state_t
Cab_gp_site_status_t
Cab_gp_staged_send_t
Cab_gp_train_context_t
Cab_gp_train_pending_output_t
Cab_gp_train_session_t
Cab_gp_util_link_gate_t	Gate state; all-zero (or ab_gp_util_link_gate_init()) allows the first attempt at once
Cgateway_c_config_channel_t
Cgateway_c_config_t
Cgateway_c_config_timers_t
Cgateway_c_context_t	One gateway_c_context_t instance's state
Cgateway_c_dedup_entry_t
Cgateway_c_dedup_t
Cgateway_c_service_def_t	One gateway service's identity and its single handler's entry points - a pure-literal table each main_c_<svc>.c defines and passes to gateway_c_main()
Cgateway_c_train_handler_state_t
Cnegotiate_state_t
Cpeer_poll_context_t
Crbc_envelope_queue_t
Crbc_envelope_t	One decoded envelope - see this file's own module doc for where the wire<->struct conversion now lives (per-domain, not one shared codec)
Crbc_gradient_segment_t
Crbc_linking_item_t
Crbc_msg_129_validated_train_data_t	Msg 129: Validated Train Data
Crbc_msg_130_request_for_shunting_t	Msg 130: Request for Shunting (Subset-026 8.6.2) - header plus a position report, same bare (no leading NID_PACKET byte) shape Msg 129/132 already use for their own Packet 0/1 field, not Msg 136's leading-byte variant
Crbc_msg_132_ma_request_t	Msg 132: Movement Authority Request
Crbc_msg_136_position_report_t	Msg 136: Train Position Report - carries Packet 0 OR Packet 1 (Subset-026 8.6.4: "Packet 0 or 1"), never both. @position_report is ALWAYS populated regardless of which packet actually arrived (the decoder mirrors Packet 1's own core fields into it too - see ab_gp_ertms_train_message_codec.c's own decode case) so every EXISTING reader that only ever looked at @position_report (written before Packet 1 existed) keeps working unchanged; @has_packet1/@packet1 exist for a caller that specifically needs to tell the two apart (ab_gp_proc_dispatch.c's own handle_msg_136() does, for the post-EoM idle heartbeat - see that function's own comment)
Crbc_msg_146_ack_t	Msg 146: Acknowledgement
Crbc_msg_147_ack_emergency_stop_t	Msg 147: Emergency Stop Acknowledgement
Crbc_msg_150_end_of_mission_t	Msg 150: End of Mission (Subset-026 8.6.10)
Crbc_msg_155_init_session_t	Msg 155: Initiation of a Communication Session
Crbc_msg_156_terminate_session_t	Msg 156: Termination of a Communication Session
Crbc_msg_159_session_established_t	Msg 159: Session Established
Crbc_msg_15_ces_t	Msg 15: Conditional Emergency Stop (CES)
Crbc_msg_16_ues_t	Msg 16: Unconditional Emergency Stop (UES)
Crbc_msg_18_ces_revocation_t	Msg 18: Revocation of Emergency Stop
Crbc_msg_24_general_message_t	Msg 24: General Message (National Values, TSRs, Text, Parameters)
Crbc_msg_27_sh_refused_t	Msg 27: SH Refused (Subset-026 8.7.10) - answers a Msg 130 Request for Shunting; carries the T_TRAIN of that request, same shape as Msg 8
Crbc_msg_28_sh_authorised_t	Msg 28: SH Authorised (Subset-026 8.7.11) - carries the T_TRAIN of the authorised Msg 130, like Msg 27. The optional packets (3 National Values, 44, 49 List of balises for SH area) are not sent: no site data defines an SH area yet
Crbc_msg_2_sr_authorisation_t	Msg 2: SR Authorisation (Subset-026 8.7.1)
Crbc_msg_33_transition_order_t	Msg 33: RBC Transition Order (this codebase's own numbering - see ab_gp_ertms_train_message_codec.c's encode-case comment for the Subset-026 conformance note: real Message 33 is "MA with Shifted Location Reference"; RBC transition is really Packet 131 inside Message 24)
Crbc_msg_34_track_ahead_free_request_t	Msg 34: Track Ahead Free Request (Subset-026 8.7.14)
Crbc_msg_3_movement_authority_t	Msg 3: Movement Authority (with optional packets)
Crbc_msg_41_session_termination_order_t	Msg 41 (this codebase's own numbering - see codec's own encode-case comment for the Subset-026 conformance note, same posture as Msg 33): Session Termination Order - header only
Crbc_msg_6_recognition_exit_trip_t	Msg 6: Recognition of exit from TRIP mode (Subset-026 8.7.3) - header only, no message-specific fields
Crbc_msg_8_ack_train_data_t	Msg 8: Acknowledgement of Train Data (Subset-026 8.7.4)
Crbc_msg_9_request_shorten_ma_t	Msg 9: Request to Shorten MA (Subset-026 8.7.5) - carries a shortened Level 2 MA (Packet 15), same shape Msg 3 already uses
Crbc_nid_lrbg_t	Last Relevant Balise Group (Country + BG identifier)
Crbc_packet_0_position_report_t
Crbc_packet_131_rbc_transition_t
Crbc_packet_15_ma_t
Crbc_packet_1_position_report_2bg_t
Crbc_packet_21_gradient_profile_t
Crbc_packet_27_ssp_t
Crbc_packet_3_national_values_t
Crbc_packet_41_level_transition_t
Crbc_packet_57_ma_request_params_t
Crbc_packet_58_pr_params_t
Crbc_packet_5_linking_t
Crbc_packet_65_tsr_t
Crbc_packet_66_tsr_revoke_t
Crbc_packet_72_text_message_t
Crbc_speed_segment_t
Crbc_track_to_train_header_t
Crbc_train_inbound_msg_t
C[union].payload
Crbc_train_outbound_msg_t
C[union].payload
Crbc_train_to_track_header_t
Crbc_util_frame_t	Decoded view of a util frame (payload is a pointer into the caller's buffer, NUL-terminated into `payload_z` by the codec)
Crelay_poll_context_t
Csaf_key_t