Probe route observer callbacks

docs/red4ext-logging-shim.md

@@ -29,9 +29,15 @@ Current behavior:
 - Hooks the route handoff found from the journal listener bridge:
   `0x598250`, `0x13763d8`, `0xaa62d0`, `0xaa6330`, `0x27abd7c`, and
   `0x5625a4`.
-- Logs mappin route-event fields, active/deactive route refs, the mappin
+- Logs mappin route-event fields, active/deactive route keys, the mappin
   active-route map at `system + 0x1a0`, and the route observer list at
   `system + 0x280`.
+- Hooks the route observer callbacks reached by route activation/deactivation:
+  `0xaa6610`, `0xaa6628`, `0xaa63e0`, `0x27b10c0`, `0x295d4a0`, and
+  `0x286a85c`.
+- Logs the route entry pointer and route object pointer passed to those
+  observers, including route object vtable slots and common fields such as the
+  active byte at offset `0x84`.
 - Resolves the native mappin system when one of those paths fires, logs relevant
   vtable slot addresses, and temporarily hooks the route-adjacent slots.
 
@@ -48,6 +54,8 @@ Current route-probe focus:
 - mappin route-event enqueue: `0x13763d8`
 - mappin route-event handler: `0xaa62d0`
 - mappin route activate/deactivate: `0xaa6330`, `0x27abd7c`
+- mappin route observer callbacks: `0xaa6610`, `0xaa6628`, `0xaa63e0`,
+  `0x27b10c0`, `0x295d4a0`, `0x286a85c`
 - route-build candidate called by the bridge: `0x5625a4`
 
 Quest/objective pins did not fire the mappin tracking hooks in live tests. The
@@ -66,6 +74,22 @@ Most recent controlled test:
   dispatch to no-op `0x14a700`; the non-default callbacks above are the current
   drill-down targets.
 
+Newest controlled test:
+
+- User clock `01:05`: Continue on the main menu. The log saw
+  `GPSSystem/Tick`.
+- User clock `01:27`: Space to continue. The log saw automatic
+  `JournalManager.TrackEntry`, a dense `JournalRouteBridge` burst, and thirty
+  `RouteBuildCandidate 0x5625a4` calls. About 5.5 seconds later the mappin route
+  activation/deactivation functions fired.
+- User clock `01:52`: map open. Hovering icons produced the expected
+  `SetSelectedMappin` bursts.
+- Deliberate quest route clicks produced `JournalManager.TrackEntry`, route
+  event enqueue calls for old-route-off/new-route-on, and route event handler
+  calls roughly 11-18 ms later.
+- Custom pin routing used the separate custom-position mappin path, then the
+  shared route activate/deactivate helper.
+
 Build and install from the Fedora toolbox:
 
 ```bash