Probe journal listener route callbacks

docs/red4ext-logging-shim.md

@@ -21,6 +21,11 @@ Current behavior:
 - Dumps the `JournalManager` listener array at offsets `0x210`/`0x21c` and the
   listener vtable slots `0x28`, `0x30`, and `0x50`, matching the indirect calls
   made by the native `TrackEntry` implementation.
+- Hooks the non-default journal listener callbacks seen during route plotting:
+  `0xea89a8`, `0xea8958`, `0xe63f80`, `0xe63e6c`, `0xe63f00`,
+  `0x8d136c`, `0x431a34`, `0x55a4e4`, and `0x14de238`.
+- For those listener callbacks, logs the listener object, event pointer, common
+  object fields, and vtable slots on candidate nested owner/service objects.
 - Resolves the native mappin system when one of those paths fires, logs relevant
   vtable slot addresses, and temporarily hooks the route-adjacent slots.
 
@@ -32,12 +37,24 @@ Current route-probe focus:
 - `TrackCustomPositionMappin` wrapper/core: `0x27c4aac`, `0x27c2318`
 - mappin-system slots `0x1f0`, `0x280`, and `0x2f0`
 - `JournalManager.TrackEntry` implementation: `0x5944fc`
+- non-default `TrackEntry` listener callbacks listed above
 
 Quest/objective pins did not fire the mappin tracking hooks in live tests. The
 REDscript decompile shows that those pins call `JournalManager.TrackEntry`
 instead, so the current useful runtime question is which native listener reacts
 to tracked-entry changes.
 
+Most recent controlled test:
+
+- `06:31:43`: user hit Continue / GPS tick logged.
+- `06:32:02`: automatic `TrackEntry` during load, no route input.
+- `06:32:27`: map opened.
+- `06:32:44`, `06:32:50`, `06:32:56`: deliberate quest/objective route plots
+  produced `JournalManager::TrackEntry` calls from return RVA `0x26ac34e`.
+- After map open, the journal listener count rose to 254. Most listener entries
+  dispatch to no-op `0x14a700`; the non-default callbacks above are the current
+  drill-down targets.
+
 Build and install from the Fedora toolbox:
 
 ```bash

docs/traffic-system-debrief.md

@@ -217,6 +217,51 @@ The GPS query helpers appear to be exposed helper/test surfaces, not the route
 path used by the world map. `TrackEntry` is now the highest-confidence native
 handoff for quest/objective route plotting.
 
+## Journal Listener Fanout
+
+`JournalManager.TrackEntry` at RVA `0x5944fc` is now confirmed at runtime as the
+quest/objective route-plot entry point. A controlled test produced route-plot
+calls at `06:32:44`, `06:32:50`, and `06:32:56`, all from return RVA
+`0x26ac34e`, which is the script/native wrapper path for `TrackEntry`.
+
+The native `TrackEntry` implementation updates the tracked-entry state and then
+fans out through a listener array:
+
+```text
+JournalManager + 0x210: listener pointer array
+JournalManager + 0x21c: listener count
+listener vtable + 0x28: one tracked-entry callback path
+listener vtable + 0x30: another tracked-entry callback path
+listener vtable + 0x50: untrack/default path
+```
+
+Before the save is fully loaded the listener count is small. After the world map
+is opened it rises to 254. Most entries use the no-op callback `0x14a700`, but
+the live route test repeatedly exposed this small non-default set:
+
+```text
+0xea89a8 / 0xea8958
+0xe63f80 / 0xe63e6c
+0xe63f00 / 0x8d136c
+0x431a34 / 0x55a4e4
+0x14de238
+```
+
+Static disassembly of these callbacks suggests the following split:
+
+- `0x14a700` is a plain empty return.
+- `0xea89a8` and `0xea8958` are objective/story tracking callbacks; their vtable
+  lives beside a `quests/street_stories/.../generic_sts_objective` string.
+- `0x431a34`, `0x55a4e4`, and `0x14de238` are heavy UI/tracker state callbacks.
+- `0xe63f80` and `0xe63e6c` remain the most promising route-refresh callbacks:
+  they read nested listener fields at `+0x70` and `+0x78` and call high vtable
+  slots such as `0x218`, `0x230`, `0x240`, `0x340`, and `0x348`.
+
+The installed probe now hooks those non-default callbacks directly and logs the
+nested owner/service vtables. The next target is to identify which nested vtable
+slot performs the route query or route cache update, then disassemble or patch
+that function.
+
 ## Native False Positives
 
 Static string scans found a tempting traffic/pathfinding cluster around RVA