Probe journal listener route callbacks

docs/red4ext-logging-shim.md

@@ -21,6 +21,11 @@ Current behavior:
 - Dumps the `JournalManager` listener array at offsets `0x210`/`0x21c` and the
   listener vtable slots `0x28`, `0x30`, and `0x50`, matching the indirect calls
   made by the native `TrackEntry` implementation.
+- Hooks the non-default journal listener callbacks seen during route plotting:
+  `0xea89a8`, `0xea8958`, `0xe63f80`, `0xe63e6c`, `0xe63f00`,
+  `0x8d136c`, `0x431a34`, `0x55a4e4`, and `0x14de238`.
+- For those listener callbacks, logs the listener object, event pointer, common
+  object fields, and vtable slots on candidate nested owner/service objects.
 - Resolves the native mappin system when one of those paths fires, logs relevant
   vtable slot addresses, and temporarily hooks the route-adjacent slots.
 
@@ -32,12 +37,24 @@ Current route-probe focus:
 - `TrackCustomPositionMappin` wrapper/core: `0x27c4aac`, `0x27c2318`
 - mappin-system slots `0x1f0`, `0x280`, and `0x2f0`
 - `JournalManager.TrackEntry` implementation: `0x5944fc`
+- non-default `TrackEntry` listener callbacks listed above
 
 Quest/objective pins did not fire the mappin tracking hooks in live tests. The
 REDscript decompile shows that those pins call `JournalManager.TrackEntry`
 instead, so the current useful runtime question is which native listener reacts
 to tracked-entry changes.
 
+Most recent controlled test:
+
+- `06:31:43`: user hit Continue / GPS tick logged.
+- `06:32:02`: automatic `TrackEntry` during load, no route input.
+- `06:32:27`: map opened.
+- `06:32:44`, `06:32:50`, `06:32:56`: deliberate quest/objective route plots
+  produced `JournalManager::TrackEntry` calls from return RVA `0x26ac34e`.
+- After map open, the journal listener count rose to 254. Most listener entries
+  dispatch to no-op `0x14a700`; the non-default callbacks above are the current
+  drill-down targets.
+
 Build and install from the Fedora toolbox:
 
 ```bash