Probe world map mappin routes

docs/red4ext-logging-shim.md

@@ -1,6 +1,7 @@
 # RED4ext logging shim
 
-`EdgeWeightGPS` is a minimal RED4ext plugin used to verify a native logging foothold without changing gameplay data.
+`EdgeWeightGPS` is a RED4ext plugin used to probe native GPS/mappin code paths
+without changing gameplay data.
 
 It writes `EdgeWeightGPS.log` beside the installed DLL:
 
@@ -12,11 +13,19 @@ Current behavior:
 
 - Logs plugin load/unload.
 - Logs the RED4ext plugin handle and SDK pointer value passed to `Main`.
-- Does not call game RTTI or register script functions.
+- Registers Running game-state callbacks so route tests can be timestamped.
+- Hooks selected native wrappers and cores around `GPSSystem`, mappin tracking,
+  world-map mappin selection, and map path framing.
+- Resolves the native mappin system when one of those paths fires, logs relevant
+  vtable slot addresses, and temporarily hooks the route-adjacent slots.
 
-Planned next step:
+Current route-probe focus:
 
-- Build a richer RTTI/hooking variant with an MSVC-compatible Windows toolchain or a narrower hand-written SDK surface. The upstream RED4ext SDK headers build under MinGW for loader-only use, but the full SDK/static library currently pulls in generated native/GPU structures with MSVC layout assumptions.
+- `FrameMappinPath` wrapper/core: `0x27c4314`, `0x27bc1ec`
+- `SetSelectedMappin` wrappers/core: `0x27c4a38`, `0x27c4944`,
+  `0x27c49c4`, `0x27c1684`
+- `TrackCustomPositionMappin` wrapper/core: `0x27c4aac`, `0x27c2318`
+- mappin-system slots `0x1f0`, `0x280`, and `0x2f0`
 
 Build and install from the Fedora toolbox:
 

docs/traffic-system-debrief.md

@@ -73,7 +73,7 @@ selection.
 
 ## Mappin Tracking Handoff
 
-The current native lead is the script/native mappin tracking path:
+The first native lead was the script/native mappin tracking path:
 
 ```text
 TrackMappin string rva:          0x2e82c30
@@ -98,16 +98,45 @@ the supplied mappin handle is null:
 - non-null tracked mappin: call resolved system vtable slot `0x220`
 - null tracked mappin: call resolved system vtable slot `0x228`
 
-That looks exactly like "set tracked mappin" versus "clear tracked mappin". The
-installed RED4ext probe now resolves this system at runtime, logs the concrete
-vtable addresses for slots `0x220`, `0x228`, `0x250`, `0x2e0`, `0x368`, and
-`0x3a8`, and attaches temporary hooks to slots `0x220` and `0x228`. The next
-in-game route-plotting run should therefore give directly disassemblable RVAs
-for the concrete mappin-system methods that receive the tracked destination.
+That looks exactly like "set tracked mappin" versus "clear tracked mappin".
+However, a clean live test disproved it as the normal world-map route plotting
+path: `TrackMappin`, `TrackMappinCore`, and
+`SetMappinTrackingAlternative` did not fire while plotting three map routes.
 
 `SetMappinTrackingAlternative` parses two script arguments and calls vtable slot
 `0x418` on its receiver. It is probably related to alternate tracking behavior,
-but static disassembly has not yet shown it to be the main route planner.
+but static disassembly and live logging have not shown it to be the main route
+planner.
+
+## World-Map Mappin Selection Lead
+
+The next native lead is the world-map mappin controller block around
+`0x1427c4314`. These functions are still mappin-facing, but they are closer to
+selection, framing, and custom-position route display than the script helper
+above:
+
+```text
+FrameMappinPath wrapper rva:                 0x27c4314
+FrameMappinPath core rva:                    0x27bc1ec
+SetSelectedMappin wrapper rva:               0x27c4a38
+SetSelectedMappin by-id wrapper rva:         0x27c4944
+SetSelectedMappin by-position wrapper rva:   0x27c49c4
+SetSelectedMappin core rva:                  0x27c1684
+TrackCustomPositionMappin wrapper rva:       0x27c4aac
+TrackCustomPositionMappin core rva:          0x27c2318
+UntrackCustomPositionMappin wrapper rva:     0x27c4ba0
+Mappin system resolver rva:                  0x02bb840
+```
+
+`FrameMappinPath` calls the resolved mappin-system vtable slot `0x280`.
+`TrackCustomPositionMappin` calls slot `0x2f0` to create a custom-position
+mappin/route handle and slot `0x1f0` to update an existing one. Those calls are
+currently the most route-like native behavior found in static disassembly.
+
+The installed RED4ext probe now logs the wrappers and cores listed above. When
+one of them can resolve the mappin system, it also logs concrete vtable RVAs for
+slots `0x1f0`, `0x220`, `0x228`, `0x250`, `0x280`, `0x2e0`, `0x2f0`, `0x368`,
+and `0x3a8`, then attaches temporary hooks to the route-adjacent slots.
 
 ## The High-Level Shape