Probe world map mappin routes

docs/traffic-system-debrief.md

@@ -73,7 +73,7 @@ selection.
 
 ## Mappin Tracking Handoff
 
-The current native lead is the script/native mappin tracking path:
+The first native lead was the script/native mappin tracking path:
 
 ```text
 TrackMappin string rva:          0x2e82c30
@@ -98,16 +98,45 @@ the supplied mappin handle is null:
 - non-null tracked mappin: call resolved system vtable slot `0x220`
 - null tracked mappin: call resolved system vtable slot `0x228`
 
-That looks exactly like "set tracked mappin" versus "clear tracked mappin". The
-installed RED4ext probe now resolves this system at runtime, logs the concrete
-vtable addresses for slots `0x220`, `0x228`, `0x250`, `0x2e0`, `0x368`, and
-`0x3a8`, and attaches temporary hooks to slots `0x220` and `0x228`. The next
-in-game route-plotting run should therefore give directly disassemblable RVAs
-for the concrete mappin-system methods that receive the tracked destination.
+That looks exactly like "set tracked mappin" versus "clear tracked mappin".
+However, a clean live test disproved it as the normal world-map route plotting
+path: `TrackMappin`, `TrackMappinCore`, and
+`SetMappinTrackingAlternative` did not fire while plotting three map routes.
 
 `SetMappinTrackingAlternative` parses two script arguments and calls vtable slot
 `0x418` on its receiver. It is probably related to alternate tracking behavior,
-but static disassembly has not yet shown it to be the main route planner.
+but static disassembly and live logging have not shown it to be the main route
+planner.
+
+## World-Map Mappin Selection Lead
+
+The next native lead is the world-map mappin controller block around
+`0x1427c4314`. These functions are still mappin-facing, but they are closer to
+selection, framing, and custom-position route display than the script helper
+above:
+
+```text
+FrameMappinPath wrapper rva:                 0x27c4314
+FrameMappinPath core rva:                    0x27bc1ec
+SetSelectedMappin wrapper rva:               0x27c4a38
+SetSelectedMappin by-id wrapper rva:         0x27c4944
+SetSelectedMappin by-position wrapper rva:   0x27c49c4
+SetSelectedMappin core rva:                  0x27c1684
+TrackCustomPositionMappin wrapper rva:       0x27c4aac
+TrackCustomPositionMappin core rva:          0x27c2318
+UntrackCustomPositionMappin wrapper rva:     0x27c4ba0
+Mappin system resolver rva:                  0x02bb840
+```
+
+`FrameMappinPath` calls the resolved mappin-system vtable slot `0x280`.
+`TrackCustomPositionMappin` calls slot `0x2f0` to create a custom-position
+mappin/route handle and slot `0x1f0` to update an existing one. Those calls are
+currently the most route-like native behavior found in static disassembly.
+
+The installed RED4ext probe now logs the wrappers and cores listed above. When
+one of them can resolve the mappin system, it also logs concrete vtable RVAs for
+slots `0x1f0`, `0x220`, `0x228`, `0x250`, `0x280`, `0x2e0`, `0x2f0`, `0x368`,
+and `0x3a8`, then attaches temporary hooks to the route-adjacent slots.
 
 ## The High-Level Shape