Probe world map tracking script path

docs/traffic-system-debrief.md

@@ -138,6 +138,31 @@ one of them can resolve the mappin system, it also logs concrete vtable RVAs for
 slots `0x1f0`, `0x220`, `0x228`, `0x250`, `0x280`, `0x2e0`, `0x2f0`, `0x368`,
 and `0x3a8`, then attaches temporary hooks to the route-adjacent slots.
 
+Live result: this lead appears to be the hover/selection layer, not the route
+commit layer. In a controlled test window, hovering a world-map icon and then
+moving back to empty map space fired `SetSelectedMappinWrapper` and
+`SetSelectedMappinCore`. Pressing the route/track action on that icon did not
+fire `FrameMappinPath`, `TrackCustomPositionMappin`, `TrackMappin`, the tracked
+mappin slots, or any of the custom-position slots.
+
+That pushes the search one layer higher, into the world-map controller script
+methods around tracking an objective or setting a waypoint. Static REDscript
+strings name these relevant methods:
+
+```text
+WorldMapMenuGameController.TryTrackQuestOrSetWaypoint
+WorldMapMenuGameController.UpdateTrackedQuest
+WorldMapMenuGameController.UpdateTravelDestination
+WorldMapMenuGameController.TrackQuestMappin
+WorldMapMenuGameController.OnPressInput
+WorldMapMenuGameController.OnHoldInput
+```
+
+The current read-only REDscript probe wraps the no-argument route/tracking
+methods plus `TrackQuestMappin`. If those fire on route plotting, the next step
+is to trace their native calls or wrap the specific player-quest/custom-waypoint
+operation they delegate to.
+
 ## The High-Level Shape
 
 Cyberpunk appears to split "navigation" into at least two major domains: