M1 probe: GoOnline passes, gate is downstream (token/status)

Add a read-only detour on anadius's GoOnline handler (anadius64.dll+0x2BB90).
Result: the game calls GoOnline during the "connecting" attempt and anadius
returns success, yet no Blaze connection follows. The gate is therefore
downstream of GoOnline -- the auth-token (GetAuthCode) and/or the "online
established" status callback. Recorded in connection-gate-findings.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/connection-gate-findings.md

@@ -119,7 +119,26 @@ only — no EA source.
 - `TODO/CONFIRM` the exact abort point (no-token vs state-says-offline vs both) —
   needs Ghidra-level control-flow tracing.
 
-### Recommendation
-Load `FIFA23.exe` into **Ghidra** to (a) name the connection-state getter
-precisely and (b) confirm the gate mechanism, then return to `protossl-scan` +
-the hook to map those addresses onto the live process and install the M2 hook.
+### Dynamic probe result (read-only) — `GoOnline` is NOT the gate
+A read-only detour on anadius's `GoOnline` handler (`anadius64.dll+0x2BB90`)
+shows the game **does** call `GoOnline` during the "connecting" attempt (incl.
+on the Ultimate Team click) and anadius returns success — **yet no Blaze
+connection follows** (still zero external `CONNECT`/DNS).
+
+Therefore the gate is **downstream of `GoOnline`**: the game decides to go
+online and the request is accepted, then it aborts at the **auth-token step
+(`GetAuthCode`) and/or while waiting for the "online established" status
+callback** (`ONLINE_STATUS_EVENT`), and times out into offline.
+
+This sharpens the two-gate picture: `GoOnline` passes; the real blocker is the
+**token / online-status step**. `TODO/CONFIRM` which (token-missing vs
+status-never-fires) — via a `GetAuthCode` probe and/or Ghidra.
+
+### Recommendation / next
+Name the downstream gate. Two complementary routes:
+- **Dynamic:** probe anadius's `GetAuthCode` handler (does it return a token or
+  fail?) — distinguishes token-gate from status-callback.
+- **Static (Ghidra):** xref the `GoOnline` / `GetAuthCode` / `ONLINE_STATUS_EVENT`
+  strings in `FIFA23.exe` to find the FUT online-flow code that issues `GoOnline`
+  then waits for the token/status, and decompile it. FIFA isn't ASLR'd, so Ghidra
+  addresses (image base `0x140000000`) map 1:1 to our recorded offsets.