M2: flips fire but gate is async event (not a poll)

- Hook: force GetInternetConnectedState->connected (flags +0xCAB1A/+0xCAB1B) and
  flip GoOnline to report "1" (+0xAF530) instead of "0" (+0xADE64).
- protossl-scan: add `read` mode (hex/ascii dump at addr|module+off).
- Finding: neither flip unblocks the game; it keeps retrying GoOnline every ~7s.
  The FUT-online flow is event-driven -- the game waits for an async "online
  established" event anadius (offline-only) never pushes. Documented in
  connection-gate-findings.md. Next: trace FIFA-side flow (Ghidra) / anadius
  event-send to inject the online event.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/connection-gate-findings.md

@@ -183,7 +183,31 @@ back offline.
    So M2 = make `GetInternetConnectedState` report **connected** (then the game
    proceeds with its existing token).
 
-### M2 directions (do NOT do this session)
+### M2 attempt results — the gate is an async EVENT, not a poll
+Tried (read/write, EAAC neutralized):
+- Forced `GetInternetConnectedState` → connected (set flags +0xCAB1A/+0xCAB1B → value
+  `"1"`; strings confirmed: +0xADE64 = `"0"` offline, +0xAF530 = `"1"` connected).
+- Flipped `GoOnline` to report `"1"` (replicated its builder `+0x25BE0` with the
+  connected string instead of `"0"`).
+
+**Neither made the game proceed.** Both handlers fire, no crash — but the game
+**keeps retrying `GoOnline` every ~7s** and never attempts the Blaze connect.
+That retry-on-timeout pattern means the FUT-online flow is **event-driven**: the
+game submits `GoOnline`, gets success, then **waits for an async "online
+established" event** (ONLINE_STATUS_EVENT-class) that anadius — being offline-only
+— never pushes (the only `<Event sender="EALS">` it ever sends is the Challenge
+handshake). So flipping poll/return values can't unblock it.
+
+**Implication:** getting past "connecting" requires **emulating the EA-app online
+event sequence** the game waits for (inject the online-status event over LSX, in
+the format/order EbisuSDK expects), not a single function flip. This is a
+substantially deeper task (and precedes the Blaze backend emulation).
+
+Next: trace the FIFA-side FUT online-flow (what the game does after `GoOnline`
+and exactly which event/condition it waits on) — Ghidra on FIFA23.exe (import
+saved at `C:\openfut\gh-proj`), or RE anadius's LSX event-send path. `TODO/CONFIRM`.
+
+### M2 directions (superseded — see above)
 - Check whether the flags at `+0xCAB1A` / `+0xCAB1B` are settable via anadius
   config / a hidden option (cheapest flip).
 - Else out-detour `GetInternetConnectedState` in our `version.dll` to force the