fifa17-recon: the real quick-sell table, and the grouping bug is not in our layer

Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.

THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:

    value = round_half_up(rating * price / 100)
    level    = 3 if rating >= 75, 2 if 65..74, else 1   (0x180141e8a..0x180141ea3,
               derived from rating, NOT a wire field)
    cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
               across every subtype 0..599 with zero disagreements

A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.

This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.

Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.

ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.

THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.

The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.

extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.

A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.

Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.

Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.

Live: 439 contract checks pass, market suite passes, both flags off.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

fifa17-recon/tools/fut_store.py

@@ -19,6 +19,95 @@ from fut_account import ACCOUNT          # single source of truth for identity/c
 
 PROFILE_PATH = os.environ.get("FUT_PROFILE", os.path.join(HERE, "fifa17_profile.json"))
 
+# ---- FUT_DISCARD_TABLE: the REAL FIFA 17 quick-sell values ------------------
+#
+# quick_sell() used to pay an invented rating tier (600/300/150/50). That number
+# was wrong for every card. The real table is `fcc_discardcoins` in the client's
+# own game DB, 141 rows keyed (cardtype, level, rare) -> price, recovered from the
+# running client 2026-08-05 and verified against 22 live club items, 22/22 exact.
+#
+# The client computes the DISPLAYED value itself with the same table whenever our
+# `discardValue` (atom 0xd7) is 0 or absent: FUN_18013fe00 stores our value at item
+# +0x38, and the guard at 0x180141025 (`cmp dword [rbp+0x198],0` / `ja`) skips the
+# local computation when it is non-zero. So today the client shows the real value
+# while the server pays a made-up one, and the two disagree on every card. This
+# makes the paid value agree with the shown value.
+#
+#   value = round_half_up(rating * price / 100)
+#   level = 3 if rating >= 75, 2 if 65..74, else 1   (0x180141e8a..0x180141ea3;
+#           derived from rating, NOT a wire field)
+#   cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and
+#           checked across every subtype 0..599 with zero disagreements
+#
+# ZERO WIRE CHANGE. Nothing new is sent; only the coin figure the server credits
+# changes. Default off per the house rule, but this is the one patch worth
+# defaulting on after a single verification.
+# See docs/plan-2026-08-05-store-subsystem.md section 3.6.
+DISCARD_TABLE = os.environ.get("FUT_DISCARD_TABLE", "0") == "1"
+
+_DP = {}
+
+
+def _dp(ct, rares, p1, p2, p3):
+    for r in rares:
+        _DP[(ct, 1, r)] = p1
+        _DP[(ct, 2, r)] = p2
+        _DP[(ct, 3, r)] = p3
+
+
+_dp(1, [0], 30, 150, 400)
+_dp(1, [1], 75, 350, 800)
+_dp(1, [7], 1500, 5000, 9000)
+_dp(1, [2, 3, 10, 13] + list(range(17, 32)), 2000, 7000, 12200)
+_dp(1, [4, 8, 9], 6000, 10000, 18000)
+_dp(1, [11], 10000, 15000, 24000)
+_dp(1, [5, 6], 20000, 40000, 80000)
+_dp(1, [12], 120000, 120000, 120000)
+_dp(2, [0], 20, 70, 110)
+_dp(2, [1], 25, 120, 320)
+for _ct in (3, 4, 5, 10):
+    _dp(_ct, [0], 10, 55, 110)
+    _dp(_ct, [1], 50, 100, 300)
+for _ct in (6, 7, 8, 9):
+    _dp(_ct, [0], 5, 20, 40)
+    _dp(_ct, [1], 20, 50, 70)
+
+
+def _cardtype(sub):
+    """FUN_1800d8330. 0 means no table row, which the client renders as value 0."""
+    if sub is None:
+        return 0
+    if 0 <= sub <= 3:
+        return 1
+    if sub == 4:
+        return 2
+    if sub == 5:
+        return 3
+    if sub == 6:
+        return 10
+    if sub == 7:
+        return 5
+    if sub == 8:
+        return 4
+    if 9 <= sub <= 11:
+        return 7
+    if sub in (30, 31, 231, 232, 233, 236) or 145 <= sub <= 150:
+        return 9
+    if (51 <= sub <= 136) or (201 <= sub <= 220) or (250 <= sub <= 273) \
+       or (300 <= sub <= 341):
+        return 6
+    return 0
+
+
+def discard_value(item):
+    """round_half_up(rating * price / 100), price from fcc_discardcoins."""
+    ct = _cardtype(item.get("cardsubtypeid"))
+    r = int(item.get("rating") or 0)
+    lvl = 3 if r >= 75 else 2 if r >= 65 else 1
+    price = _DP.get((ct, lvl, int(item.get("rareflag") or 0)), 0)
+    n = r * price
+    return n // 100 + (1 if n % 100 >= 50 else 0)
+
 # Back-compat snapshots. Identity now lives in fut_account.ACCOUNT so Blaze, LSX
 # and UTAS cannot drift apart; prefer ACCOUNT.<field> in new code. These are
 # import-time snapshots and will NOT reflect a later adopt_from_auth().
@@ -215,6 +304,12 @@ class Store:
             dv = it.get("discardValue") or 0
             if dv:
                 return int(dv)
+            if DISCARD_TABLE:
+                # The real table. Matches what the client already displays, so the
+                # coins paid and the coins shown finally agree.
+                return discard_value(it)
+            # The invented tier. Wrong for every card, kept only as the live-proven
+            # default until FUT_DISCARD_TABLE has been in front of the game once.
             r = it.get("rating") or 0
             return 600 if r >= 85 else 300 if r >= 80 else 150 if r >= 75 else 50
         with _LOCK: