fifa17-recon: FUT squad blocker solved + userInfo delivered

The client now issues PUT /squad and the hub renders coins, record and the
squad roster. Three separate root causes, all verified live.

Squad blocker (the long-standing "client never sends PUT /squad"):
  AddPlayerToSquad, GetSquads and SelectSquadById issue ZERO network requests
  (pure local model reads/mutations, FutSquadServiceImpl vtable 0x180233ff0);
  only SaveCurrentSquad writes, and it is unguarded. The client simply needed a
  populated ACTIVE squad model, which arrives via the massinfo `squad` member.
  No response of ours was ever being rejected.

userMassInfo is NOT required to be {}:
  0x180174630 is a FLAT {userInfo, squad, settings, userData} body -- the old
  "wrapper key is user" note was wrong, and the historical freeze was the
  malformed squad member, not the envelope.

clubNameChangeAllowed must be false:
  sending true advertises a club-rename flow whose UI model is never populated;
  the client shows a naming prompt and dies confirming it (ACCESS_VIOLATION
  reading 0x0 at FIFA17.exe+0x71b8651, 4/4 runs, no CardsDLL frame and no request
  in flight). Isolated by a single-variable run; guarded by a contract check.

Endpoint/schema corrections found in live traffic, invisible to static analysis:
  * GET ut/%s/squad/list is a real endpoint and must return {"squad":[...]},
    not the active-squad object (the /list suffix is appended by the caller, so
    it never appeared in the request table)
  * PUT lands on ut/%s/squad/<id>, not a bare ut/%s/squad
  * userInfo currencies are read as name/funds/finalFunds/active -- there is no
    "value" key, so coins always rendered 0
  * squad-list elements take STRING formation/squadType, not ints
  * the CardsDLL script-API thunk<->name table was off by one (AddPlayerToSquad
    is 0x18004aa70; 0x18004aff0 is GetPotentialChemistry_Club)

FUT_MASSINFO / FUT_USERINFO ladders keep every step of the bisect reproducible.
Contract suite 311 -> 358 checks. Tooling added: PyGhidra harness (Ghidra's
Java/OSGi script path is broken on this box), minidump reader, live code grabber.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW

fifa17-recon/docs/CARD_SYSTEM.md

@@ -38,15 +38,17 @@ Offline FIFA 17 Ultimate Team runs end-to-end on our backend:
 
 ## The squad-shell (what makes it work — don't regress these)
 
-- `userMassInfo` MUST return `{}`. Any content (userInfo AND/OR squad) desyncs the
-  massinfo parser (0x180174630) → infinite tokenizer spin (busy-loop freeze at
-  0x1801c7f1a). `utas_server.py`: `FUT_MASSINFO=empty` (default).
+- ~~`userMassInfo` MUST return `{}`~~ — **superseded 2026-08-03.** `0x180174630` is fully
+  decompiled: a FLAT `{userInfo, squad, settings, userData}` body. The old desync is
+  attributed to the `squad` member, which was built before `0x18013d1f0`'s schema was
+  known. `utas_server.py` now defaults to `FUT_MASSINFO=full`; fall back through
+  `squad`/`userinfo`/`settings`/`empty` to bisect if the hub freezes at 0x1801c7f1a.
 - Deliver the squad via **`GET /squad/0`** (LoadActiveSquad, deser 0x18013d1f0),
   which FIFA fetches on **Squads-tab entry** (re-fetches on tab-switch, not on
   editor re-open). `FUT_SQUAD_STEP` selects the squad (s2v0 = 1 real item).
 - `GET /user` is NEVER called at boot — userInfo can only reach FIFA via
-  userMassInfo (which we can't populate without the desync). So the hub's
-  coins/record can't be shown until the userInfo-in-massinfo desync is solved.
+  userMassInfo, which is now populated (above), so the hub's coins/record and the
+  squad roster (`userInfo.squadList`) are delivered at boot. Pending live verify.
 
 ## Why cards render generic (definitively reversed — 3 workflows)