fifa17-recon: log archaeology -- /club is only ever the SEARCH form

REBUILD_RESEARCH S18, from running futlog.py over the full 3044-request history.

The client has requested /club six times and EVERY ONE carried a query string
(year/type/count/position/level/nation/league/team/sort). The bare path has never
been requested. ENDPOINT_MAP says GET ut/%s/club is FutGetClubInfo, whose only
recognised member is user(0x36c), and concludes our itemData body is skipped and the
club list must therefore be empty. The club list is NOT empty; every card renders. So
either the query form dispatches elsewhere or the row is wrong. TODO/CONFIRM.

Relevant to the MY CLUB counter: we ignore the query string completely and return all
109 items to a request asking for count=11 with position and sort filters, and our
response carries no result total. A paged search response is exactly where a tab
counter would read its number from.

Also recorded: the unmapped view is a standing detector for suffix endpoints the URL
template table cannot show. It has caught four so far.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW

fifa17-recon/docs/REBUILD_RESEARCH.md

@@ -726,3 +726,58 @@ Two self-inflicted incidents in the same session, both worth recording:
   the pattern also contained the literal script name in a later clause. It killed the
   invoking shell before it reached the restart. Split the kill and the start into
   separate commands, or obfuscate every occurrence.
+
+---
+
+## 18. Log-archaeology findings (2026-08-04, `futlog.py`)
+
+Filtering the full 3,044-request log to real client traffic (486 requests, User-Agent
+`ProtoHttp`) surfaced three things that were sitting in evidence already collected.
+
+### 18a. `GET /club` is only ever the SEARCH form, and `itemData` is right for it
+
+The client has requested `/club` six times, **every one of them with a query string**:
+
+```
+/club?year=2017&type=player&count=34&position=ST&level=any&nation=-1&league=-1&team=-1&sort=desc
+/club?year=2017&type=player&count=34&position=RB&level=any&...
+/club?year=2017&type=player&count=34&level=any&...
+/club?year=2017&type=player&count=11&level=any&sort=desc          (x3)
+```
+
+**The bare path `/club` has never been requested.** Zero times.
+
+This contradicts `ENDPOINT_MAP.md`, which states that `GET ut/%s/club` resolves to
+`FutGetClubInfoServerResponse`, that its only recognised member is `user`(0x36c) as an
+array of user-records, and therefore that our `{"itemData":[...]}` is skipped and the
+club list must be empty. The club list is **not** empty: the user opened MY CLUB and
+every card rendered. So either the query form dispatches to a different response class,
+or the row is wrong. `TODO/CONFIRM` which.
+
+Two consequences worth chasing:
+
+- We **ignore the query string entirely** and return all 109 items to a request that
+  asked for `count=11` with position and sort filters. That happens to work for
+  rendering, but a search response that carries a result total is exactly the sort of
+  place the MY CLUB counter would read from, and ours carries no count of any kind.
+- `position=ST` and `position=RB` appear only in the 20:15 pair, which is squad-slot
+  filtering. The client is using this endpoint as a player picker, not just a list.
+
+### 18b. The move request had been captured eight times before it was read
+
+See the correction in §17. `PUT /item` appears nine times in the log, eight of them
+during the failed attempts, every one carrying `swap` and `tradeId`. The shape was never
+missing; nobody looked.
+
+### 18c. Endpoints the client wanted that fell through to the catch-all
+
+`futlog.py -s --unmapped` over the whole history:
+
+```
+/leaderboards/options       /match/reset
+/clientdata/userHubData     /delete/game/fifa17/item
+```
+
+All four are now routed. The value here is the method: the unmapped view is a standing
+detector for the suffix endpoints the binary's URL template table cannot show, which
+have now caught this project four separate times. Run it after every session.