diff --git a/fifa17-recon/docs/REBUILD_RESEARCH.md b/fifa17-recon/docs/REBUILD_RESEARCH.md
index e1d78a9..901105a 100644
--- a/fifa17-recon/docs/REBUILD_RESEARCH.md
+++ b/fifa17-recon/docs/REBUILD_RESEARCH.md
@@ -726,3 +726,58 @@ Two self-inflicted incidents in the same session, both worth recording:
   the pattern also contained the literal script name in a later clause. It killed the
   invoking shell before it reached the restart. Split the kill and the start into
   separate commands, or obfuscate every occurrence.
+
+---
+
+## 18. Log-archaeology findings (2026-08-04, `futlog.py`)
+
+Filtering the full 3,044-request log to real client traffic (486 requests, User-Agent
+`ProtoHttp`) surfaced three things that were sitting in evidence already collected.
+
+### 18a. `GET /club` is only ever the SEARCH form, and `itemData` is right for it
+
+The client has requested `/club` six times, **every one of them with a query string**:
+
+```
+/club?year=2017&type=player&count=34&position=ST&level=any&nation=-1&league=-1&team=-1&sort=desc
+/club?year=2017&type=player&count=34&position=RB&level=any&...
+/club?year=2017&type=player&count=34&level=any&...
+/club?year=2017&type=player&count=11&level=any&sort=desc          (x3)
+```
+
+**The bare path `/club` has never been requested.** Zero times.
+
+This contradicts `ENDPOINT_MAP.md`, which states that `GET ut/%s/club` resolves to
+`FutGetClubInfoServerResponse`, that its only recognised member is `user`(0x36c) as an
+array of user-records, and therefore that our `{"itemData":[...]}` is skipped and the
+club list must be empty. The club list is **not** empty: the user opened MY CLUB and
+every card rendered. So either the query form dispatches to a different response class,
+or the row is wrong. `TODO/CONFIRM` which.
+
+Two consequences worth chasing:
+
+- We **ignore the query string entirely** and return all 109 items to a request that
+  asked for `count=11` with position and sort filters. That happens to work for
+  rendering, but a search response that carries a result total is exactly the sort of
+  place the MY CLUB counter would read from, and ours carries no count of any kind.
+- `position=ST` and `position=RB` appear only in the 20:15 pair, which is squad-slot
+  filtering. The client is using this endpoint as a player picker, not just a list.
+
+### 18b. The move request had been captured eight times before it was read
+
+See the correction in §17. `PUT /item` appears nine times in the log, eight of them
+during the failed attempts, every one carrying `swap` and `tradeId`. The shape was never
+missing; nobody looked.
+
+### 18c. Endpoints the client wanted that fell through to the catch-all
+
+`futlog.py -s --unmapped` over the whole history:
+
+```
+/leaderboards/options       /match/reset
+/clientdata/userHubData     /delete/game/fifa17/item
+```
+
+All four are now routed. The value here is the method: the unmapped view is a standing
+detector for the suffix endpoints the binary's URL template table cannot show, which
+have now caught this project four separate times. Run it after every session.