//! In-process RE probes: passive logging detours on FIFA's online-flow functions.
//!
//! Purpose: FIFA reacts to our pushed LSX events (OnlineStatusEvent/Login) but
//! never starts the GetAuthCode→Nucleus→Blaze chain, and that decision lives in
//! FIFA's game-side / in-process EbisuSDK logic that is invisible from the LSX
//! wire. These probes log when the key online-flow functions are called (and
//! their return values), so we can SEE where FIFA stalls after our events.
//!
//! Mechanism: the same unhook/rehook detour `connect_hook` uses — on entry we
//! restore the original bytes, log, call the real function, then re-install the
//! jump. This needs no trampoline/relocation, so it works even on prologues with
//! RIP-relative operands (e.g. GoOnline). Not thread-safe (a concurrent call
//! during the unhook window runs un-logged) but never corrupts the target — fine
//! for read-only RE.
//!
//! Signature assumption: each probed fn takes ≤4 integer args (Win64: rcx/rdx/
//! r8/r9) and returns in rax. All targets here are SDK methods with few args.
use core::sync::atomic::{AtomicBool, AtomicU32, AtomicUsize, Ordering};
use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
use windows_sys::Win32::System::Memory::{
    VirtualProtect, VirtualQuery, MEMORY_BASIC_INFORMATION, MEM_COMMIT, MEM_PRIVATE,
    PAGE_EXECUTE_READWRITE, PAGE_GUARD, PAGE_NOACCESS,
};
use windows_sys::Win32::System::Threading::GetCurrentThreadId;

/// Fault-safe pointer read: returns None unless `ptr` lands in a committed, readable
/// page (checked via VirtualQuery). Avoids crashing FIFA when we sample pointers that
/// may be null/garbage mid-construction.
unsafe fn read_ptr(ptr: usize) -> Option<usize> {
    if ptr < 0x10000 || ptr & 7 != 0 {
        return None;
    }
    let mut mbi: MEMORY_BASIC_INFORMATION = core::mem::zeroed();
    let n = VirtualQuery(
        ptr as _,
        &mut mbi,
        core::mem::size_of::<MEMORY_BASIC_INFORMATION>(),
    );
    if n == 0 || mbi.State != MEM_COMMIT {
        return None;
    }
    if mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD) != 0 {
        return None;
    }
    // Ensure the full 8 bytes are inside the region.
    if ptr + 8 > mbi.BaseAddress as usize + mbi.RegionSize {
        return None;
    }
    Some(core::ptr::read_volatile(ptr as *const usize))
}

/// Poll the Nucleus session-context chain directly, independent of the login state
/// machine: X = OriginSDK singleton [FIFA23.exe+0xacd02c0]; M = [X+0x360] (online/
/// Nucleus manager); ctx = [M+0x778] (the session context that nucleusConnectREST/
/// Trusted null-check). Logs each level so we see exactly if/when the context is
/// created. All reads are VirtualQuery-guarded, so a null/garbage pointer is logged,
/// never dereferenced blind.
pub fn install_state_sampler() {
    std::thread::spawn(|| unsafe {
        let base = GetModuleHandleA(core::ptr::null());
        if base.is_null() {
            crate::write_log("SAMPLE: main exe not found\n");
            return;
        }
        let x_slot = base as usize + 0xacd02c0; // VA 0x14acd02c0
        let mut last = String::new();
        for i in 0..180u32 {
            std::thread::sleep(std::time::Duration::from_millis(1000));
            let line = match read_ptr(x_slot) {
                None => "X=<unreadable>".to_string(),
                Some(0) => "X=null".to_string(),
                Some(x) => match read_ptr(x + 0x360) {
                    None => format!("X={x:#x} M=<unreadable>"),
                    Some(0) => format!("X={x:#x} M=null"),
                    Some(m) => match read_ptr(m + 0x778) {
                        None => format!("X={x:#x} M={m:#x} ctx=<unreadable>"),
                        Some(c) => format!("X={x:#x} M={m:#x} ctx[M+0x778]={c:#x}"),
                    },
                },
            };
            // Only log on change (plus a heartbeat every 20s) to keep the log clean.
            if line != last || i % 20 == 0 {
                crate::write_log(&format!("SAMPLE #{i} {line}\n"));
                last = line;
            }
        }
    });
}

// ─── live game-side listener capture ────────────────────────────────────────────
//
// OnlineStatusEventT::HandleMessage dispatches the parsed bool to the game's online
// listener via a virtual call `call [rax+0x28]` at FIFA23.exe+0x274d4e2, where rax
// is the vtable of the object at [rsi-0x38]. The concrete listener is only known at
// runtime. We capture it with a behavior-preserving mid-function detour: patch the
// 14 bytes at +0x274d4d7 (which are exactly `lea rcx,[rsi-0x38]; mov rax,[rcx]; lea
// rdx,[rbp-0x49]; call [rax+0x28]`) to jump to a stub that replicates those four
// instructions but logs the resolved listener address in between, then resumes at
// +0x274d4e5. Non-volatile regs (rsi/rbp/…) are preserved by the ABI; volatiles
// match the original dispatch's clobbers.

/// Runtime absolute address to resume at after the replicated dispatch
/// (main-exe base + 0x274d4e5). Read by the asm stub.
#[no_mangle]
static mut RESUME_ADDR: u64 = 0;
static MAIN_BASE: AtomicUsize = AtomicUsize::new(0);
static LISTENER_LOGGED: AtomicBool = AtomicBool::new(false);

/// Called by the stub with the listener object's vtable and the resolved listener
/// function pointer (vtable[0x28]). Logs once (RVAs for static RE).
unsafe extern "C" fn listener_log(vtable: usize, func: usize) {
    // Run the dial trigger on EVERY event dispatch — it self-gates internally (kill
    // switch, one-shot latch, precondition checks). This must run BEFORE the
    // LISTENER_LOGGED one-shot below, which returns on all but the very first fire.
    dial_trigger_tick();
    connmgr_enum_tick();
    elem_watch_tick();
    if LISTENER_LOGGED.swap(true, Ordering::Relaxed) {
        return;
    }
    let base = MAIN_BASE.load(Ordering::Relaxed);
    crate::write_log(&format!(
        "PROBE OnlineStatus.listener: vtable={vtable:#x} (rva {:#x})  fn={func:#x} (rva {:#x})\n",
        vtable.wrapping_sub(base),
        func.wrapping_sub(base),
    ));
}

core::arch::global_asm!(
    ".intel_syntax noprefix",
    ".global openfut_listener_stub",
    "openfut_listener_stub:",
    "lea rcx, [rsi - 0x38]",
    "mov rax, [rcx]",            // rax = listener vtable
    "mov rdx, [rax + 0x28]",     // rdx = listener fn  (arg2)
    "mov rcx, rax",              // rcx = vtable       (arg1)
    // Align the stack to 16 before the call, saving the original rsp so we can
    // restore it (0x28 misaligns; SSE code in the logger then faults).
    "mov r11, rsp",
    "and rsp, -16",
    "sub rsp, 0x30",            // 0x20 shadow + 0x10 spare, stays 16-aligned
    "mov [rsp + 0x20], r11",    // stash original rsp
    "call {log}",
    "mov rsp, [rsp + 0x20]",    // restore original rsp
    "lea rcx, [rsi - 0x38]",     // replicate the original dispatch
    "mov rax, [rcx]",
    "lea rdx, [rbp - 0x49]",
    "call qword ptr [rax + 0x28]",
    "mov r10, qword ptr [rip + {resume}]",
    "jmp r10",
    ".att_syntax prefix",
    log = sym listener_log,
    resume = sym RESUME_ADDR,
);

extern "C" {
    fn openfut_listener_stub();
}

/// Patch the OnlineStatusEvent dispatch site to route through the logging stub.
pub unsafe fn install_listener_probe() {
    let base = GetModuleHandleA(core::ptr::null());
    if base.is_null() {
        crate::write_log("PROBE listener: main exe not found\n");
        return;
    }
    let base = base as usize;
    MAIN_BASE.store(base, Ordering::Relaxed);
    // Arm the dial trigger from the env var, ONCE, at install (DLL-load) time. Default
    // disarmed: OPENFUT_DIAL_TRIGGER must be explicitly "1". Orthogonal to the pump/ctx
    // env vars.
    let armed = std::env::var("OPENFUT_DIAL_TRIGGER")
        .map(|v| v == "1")
        .unwrap_or(false);
    DIAL_ARMED.store(armed, Ordering::Relaxed);
    crate::write_log(&format!(
        "DIAL_TRIGGER: {} (env OPENFUT_DIAL_TRIGGER)\n",
        if armed { "ARMED" } else { "disarmed" }
    ));
    // Arm the (independent) connMgr enumeration from its own env var, once, at load.
    let enum_armed = std::env::var("OPENFUT_CONNMGR_ENUM")
        .map(|v| v == "1")
        .unwrap_or(false);
    CONNMGR_ENUM_ARMED.store(enum_armed, Ordering::Relaxed);
    crate::write_log(&format!(
        "CONNMGR_ENUM: {} (env OPENFUT_CONNMGR_ENUM)\n",
        if enum_armed { "ARMED" } else { "disarmed" }
    ));
    // Arm the (independent) [element+0x40] container-writer watchpoint from its own
    // env var, once, at load. Orthogonal to DIAL_TRIGGER / CONNMGR_ENUM.
    let elem_watch_armed = std::env::var("OPENFUT_ELEM_WATCH")
        .map(|v| v == "1")
        .unwrap_or(false);
    ELEM_WATCH_ARMED.store(elem_watch_armed, Ordering::Relaxed);
    crate::write_log(&format!(
        "ELEM_WATCH: {} (env OPENFUT_ELEM_WATCH)\n",
        if elem_watch_armed {
            "ARMED"
        } else {
            "disarmed"
        }
    ));
    RESUME_ADDR = (base + 0x274d4e5) as u64;
    let target = (base + 0x274d4d7) as *mut u8;
    write_jmp(target, openfut_listener_stub as usize as u64);
    crate::write_log(&format!(
        "PROBE listener: dispatch site patched @ {:#x}\n",
        target as usize
    ));
}

// ─── dial trigger (sub-phase B) ──────────────────────────────────────────────────
//
// Extends the listener probe (NOT a new detour): `dial_trigger_tick()` runs on every
// OnlineStatusEvent dispatch — on the game's online-servicing thread — and, once every
// precondition lines up, calls the redirector dial handler 0x144f4d360 directly with
// (connMgr, synthetic-notification). One-shot, env-gated, heavily guarded and logged.
//
// Addresses (all from prior confirmed reports; RVA = VA − base, base = main-exe module):
//   dial handler         base+0x4f4d360    (VA 0x144f4d360)   rcx=connMgr, rdx=notification
//   NetConnStatus        base+0xef17f0     (VA 0x140ef17f0)   ecx='conn' -> eax status
//   G (OriginSDK global) base+0xacd02c0    (VA 0x14acd02c0)
//   connMgr vtable       base+0x80200b8;   M=*[G+0x360]; ctx=*[M+0x778]; connMgr scan.

/// Kill switch, read once at DLL load from OPENFUT_DIAL_TRIGGER (see install_listener_probe).
static DIAL_ARMED: AtomicBool = AtomicBool::new(false);
/// One-shot latch. Claimed (false→true) immediately BEFORE the dial call so a re-entrant
/// dispatch can't double-fire; also set on the FATAL sanity failure.
static DIAL_TRIGGER_FIRED: AtomicBool = AtomicBool::new(false);
/// Thread id of the first listener-probe fire (the online-servicing thread). 0 until seen.
static LISTENER_TID: AtomicU32 = AtomicU32::new(0);
/// Last completion-stub count we logged, so we only log on change.
static LAST_COMPLETION_COUNT: AtomicU32 = AtomicU32::new(0);
/// Rate-limit state for skip logging: the reason currently being counted, and how many.
static LAST_SKIP_REASON: AtomicU32 = AtomicU32::new(0);
static SKIP_COUNT: AtomicU32 = AtomicU32::new(0);

/// Public snapshot of trigger state, for future polling (not needed for correctness).
/// (A `#[repr(C)]` layout would matter only if C code read this; plain Rust is fine here.)
#[allow(dead_code)]
pub struct DialTriggerStatus {
    pub kill_switch_armed: bool,
    pub latch_fired: bool,
    pub listener_thread_id: u32,
    pub pump_thread_id: u32,
    pub last_completion_count: u32,
}

#[allow(dead_code)]
pub fn dial_trigger_status() -> DialTriggerStatus {
    DialTriggerStatus {
        kill_switch_armed: DIAL_ARMED.load(Ordering::Relaxed),
        latch_fired: DIAL_TRIGGER_FIRED.load(Ordering::Relaxed),
        listener_thread_id: LISTENER_TID.load(Ordering::Relaxed),
        pump_thread_id: netconn_thread_id(),
        last_completion_count: LAST_COMPLETION_COUNT.load(Ordering::Relaxed),
    }
}

/// Rate-limited skip logger: logs the first 3 skips of a given reason, then one
/// "suppressed" line, then goes silent for that reason. Counters reset when the reason
/// changes, so a *new* failure mode logs fresh.
fn log_skip(reason_id: u32, msg: &str) {
    // `swap` sets the current reason and returns the previous one; if it changed, reset.
    if LAST_SKIP_REASON.swap(reason_id, Ordering::Relaxed) != reason_id {
        SKIP_COUNT.store(0, Ordering::Relaxed);
    }
    let n = SKIP_COUNT.fetch_add(1, Ordering::Relaxed);
    if n < 3 {
        crate::write_log(msg);
    } else if n == 3 {
        crate::write_log("DIAL_TRIGGER: (further skips of this reason suppressed)\n");
    }
}

/// After the dial has fired, log the completion-stub counter whenever it changes — our
/// signal that the enqueued RpcJob actually ran (Tier-2 success).
fn observe_completion() {
    let c = crate::dial_notification::completion_stub_call_count();
    let last = LAST_COMPLETION_COUNT.swap(c, Ordering::Relaxed);
    if c != last {
        crate::write_log(&format!(
            "DIAL_TRIGGER: completion stub count changed {last} → {c}\n"
        ));
    }
}

/// The trigger. Runs on every listener-probe fire; self-gates so it fires the dial at
/// most once, only when every precondition holds. Called from `listener_log`, which the
/// asm stub invokes with a properly-aligned stack and shadow space.
unsafe fn dial_trigger_tick() {
    // Step 1 — kill switch (env value cached at load).
    if !DIAL_ARMED.load(Ordering::Relaxed) {
        return;
    }
    // Step 2 — latch. Once fired, only keep watching the completion counter.
    // `SeqCst` (sequentially consistent) is the strongest, simplest-to-reason-about
    // ordering; for a gate that decides whether we perform an action, we prefer that
    // safety over the (subtle) minimum `Relaxed` would allow.
    if DIAL_TRIGGER_FIRED.load(Ordering::SeqCst) {
        observe_completion();
        return;
    }
    let base = MAIN_BASE.load(Ordering::Relaxed);
    if base == 0 {
        return;
    }

    // Step 3 — thread capture + self-consistency + pump-contrast sanity.
    // GetCurrentThreadId: Win32 FFI (no args, returns this thread's id). It's `unsafe`
    // only because it's a foreign call; it has no preconditions and no side effects.
    let tid = GetCurrentThreadId();
    let stored = LISTENER_TID.load(Ordering::Relaxed);
    if stored == 0 {
        LISTENER_TID.store(tid, Ordering::Relaxed);
        let pump = netconn_thread_id();
        crate::write_log(&format!(
            "DIAL_TRIGGER: first listener fire, thread_id={tid}, pump_id={pump}\n"
        ));
        // Pump-contrast sanity: the listener must NOT be our own background pump thread.
        // A match here means our whole thread model is broken — abort permanently.
        if tid == pump && pump != 0 {
            crate::write_log(
                "DIAL_TRIGGER: FATAL — listener thread matches pump thread; aborting\n",
            );
            DIAL_TRIGGER_FIRED.store(true, Ordering::SeqCst);
            return;
        }
    } else if stored != tid {
        log_skip(
            1,
            &format!("DIAL_TRIGGER: listener thread varied (was {stored}, now {tid}) — skipping\n"),
        );
        return;
    }

    // Step 4 — conn state must be '+onl'. NetConnStatus(rcx='conn',0,0,0) -> eax.
    let netconn_status: unsafe extern "system" fn(u32, usize, usize, usize) -> u32 =
        core::mem::transmute(base + 0xef17f0);
    let status = netconn_status(0x636f6e6e, 0, 0, 0);
    if status != 0x2b6f6e6c {
        log_skip(
            2,
            &format!("DIAL_TRIGGER: not +onl (conn=0x{status:08x}) — skipping\n"),
        );
        return;
    }

    // Step 5 — resolve connMgr (reuse the ctx-dump scan + tiebreaker).
    let Some(g) = read_ptr(base + 0xacd02c0).filter(|&x| x != 0) else {
        log_skip(
            3,
            "DIAL_TRIGGER: connMgr resolution failed (G null) — skipping\n",
        );
        return;
    };
    let Some(m) = read_ptr(g + 0x360).filter(|&x| x != 0) else {
        log_skip(
            3,
            "DIAL_TRIGGER: connMgr resolution failed (M null) — skipping\n",
        );
        return;
    };
    let expected_vtable = base + 0x80200b8;
    let mut stats = (0u64, 0u64);
    let cands = scan_conn_mgr(m, expected_vtable, &mut stats);
    // Tiebreaker: first candidate whose vtable[0] lands in .text (a real live object).
    let mut conn_mgr = 0usize;
    for &p in &cands {
        let vt0 = read_ptr(read_ptr(p).unwrap_or(0)).unwrap_or(0);
        if in_text(base, vt0) {
            conn_mgr = p;
            break;
        }
    }
    if conn_mgr == 0 {
        log_skip(
            3,
            &format!(
                "DIAL_TRIGGER: connMgr resolution failed ({} candidate(s), none clean) — skipping\n",
                cands.len()
            ),
        );
        return;
    }

    // Step 6 — ctx sanity: [connMgr+8]=M, [M+0x778]=ctx must be a live object whose
    // vtable pointer lands in the module image (0x140000000..0x161000000).
    let m_holder = read_ptr(conn_mgr + 8).unwrap_or(0);
    let ctx = read_ptr(m_holder + 0x778).unwrap_or(0);
    let ctx_vt = read_ptr(ctx).unwrap_or(0);
    if ctx == 0 || !(0x140000000..0x161000000).contains(&ctx_vt) {
        log_skip(
            4,
            &format!(
                "DIAL_TRIGGER: ctx pointer implausible (ctx={ctx:#x} vt={ctx_vt:#x}) — skipping\n"
            ),
        );
        return;
    }

    // All preconditions hold. Claim the one-shot latch ATOMICALLY, right before the call,
    // so a re-entrant OnlineStatusEvent dispatch can't double-fire the dial. `compare_
    // exchange(false→true)` is a proper CAS: exactly one caller wins; a loser bails. (I
    // use CAS rather than `swap`/load-then-store because it both claims and checks in one
    // atomic step — the correct primitive for a one-shot "exactly one winner" latch.)
    // NOTE: this sets the latch just before the call rather than just after (as the task
    // sketch said) specifically to close the re-entrancy window; preconditions that fail
    // above still leave the latch clear, so they retry on later fires as intended.
    if DIAL_TRIGGER_FIRED
        .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
        .is_err()
    {
        return;
    }

    // Step 7 — build the notification with a 'static lifetime via Box::leak.
    // `Box::new(...)` heap-allocates the [u8;0x100]; `Box::leak` converts that owned Box
    // into a `&'static mut [u8;0x100]` by intentionally NOT running its destructor — the
    // 256 bytes live for the whole process. We do this so the buffer outlives anything
    // the dial branch might retain a pointer into. The RE showed only value-copies out of
    // the notification, so a stack buffer would *probably* be safe — but a permanent
    // buffer removes all doubt on the highest-stakes call in the project, and the leak
    // happens exactly once, so it's harmless.
    let notif: &'static mut [u8; 0x100] =
        Box::leak(Box::new(crate::dial_notification::build_notification()));
    let notif_ptr = notif.as_ptr();

    // Step 8 — fire the dial.
    // `unsafe extern "system" fn(*mut u8, *const u8) -> usize`: on 64-bit Windows the
    // "system" ABI *is* the Win64 calling convention (integer args in rcx, rdx, r8, r9;
    // return in rax) — exactly what the game function expects (rcx=connMgr, rdx=notif).
    // We `transmute` the resolved code address into this typed fn so the compiler emits a
    // correct Win64 call (right registers, 32-byte shadow space, return read from rax); a
    // bare pointer carries no ABI and couldn't be called correctly. The return TYPE is an
    // inference — we log whatever integer comes back regardless of what it means.
    let dial: unsafe extern "system" fn(*mut u8, *const u8) -> usize =
        core::mem::transmute(base + 0x4f4d360);
    crate::write_log(&format!(
        "DIAL_TRIGGER: calling 0x144f4d360 connMgr={conn_mgr:#x} notification={:#x}\n",
        notif_ptr as usize
    ));
    // Force the pre-call line to disk BEFORE the call — if the dial faults, this line is
    // how we know we reached the call site (crash RIP would be inside the dial branch).
    crate::flush_log();
    // THE dial call — the most consequential unsafe in the project. We hand the game its
    // own dial handler with a real connMgr (resolved + ctx-checked) and our synthetic
    // notification (matching the RE'd contract). This is sound iff: we're on the online
    // thread (step 3), conn=='+onl' (step 4), connMgr is a valid live object (step 5),
    // ctx is populated (step 6), and the notification matches the contract (unit-tested
    // dial_notification). If any of those is wrong the game may fault inside the dial
    // branch — which is normal .text and therefore diagnosable. We accept that risk.
    let ret = dial(conn_mgr as *mut u8, notif_ptr);
    crate::write_log(&format!("DIAL_TRIGGER: dial returned {ret:#x}\n"));

    // Step 10 — start watching the completion counter (Tier-2 signal on later fires).
    observe_completion();
}

// ─── connMgr candidate enumeration (read-only diagnostic) ────────────────────────
//
// After sub-phase B crashed on the `[connMgr+0x18]!=0` dial sub-path, we want to know
// whether OTHER connMgr instances exist and — critically — what each one's `[+0x18]` is.
// A candidate with `[+0x18]==0` would route the dial through the crash-free "create"
// branch (0x144f4d5fd). This enumerates EVERY candidate the resolver's scan finds (not
// just the first) and logs each one's branch-relevant fields. Pure observation: no dial,
// no writes, no game calls. Reuses `scan_conn_mgr` (which already returns all matches),
// `read_ptr`, `read_bytes`, `hex_dump`, `in_text` — nothing in sub-phase B is touched.

/// Kill switch, read once at DLL load from OPENFUT_CONNMGR_ENUM (independent of the
/// dial/pump/ctx switches).
static CONNMGR_ENUM_ARMED: AtomicBool = AtomicBool::new(false);
/// One-shot latch: enumerate exactly once per process.
static CONNMGR_ENUM_DONE: AtomicBool = AtomicBool::new(false);
/// Retry counter: if the first scans find nothing (connMgr not built yet), retry a few
/// listener fires before committing to a "zero candidates" verdict (avoids a false zero
/// from a timing race).
static CONNMGR_ENUM_TRIES: AtomicU32 = AtomicU32::new(0);

/// One connMgr candidate's branch-relevant fields.
///
/// Derives: `Debug` for ad-hoc `{:?}` debugging (note it prints integers in *decimal*,
/// so the log lines below format hex explicitly). `Clone, Copy` because it's a small
/// plain-old-data struct (all `usize`/`bool`/`Option<usize>`, every field itself `Copy`)
/// — copying is trivial and it lets us collect into a `Vec` and re-scan it for the
/// summary without any borrow-checker friction.
#[derive(Debug, Clone, Copy)]
struct CandidateInfo {
    p: usize,
    vtable: usize,
    vtable0: usize,
    vtable0_in_text: bool,
    field_18: Option<usize>, // [P+0x18] — THE branch-selection field (0 => safe branch)
    field_20: Option<usize>, // [P+0x20] — ordered-container head (expect 0 at menu)
    field_30: Option<usize>, // [P+0x30] — ordered-container head (expect 0 at menu)
    field_c38: Option<usize>, // [P+0xc38] — dispatcher pointer
}

/// Enumerate all connMgr candidates and log each one's `[+0x18]`. Runs once, on the
/// listener thread, gated on the pump running (menu reached) — NOT on '+onl'.
unsafe fn connmgr_enum_tick() {
    // Step 1 — kill switch.
    if !CONNMGR_ENUM_ARMED.load(Ordering::Relaxed) {
        return;
    }
    // Step 2 — one-shot: already enumerated?
    if CONNMGR_ENUM_DONE.load(Ordering::Relaxed) {
        return;
    }
    // Step 3 — gate on the pump having fired (a cheap "we're at the menu" signal). We do
    // NOT gate on '+onl': connMgr exists at the menu, and enumerating early gives us more
    // time. Requires OPENFUT_NETCONN_PUMP=1 (else netconn_thread_id stays 0 forever).
    if netconn_thread_id() == 0 {
        return;
    }
    let base = MAIN_BASE.load(Ordering::Relaxed);
    if base == 0 {
        return;
    }

    // Step 4 — resolve M. On a null link, DON'T latch — just retry on the next fire.
    let Some(g) = read_ptr(base + 0xacd02c0).filter(|&x| x != 0) else {
        return;
    };
    let Some(m) = read_ptr(g + 0x360).filter(|&x| x != 0) else {
        return;
    };

    // Step 5 — scan for EVERY candidate. `scan_conn_mgr` already collects all matches of
    // `[P+0]==vtable && [P+8]==M` (the resolver just picks the first clean one on top), so
    // we reuse it unchanged — the enumeration and the resolver share one scan.
    let expected_vtable = base + 0x80200b8;
    let mut stats = (0u64, 0u64);
    let t0 = std::time::Instant::now();
    let cands = scan_conn_mgr(m, expected_vtable, &mut stats);
    let scan_ms = t0.elapsed().as_millis();

    // If empty, it may be a timing race (connMgr not built yet). Retry up to 8 fires
    // before accepting a genuine "zero" — `fetch_add` returns the prior count.
    if cands.is_empty() && CONNMGR_ENUM_TRIES.fetch_add(1, Ordering::Relaxed) < 8 {
        return;
    }
    // Commit exactly once.
    if CONNMGR_ENUM_DONE.swap(true, Ordering::Relaxed) {
        return;
    }

    crate::write_log(&format!(
        "CONNMGR_ENUM: G={g:#x} M={m:#x} scanned {} regions / {} MB in {scan_ms}ms — {} candidate(s)\n",
        stats.0,
        stats.1 / (1024 * 1024),
        cands.len()
    ));

    // A `Vec<CandidateInfo>` is fine here: this runs exactly once, on a ~2s-cadence event
    // callback (not a hot path), and we're already allocating (format! strings, and
    // scan_conn_mgr's own Vec). A handful of candidates is trivial. (Idiomatic-but-beyond-
    // beginner alternatives noted for later: an `impl Iterator` scan to avoid the interim
    // Vec, or Rayon to parallelise the region sweep — neither is worth it for a one-shot.)
    let mut infos: Vec<CandidateInfo> = Vec::new();
    // Render an Option<usize> as hex, or "<unreadable>" if the field couldn't be read.
    let h = |o: Option<usize>| match o {
        Some(v) => format!("{v:#x}"),
        None => "<unreadable>".to_string(),
    };
    for (i, &p) in cands.iter().enumerate() {
        // SAFE: `p` came from scan_conn_mgr, which only emits addresses inside committed,
        // readable heap regions (VirtualQuery-classified). read_ptr re-checks each read is
        // 8-aligned and committed, returning None rather than dereferencing bad memory, so
        // every field read below is guarded — a garbage/partial object logs, never faults.
        let vtable = read_ptr(p).unwrap_or(0);
        let vtable0 = read_ptr(vtable).unwrap_or(0);
        let info = CandidateInfo {
            p,
            vtable,
            vtable0,
            vtable0_in_text: in_text(base, vtable0),
            field_18: read_ptr(p + 0x18),
            field_20: read_ptr(p + 0x20),
            field_30: read_ptr(p + 0x30),
            field_c38: read_ptr(p + 0xc38),
        };
        infos.push(info);
        crate::write_log(&format!(
            "CONNMGR_ENUM: [{i}] P={p:#x} vt={vtable:#x} vt[0]={vtable0:#x} ({}) \
             [+0x18]={} [+0x20]={} [+0x30]={} [+0xc38]={}\n",
            if info.vtable0_in_text {
                "in .text"
            } else {
                "NOT .text"
            },
            h(info.field_18),
            h(info.field_20),
            h(info.field_30),
            h(info.field_c38),
        ));
        // 64-byte hex+ASCII (reuses the ctx-dump helpers): offset | 16 hex | ASCII.
        if let Some(bytes) = read_bytes(p, 64) {
            hex_dump(&format!("[{i}] P"), p, &bytes);
        }
    }

    // Summary: count the branch-relevant split on [+0x18], and note the resolver's pick.
    let with_zero = infos.iter().filter(|c| c.field_18 == Some(0)).count();
    let with_nonzero = infos
        .iter()
        .filter(|c| matches!(c.field_18, Some(v) if v != 0))
        .count();
    // Which candidate sub-phase B's resolver would pick: first with vtable[0] in .text.
    let pick = infos.iter().find(|c| c.vtable0_in_text).map(|c| c.p);
    crate::write_log(&format!(
        "CONNMGR_ENUM: SUMMARY total={} [+0x18]==0(safe)={} [+0x18]!=0(crash)={} subphaseB_pick={}\n",
        infos.len(),
        with_zero,
        with_nonzero,
        pick.map(|p| format!("{p:#x}")).unwrap_or_else(|| "none".to_string()),
    ));
    // One at-a-glance OUTCOME line mapping to the four expected cases.
    let outcome = if infos.is_empty() {
        "zero (unexpected — timing or bug)"
    } else if with_zero > 0 {
        "has-safe-candidate (PROMISING — a [+0x18]==0 connMgr exists → try selecting it)"
    } else if infos.len() == 1 {
        "single-all-nonzero (no alternate connMgr → needs option 2: container init)"
    } else {
        "multiple-all-nonzero (all route to crash branch → needs option 2)"
    };
    crate::write_log(&format!("CONNMGR_ENUM: OUTCOME = {outcome}\n"));
}

// ─── [element+0x40] container-writer watchpoint ──────────────────────────────────
//
// The sub-phase B dial crashed at 0x144fd6b6c reading a garbage `begin` pointer out
// of the per-connection message-handler flat-map stored at `element+0x40` (element =
// [ctx+0x1a8] + target_index*0x90). Static RE proved that container is filled by the
// connection *lifecycle*, not by a discrete callable init — but couldn't say *when*
// or *by whom* it goes from garbage/empty to populated. This probe answers that at
// runtime, purely by observation:
//
//   Phase 1 (one-shot, on the listener/game thread): snapshot the array shape
//     (array_base, sub_object, count, target_index), locate `element`, hex-dump it,
//     and classify [element+0x40] as null-init / uninitialized / initialized.
//   Phase 2 (background thread, 100ms poll): watch [element+0x40] for the moment it
//     changes, logging the new value + surrounding bytes + live conn fourcc + uptime.
//
// It is a POLLING watchpoint, not a hardware one: user-mode code can't cheaply set a
// debug-register / page-guard write-watch on another thread's writes without acting as
// a debugger, so a 100ms read poll is the pragmatic read-only choice (a fast writer
// could in theory change-then-change-back between polls, but the container fill we care
// about is a one-way garbage→populated transition, which a poll catches reliably).
//
// Read-only throughout: no writes, no dial, no game calls (the conn fourcc is read from
// the NetConn status word in memory, not via NetConnStatus). Reuses scan_conn_mgr /
// read_ptr / read_bytes.

/// Kill switch, read once at DLL load from OPENFUT_ELEM_WATCH (independent of the
/// dial / pump / enum / ctx switches).
static ELEM_WATCH_ARMED: AtomicBool = AtomicBool::new(false);
/// One-shot latch: take the snapshot (and arm the watcher) exactly once per process.
static ELEM_WATCH_DONE: AtomicBool = AtomicBool::new(false);
/// Retry counter: if the first scans can't resolve connMgr yet, retry a few listener
/// fires before giving up (avoids a false "unresolved" from a timing race).
static ELEM_WATCH_TRIES: AtomicU32 = AtomicU32::new(0);
/// Absolute VA of the watched element (set by the snapshot, read by the watcher). 0 =
/// not yet armed / no valid element.
static ELEM_WATCH_ELEM: AtomicUsize = AtomicUsize::new(0);
/// Last-seen value of [element+0x40]. Seeded by the snapshot; the watcher compares each
/// poll against it and updates it on a change. `AtomicUsize` (not a plain `usize`)
/// because the snapshot writes it on the game thread and the watcher reads+writes it on
/// its own thread — the atomic gives well-defined cross-thread access with no lock.
/// `Relaxed` is enough: we only compare the value, with no ordering vs other memory.
static ELEM_WATCH_BASELINE: AtomicUsize = AtomicUsize::new(0);

/// Read a 32-bit little-endian value at `addr`, VirtualQuery-guarded via `read_bytes`.
/// `read_ptr` can't be reused for these fields: it reads 8 bytes and *requires 8-byte
/// alignment*, but `sub_object+0x51c` (the count) is 4-aligned only. `read_bytes` has no
/// alignment requirement and clamps to the committed region, so it's the safe primitive.
unsafe fn read_u32(addr: usize) -> Option<u32> {
    let b = read_bytes(addr, 4)?;
    if b.len() < 4 {
        return None; // region ended mid-field — treat as unreadable
    }
    Some(u32::from_le_bytes([b[0], b[1], b[2], b[3]]))
}

/// Render a 32-bit fourcc (e.g. NetConn's `'+onl'` = 0x2b6f6e6c) as its 4 ASCII chars,
/// low byte first (matching how the game packs `('+','o','n','l')`). Non-printable bytes
/// show as '.'. Purely for readable logs.
fn fourcc4(v: u32) -> String {
    let b = v.to_le_bytes();
    b.iter()
        .map(|&c| {
            if (0x20..0x7f).contains(&c) {
                c as char
            } else {
                '.'
            }
        })
        .collect()
}

/// Classic hex dump for the ELEM_WATCH lines. Deliberately a small copy of `hex_dump`'s
/// body rather than a call to it: `hex_dump` hard-codes a `"CTXDUMP"` log prefix, and we
/// want an `"ELEM_WATCH"` prefix so these lines grep together with the rest of the phase.
/// (Refactoring `hex_dump` to take a prefix would touch the stable ctx-dump/enum probes
/// for no real gain; a ~10-line duplicate is the lower-risk choice.)
fn elem_hex_dump(label: &str, start_va: usize, data: &[u8]) {
    let mut out = format!(
        "ELEM_WATCH {label} @{start_va:#x} ({} bytes):\n",
        data.len()
    );
    for (row, chunk) in data.chunks(16).enumerate() {
        let mut hex = String::new();
        let mut ascii = String::new();
        for (i, &b) in chunk.iter().enumerate() {
            hex.push_str(&format!("{b:02x} "));
            if i == 7 {
                hex.push(' ');
            }
            ascii.push(if (0x20..0x7f).contains(&b) {
                b as char
            } else {
                '.'
            });
        }
        out.push_str(&format!("  +{:#05x}  {:<50}|{ascii}|\n", row * 16, hex));
    }
    crate::write_log(&out);
}

/// Phase 1: snapshot the container element + arm the Phase-2 watcher. Runs on the
/// listener (game) thread, once, gated on the pump running (menu reached) — NOT on
/// '+onl' (the element exists at the menu; earlier snapshot = more watch time).
unsafe fn elem_watch_tick() {
    // Step 1 — kill switch.
    if !ELEM_WATCH_ARMED.load(Ordering::Relaxed) {
        return;
    }
    // Step 2 — one-shot: already snapshotted?
    if ELEM_WATCH_DONE.load(Ordering::Relaxed) {
        return;
    }
    // Step 3 — gate on the pump having fired ("we're at the menu"). Requires
    // OPENFUT_NETCONN_PUMP=1 (else netconn_thread_id stays 0 forever).
    if netconn_thread_id() == 0 {
        return;
    }
    let base = MAIN_BASE.load(Ordering::Relaxed);
    if base == 0 {
        return;
    }

    // Step 4 — resolve M (G = OriginSDK singleton, M = [G+0x360]). Null link => don't
    // latch, just retry on the next fire.
    let Some(g) = read_ptr(base + 0xacd02c0).filter(|&x| x != 0) else {
        return;
    };
    let Some(m) = read_ptr(g + 0x360).filter(|&x| x != 0) else {
        return;
    };

    // Step 5 — resolve connMgr: reuse the same scan + "first candidate whose vtable[0]
    // is in .text" tiebreak that sub-phase B's dial resolver uses, so we snapshot the
    // exact object the dial would have operated on.
    let expected_vtable = base + 0x80200b8;
    let mut stats = (0u64, 0u64);
    let cands = scan_conn_mgr(m, expected_vtable, &mut stats);
    let mut conn_mgr = 0usize;
    for &p in &cands {
        let vt0 = read_ptr(read_ptr(p).unwrap_or(0)).unwrap_or(0);
        if in_text(base, vt0) {
            conn_mgr = p;
            break;
        }
    }
    if conn_mgr == 0 {
        // Not resolvable yet — retry up to 8 fires before giving up (timing race).
        if ELEM_WATCH_TRIES.fetch_add(1, Ordering::Relaxed) < 8 {
            return;
        }
        if ELEM_WATCH_DONE.swap(true, Ordering::Relaxed) {
            return;
        }
        crate::write_log("ELEM_WATCH: connMgr unresolved after retries — snapshot aborted\n");
        return;
    }

    // connMgr is resolved: commit the one-shot latch NOW. Everything below is a single
    // observation of whatever state exists — including "not set up yet", which is a
    // valid RESULT, not a reason to retry. (If we retried on an uninitialized element we
    // would loop forever, since offline it may never populate.)
    if ELEM_WATCH_DONE.swap(true, Ordering::Relaxed) {
        return;
    }

    // Step 6 — walk connMgr -> M -> ctx. (M here is re-read from [connMgr+8]; it should
    // equal the global M we scanned with.)
    let cm_m = read_ptr(conn_mgr + 8).unwrap_or(0);
    let ctx = if cm_m != 0 {
        read_ptr(cm_m + 0x778).unwrap_or(0)
    } else {
        0
    };
    if cm_m == 0 || ctx == 0 {
        crate::write_log(&format!(
            "ELEM_WATCH: chain broke (connMgr={conn_mgr:#x} M={cm_m:#x} ctx={ctx:#x}) — watchpoint not armed\n"
        ));
        return;
    }

    // Step 7 — read the array shape. Each field is guarded (read_ptr/read_u32 return
    // None rather than fault). Contract (from the 0x145057430 getter RE):
    //   array_base   = [ctx+0x1a8]          (base of the 0x90-byte element array)
    //   sub_object   = [ctx+0x20]           (holds the element count)
    //   count        = [sub_object+0x51c]   (u32)
    //   target_index = [[M+0x7b0]+0x650]    (u32; the dial read this with `mov edx,...`)
    let array_base = read_ptr(ctx + 0x1a8).unwrap_or(0);
    let sub_object = read_ptr(ctx + 0x20).unwrap_or(0);
    let count = if sub_object != 0 {
        read_u32(sub_object + 0x51c)
    } else {
        None
    };
    let m7b0 = read_ptr(cm_m + 0x7b0).unwrap_or(0);
    let target_index = if m7b0 != 0 {
        read_u32(m7b0 + 0x650)
    } else {
        None
    };

    let fmt_u = |o: Option<u32>| {
        o.map(|v| v.to_string())
            .unwrap_or_else(|| "<unreadable>".to_string())
    };
    crate::write_log(&format!(
        "ELEM_WATCH: SNAPSHOT ctx={ctx:#x} array_base={array_base:#x} sub_object={sub_object:#x} \
         count={} [M+0x7b0]={m7b0:#x} target_index={}\n",
        fmt_u(count),
        fmt_u(target_index),
    ));

    // Step 8 — need array_base + count + target_index to locate the element.
    let (Some(count), Some(idx)) = (count, target_index) else {
        crate::write_log("ELEM_WATCH: count or target_index unreadable — cannot locate element; watchpoint not armed\n");
        return;
    };
    if array_base == 0 {
        crate::write_log(
            "ELEM_WATCH: array_base null — element array not allocated; watchpoint not armed\n",
        );
        return;
    }
    if idx >= count {
        crate::write_log(&format!(
            "ELEM_WATCH: target_index {idx} >= count {count} (OUT OF BOUNDS — array likely uninitialized garbage); watchpoint not armed\n"
        ));
        return;
    }

    let elem = array_base + (idx as usize) * 0x90;
    crate::write_log(&format!(
        "ELEM_WATCH: element[{idx}] @ {elem:#x} (array_base + {idx}*0x90)\n"
    ));

    // Step 9 — hex-dump the element head, then classify [element+0x40] (the flat-map's
    // `begin` pointer). This is the exact word the crashed dial dereferenced as garbage.
    if let Some(bytes) = read_bytes(elem, 0x80) {
        elem_hex_dump("element (snapshot)", elem, &bytes);
    }
    let begin = read_ptr(elem + 0x40);
    let end = read_ptr(elem + 0x48).unwrap_or(0);
    let interp = match begin {
        None => "unreadable",
        Some(0) => "container null-init (default-constructed empty vector — begin==end==0)",
        Some(v) if v < 0x10000 => {
            "container UNINITIALIZED (small non-pointer sentinel — this is the crash shape)"
        }
        Some(v) if read_bytes(v, 8).is_some() => {
            "container appears INITIALIZED (begin is a readable heap pointer)"
        }
        Some(_) => "container has a non-null but UNREADABLE begin (dangling / mid-construction?)",
    };
    crate::write_log(&format!(
        "ELEM_WATCH: [elem+0x40]={} [elem+0x48]={end:#x} => {interp}\n",
        begin
            .map(|v| format!("{v:#x}"))
            .unwrap_or_else(|| "<unreadable>".to_string()),
    ));

    // Step 10 — arm Phase 2: seed the baseline and spawn the poller. We watch regardless
    // of the classification: even a currently-initialized container is worth watching for
    // a re-init, and an uninitialized one is exactly the transition we're hunting.
    ELEM_WATCH_ELEM.store(elem, Ordering::Relaxed);
    ELEM_WATCH_BASELINE.store(begin.unwrap_or(0), Ordering::Relaxed);
    spawn_elem_watcher(base, elem);
}

/// Phase 2: background thread that polls [element+0x40] every 100ms and logs the moment
/// it changes. Mirrors the NetConn pump's structure (a plain `std::thread` loop). Runs
/// for the process lifetime; read-only.
fn spawn_elem_watcher(base: usize, elem: usize) {
    std::thread::spawn(move || unsafe {
        // NetConn status word lives at [[base+0x9fe5e50]+0x48] (same slot the pump reads).
        // We read the conn fourcc straight from memory for change-time context — no game
        // call from this background thread.
        let netconn_slot = base + 0x9fe5e50;
        let t0 = std::time::Instant::now();
        let mut changes = 0u32;
        crate::write_log(&format!(
            "ELEM_WATCH: Phase 2 watchpoint armed on [elem+0x40] @ {:#x} (100ms poll)\n",
            elem + 0x40
        ));
        loop {
            std::thread::sleep(std::time::Duration::from_millis(100));
            // Guarded read; if the element's page ever goes away, skip this tick.
            let Some(now) = read_ptr(elem + 0x40) else {
                continue;
            };
            let baseline = ELEM_WATCH_BASELINE.load(Ordering::Relaxed);
            if now == baseline {
                continue;
            }
            ELEM_WATCH_BASELINE.store(now, Ordering::Relaxed);
            changes += 1;
            if changes <= 5 {
                let end = read_ptr(elem + 0x48).unwrap_or(0);
                let conn = read_ptr(netconn_slot)
                    .filter(|&x| x != 0)
                    .and_then(|nc| read_ptr(nc + 0x48))
                    .map(|w| w as u32)
                    .unwrap_or(0);
                crate::write_log(&format!(
                    "ELEM_WATCH: [elem+0x40] CHANGED! was={baseline:#x} now={now:#x} [elem+0x48]={end:#x} \
                     conn=0x{conn:08x} ({}) uptime={}s\n",
                    fourcc4(conn),
                    t0.elapsed().as_secs(),
                ));
                if let Some(bytes) = read_bytes(elem, 0x80) {
                    elem_hex_dump("element (after change)", elem, &bytes);
                }
            } else if changes == 6 {
                crate::write_log(
                    "ELEM_WATCH: (further changes suppressed; still tracking baseline)\n",
                );
            }
            // Beyond 6, keep updating the baseline silently so distinct future changes
            // are still detected — we just stop spamming the log.
        }
    });
}

/// FORCING EXPERIMENT: directly invoke `nucleusConnectREST` (FIFA23.exe+0x2861910)
/// from a background thread once FIFA is at "connecting". That function is nearly
/// self-contained — it fetches X=[0x14acd02c0], M=[X+0x360], ctx=[M+0x778] from the
/// global singleton and, if ctx is non-null, sends a GetAuthCode LSX request. The
/// dormant subsystem never calls it; we call it ourselves to test whether triggering
/// the connect makes FIFA fire GetAuthCode (which the bridge answers) and advance.
/// Guarded: we only call once the ctx chain is valid, to avoid a null-deref crash.
pub fn install_force_connect() {
    std::thread::spawn(|| unsafe {
        let base = GetModuleHandleA(core::ptr::null());
        if base.is_null() {
            return;
        }
        let base = base as usize;
        let x_slot = base + 0xacd02c0;
        let rest: extern "system" fn() -> usize = core::mem::transmute(base + 0x2861910);
        // Wait for the ctx chain to be valid (FIFA past bootstrap / online), up to ~5 min.
        let mut fired = 0;
        for i in 0..600u32 {
            std::thread::sleep(std::time::Duration::from_millis(500));
            let ctx = read_ptr(x_slot)
                .filter(|&x| x != 0)
                .and_then(|x| read_ptr(x + 0x360))
                .filter(|&m| m != 0)
                .and_then(|m| read_ptr(m + 0x778))
                .filter(|&c| c != 0);
            let Some(ctx) = ctx else {
                continue;
            };
            // Give the game ~15s settled (ctx valid) before poking, then re-fire a few
            // times spaced out (the FUT-tick pump needs a moment to reach state 2).
            if i < 30 {
                continue;
            }
            crate::write_log(&format!(
                "FORCE: calling nucleusConnectREST() (ctx={ctx:#x}) attempt {fired}\n"
            ));
            let r = rest();
            crate::write_log(&format!("FORCE: nucleusConnectREST returned {r:#x}\n"));
            fired += 1;
            if fired >= 6 {
                break;
            }
            std::thread::sleep(std::time::Duration::from_millis(5000));
        }
        crate::write_log("FORCE: done\n");
    });
}

/// First thread ID the NetConn pump ever fires on; 0 until the pump fires at least
/// once. Sub-phase B reads this (via `netconn_thread_id`) to know which thread the
/// pump runs on.
///
/// Why `AtomicU32` (not `Mutex<u32>` or `static mut u32`): this is a write-once,
/// read-many value. An atomic gives lock-free, data-race-free access with NO `unsafe`;
/// a `Mutex` is overkill for one integer, and a `static mut` would require `unsafe` and
/// risks undefined behaviour under concurrent access. (For a strictly write-once value
/// `std::sync::OnceLock<u32>` is the most idiomatic modern form — noted for future
/// reference; a plain atomic is simpler and sufficient here.)
static NETCONN_TID: AtomicU32 = AtomicU32::new(0);

/// The thread ID the NetConn pump fires on, or 0 if it hasn't fired yet. `Relaxed` is
/// sufficient: we only need the value itself to be visible to the reader, not ordered
/// against any other memory (there's no "publish data then set flag" handoff here).
pub fn netconn_thread_id() -> u32 {
    NETCONN_TID.load(Ordering::Relaxed)
}

/// Pump DirtySDK's NetConnIdle ourselves to break the offline "go-online" bootstrap.
///
/// RE finding (openfut-bridge/docs/connection-gate-findings.md, 2026-07-02): the app's
/// go-online handler (main_exe+0x4f4d360) dials the redirector only when
/// NetConnStatus('conn')=='+onl'. That status is the conn-module cached field
/// [NetConn+0x48], promoted '~con'->'+onl' by the conn tick (main_exe+0xf05430). With
/// live field values the tick WOULD promote (all preconditions met) and fire the
/// state-change notification the handler reacts to — but the tick, though registered in
/// the NetConnIdle callback table, is never run: its pump (NetConnIdle core,
/// main_exe+0xf16a50) is driven ONLY by online connect/wait loops, which never run
/// offline at the menu. Bootstrap circularity. Calling the pump ourselves runs the
/// game's own promotion logic (it self-guards on 'open'=[NetConn+0xcd], already =1), so
/// it is coherent, not a faked state.
///
/// NOTE: like `install_force_connect`, this runs on a spawned thread and DirtySDK state
/// is not formally thread-safe — this is a forcing EXPERIMENT. If it destabilises FIFA,
/// move the `pump()` call onto a game-thread detour instead of a background thread.
/// Off by default (see install_probes_deferred); enable manually to test.
pub fn install_force_netconn_pump() {
    std::thread::spawn(|| unsafe {
        // Kill switch: only run when OPENFUT_NETCONN_PUMP=1. Read once at thread start
        // (an env var is fixed for the process lifetime). Unset or "0" => short-circuit:
        // log and return, so the pump is wired in but completely inert — a safe default
        // that can be flipped without a rebuild.
        let enabled = std::env::var("OPENFUT_NETCONN_PUMP")
            .map(|v| v == "1")
            .unwrap_or(false);
        if !enabled {
            crate::write_log("NETCONN_PUMP: disabled (set OPENFUT_NETCONN_PUMP=1 to enable)\n");
            return;
        }
        let base = GetModuleHandleA(core::ptr::null());
        if base.is_null() {
            return;
        }
        let base = base as usize;
        let netconn_slot = base + 0x9fe5e50; // VA 0x149fe5e50 -> NetConn global (X)
                                             // NetConnIdle core pump; takes no args (reads globals, sets its own rcx). Win64.
        let pump: extern "system" fn() = core::mem::transmute(base + 0xf16a50);

        // Render a 4-char status code the way DirtySDK stores it (e.g. 0x2b6f6e6c="+onl").
        let fourcc = |v: u32| -> String {
            [(v >> 24) as u8, (v >> 16) as u8, (v >> 8) as u8, v as u8]
                .iter()
                .map(|&b| {
                    if (0x20..0x7f).contains(&b) {
                        b as char
                    } else {
                        '.'
                    }
                })
                .collect()
        };

        // Pump CONTINUOUSLY, ~every 100ms, for up to ~30 min. Do NOT stop at +onl:
        // promoting the status is not enough — the actual redirector/Blaze connection
        // (ProtoSSLConnect -> getaddrinfo -> dial) only progresses while the idle loop
        // keeps ticking, exactly like the game's own connect-wait loops (0x14508a500,
        // which pump 0x140f16a50 repeatedly). Log only on status CHANGE, plus a
        // heartbeat, so the log doesn't flood.
        let mut pumped = 0u32;
        let mut last_status = 0u32;
        // Count of thread-id samples logged so far. Plain local (not atomic): only THIS
        // pump thread ever touches it, so there's no cross-thread race to guard against.
        let mut samples = 0u32;
        for _ in 0..18000u32 {
            std::thread::sleep(std::time::Duration::from_millis(100));
            let Some(nc) = read_ptr(netconn_slot).filter(|&x| x != 0) else {
                continue;
            };
            // Read the conn status dword at [nc+0x48] (8-aligned; read_ptr is guarded).
            let status = read_ptr(nc + 0x48).map(|w| w as u32).unwrap_or(0);
            // Drive the idle loop. Self-guards on 'open'; a no-op if not yet open.
            pump();
            pumped += 1;
            // Thread-id capture: log the first 5 fires, then stop (5 samples is enough to
            // see whether it's stable or varying). NOTE: this is OUR spawned pump thread,
            // NOT necessarily the game's online-servicing thread — it will therefore be a
            // single stable value. See the report / fn docs before using it as sub-phase
            // B's "known-good" comparison.
            if samples < 5 {
                // GetCurrentThreadId is a Win32 FFI call (no args; returns the OS thread
                // id as a DWORD/u32). Any foreign call is `unsafe` because Rust can't
                // verify the callee's contract — we're already inside the closure's
                // `unsafe` block. This one is trivially safe: it only reads the current
                // thread's id and has no preconditions or side effects.
                let tid = GetCurrentThreadId();
                // First-write-wins: record the first id we ever see. compare_exchange
                // flips 0 -> tid exactly once and no-ops thereafter. Only this thread
                // writes it, so a plain store would also work; the CAS documents the
                // "first wins" intent and stays correct even if several threads pumped.
                // `Relaxed` on both success/failure: value-only, no ordering needed.
                let _ = NETCONN_TID.compare_exchange(0, tid, Ordering::Relaxed, Ordering::Relaxed);
                samples += 1;
                crate::write_log(&format!(
                    "NETCONN_PUMP: fired (sample {samples}/5), thread_id={tid}\n"
                ));
                if samples == 5 {
                    crate::write_log(&format!(
                        "NETCONN_PUMP: thread ID captured = {} (further pump fires will not log)\n",
                        NETCONN_TID.load(Ordering::Relaxed)
                    ));
                }
            }
            if status != last_status || pumped % 100 == 0 {
                crate::write_log(&format!(
                    "PUMP #{pumped}: NetConn={nc:#x} conn[+0x48]={status:#x} ({})\n",
                    fourcc(status)
                ));
                last_status = status;
            }
        }
        crate::write_log("PUMP: done (30 min elapsed)\n");
    });
}

/// Pump the FUT online manager's update tick to break the "go-online" bootstrap.
///
/// RE finding (2026-07-03, docs/connection-gate-findings.md): the FUT online→auth chain
/// (GetAuthCode→Nucleus→Blaze) is gated on the FifaOnline manager advancing its state
/// machine. mgr = *[FIFA23.exe+0xa199608]; state @mgr+0x1bb8 (0=idle, 1=connecting,
/// 2=online — the `==2` check is inlined everywhere). The 0→1 transition is driven by
/// the manager's update tick (main_exe+0x1b3f290) consuming a "go-online request" latch
/// byte @mgr+0x1bbc, which the event-0 handler (main_exe+0x1b0bbb0) normally sets. At the
/// "connecting to EA servers" screen the tick is DORMANT: setting the latch by hand, it
/// is never consumed (state stays 0) — the same primed-but-unpumped pattern as
/// NetConnIdle. Only the FUT auth requester (main_exe+0x1b02790), reached once state
/// advances, issues GetAuthCode.
///
/// We post the latch and call the tick ourselves. The tick self-gates
/// (main_exe+0x7e5c80: singleton [0x14acd02c0]!=0 && byte [0x14acd02ef]==0, both already
/// satisfied) and takes a lock at mgr+0x5a98 — but since the game isn't calling it, our
/// thread is the sole caller, so no contention. Advancing to state 1 kicks the connect
/// job, which should fire GetAuthCode (the bridge answers it). Signature is a Win64
/// method rcx=this(mgr); we pass rdx=0 (update dt/flag default). Forcing EXPERIMENT.
pub fn install_force_fut_tick() {
    std::thread::spawn(|| unsafe {
        let base = GetModuleHandleA(core::ptr::null());
        if base.is_null() {
            return;
        }
        let base = base as usize;
        let mgr_slot = base + 0xa199608; // VA 0x14a199608 -> FUT online manager ptr
        let tick: extern "system" fn(usize, usize) -> usize =
            core::mem::transmute(base + 0x1b3f290);
        let mut ticked = 0u32;
        let mut last = (u32::MAX, 0u8);
        // ~15 min at 250ms. The tick is heavy (locks + sub-updates); don't spin at 100ms.
        for _ in 0..3600u32 {
            std::thread::sleep(std::time::Duration::from_millis(250));
            let Some(mgr) = read_ptr(mgr_slot).filter(|&m| m != 0) else {
                continue;
            };
            // state @+0x1bb8 (low32) + latch byte @+0x1bbc share one 8-aligned qword.
            let Some(w) = read_ptr(mgr + 0x1bb8) else {
                continue;
            };
            let state = w as u32;
            let latch = ((w >> 32) & 0xff) as u8;
            // Post the go-online request ONLY at state 0 (mimics event-0 delivery) to
            // advance 0->1. Do NOT re-post at state 1: with latch!=0 the tick takes its
            // teardown path (call main_exe+0x1a85ef0 resets the connection) and cycles
            // state 1->0->1 every tick, so the connect never completes -> "EA servers
            // down". At state 1 we call the tick with latch==0 so it drives the
            // connecting state (the 0x1b3f549 path) toward state 2.
            if state == 0 {
                core::ptr::write_volatile((mgr + 0x1bbc) as *mut u8, 1);
            }
            let _ = tick(mgr, 0);
            ticked += 1;
            let now = (state, latch);
            if now != last || ticked % 40 == 0 {
                crate::write_log(&format!(
                    "FUTTICK #{ticked}: mgr={mgr:#x} state[+0x1bb8]={state} latch[+0x1bbc]={latch}\n"
                ));
                last = now;
            }
        }
        crate::write_log("FUTTICK: done\n");
    });
}

// ─── menu-time ctx dump (READ-ONLY) ─────────────────────────────────────────────
//
// Goal (2026-07-03): confirm whether the Nucleus/connect `ctx` reachable from the
// redirector connMgr is *populated* at the main menu (offline), or an empty shell
// that would fault on a dispatch even with the correct `this`. This is pure
// observation — it never writes game memory and never calls a game function, so
// unlike the forcing pumps it can run from a background thread with no risk.
//
// Resolution algorithm (confirmed live on 2026-07-03):
//   G   = *[base + 0xacd02c0]          (an OriginSDK global singleton)
//   M   = *[G + 0x360]                 (the ctx holder / online manager)
//   ctx = *[M + 0x778]                 (the connect/session context)
//   connMgr P: a heap object with [P+0] == base+0x80200b8 (its vtable, a static
//              .rdata address) AND [P+8] == M. Confirmed via vtable[0] landing in
//              .text and an embedded dispatcher pointer at [P+0xc38].
//
// All offsets here are the CONFIRMED values from the connMgr-resolution run; if a
// future disassembly contradicts one, stop and re-verify rather than adjust blindly.

/// Latches true the moment the dump actually runs, so it fires at most once per
/// process. (There is only ever one probe thread, so this is belt-and-suspenders.)
static CTX_DUMP_DONE: AtomicBool = AtomicBool::new(false);

/// Is `addr` inside one of FIFA23.exe's two `.text` (code) sections? Used as the
/// false-positive filter on a candidate's first virtual method (vtable[0]): a real
/// object's vtable points at real code. Ranges are RVAs from the section map
/// (docs): first .text [0x1000, 0x72a7800), second .text [0xbe37000, 0xc1cd000).
fn in_text(base: usize, addr: usize) -> bool {
    let rva = addr.wrapping_sub(base);
    (0x1000..0x72a7800).contains(&rva) || (0xbe37000..0xc1cd000).contains(&rva)
}

/// Read up to `len` bytes starting at `addr` into a Vec, but never past the end of
/// the single VirtualQuery region `addr` lives in (so we can't wander off committed
/// memory). Returns None if `addr` isn't in a committed, readable page. The returned
/// Vec may be SHORTER than `len` if the region ends first — the caller notes that.
unsafe fn read_bytes(addr: usize, len: usize) -> Option<Vec<u8>> {
    if addr < 0x10000 {
        return None;
    }
    let mut mbi: MEMORY_BASIC_INFORMATION = core::mem::zeroed();
    let n = VirtualQuery(
        addr as _,
        &mut mbi,
        core::mem::size_of::<MEMORY_BASIC_INFORMATION>(),
    );
    if n == 0 || mbi.State != MEM_COMMIT {
        return None;
    }
    if mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD) != 0 {
        return None;
    }
    // VirtualQuery guarantees the whole [BaseAddress, BaseAddress+RegionSize) range
    // shares one protection, so clamping to the region end keeps every copied byte
    // inside committed+readable memory.
    let region_end = mbi.BaseAddress as usize + mbi.RegionSize;
    let take = len.min(region_end.saturating_sub(addr));
    let mut buf = vec![0u8; take];
    // SAFE: src is committed+readable for `take` bytes (clamped above); dst is our
    // freshly-allocated Vec of exactly `take` bytes; the ranges don't overlap.
    core::ptr::copy_nonoverlapping(addr as *const u8, buf.as_mut_ptr(), take);
    Some(buf)
}

/// Format `data` as a classic hex dump (16 bytes/line: relative offset, hex, ASCII)
/// and append it to the log under one header line. `start_va` is only used to print
/// the object's base address in the header; offsets are relative (`+0x000`, …).
fn hex_dump(label: &str, start_va: usize, data: &[u8]) {
    let mut out = format!("CTXDUMP {label} @{start_va:#x} ({} bytes):\n", data.len());
    for (row, chunk) in data.chunks(16).enumerate() {
        let mut hex = String::new();
        let mut ascii = String::new();
        for (i, &b) in chunk.iter().enumerate() {
            hex.push_str(&format!("{b:02x} "));
            if i == 7 {
                hex.push(' '); // gap between the two 8-byte halves, easier to read
            }
            // Printable ASCII stays; everything else shows as '.' so pointer bytes
            // don't corrupt the log line.
            ascii.push(if (0x20..0x7f).contains(&b) {
                b as char
            } else {
                '.'
            });
        }
        out.push_str(&format!("  +{:#05x}  {:<50}|{ascii}|\n", row * 16, hex));
    }
    crate::write_log(&out);
}

/// Scan committed private (heap) memory for connMgr candidates: objects `P` with
/// `[P+0] == expected_vtable` AND `[P+8] == m`.
///
/// How the scan works (conceptually): the address space is a series of regions.
/// `VirtualQuery(addr)` describes the region containing `addr` — its base, size,
/// commit state, protection, and type (private heap vs mapped file vs image). We
/// walk region-by-region (jumping to base+size each step), and for every region that
/// is COMMITTED, PRIVATE (heap, not an EXE/DLL image or file mapping), and readable,
/// we sweep it at 8-byte stride looking for a word equal to `expected_vtable`. The
/// vtable is a single fixed value, so that first compare rejects almost every slot
/// instantly; only on a hit do we read `[P+8]` and compare to `m`. Restricting to
/// MEM_PRIVATE skips the executable/DLL images and mapped files entirely, which is
/// most of the address space and where connMgr can't live.
///
/// Returns every matching `P`. Read-only throughout. Also fills `stats` with
/// (regions_scanned, bytes_scanned) so we can report the cost.
unsafe fn scan_conn_mgr(m: usize, expected_vtable: usize, stats: &mut (u64, u64)) -> Vec<usize> {
    let mut hits = Vec::new();
    let mut addr: usize = 0x10000; // user space starts here; skip the null-guard page
    loop {
        let mut mbi: MEMORY_BASIC_INFORMATION = core::mem::zeroed();
        let n = VirtualQuery(
            addr as _,
            &mut mbi,
            core::mem::size_of::<MEMORY_BASIC_INFORMATION>(),
        );
        if n == 0 {
            break; // past the top of the user address space
        }
        let region_base = mbi.BaseAddress as usize;
        let region_size = mbi.RegionSize;
        let next = region_base.wrapping_add(region_size);
        if next <= addr {
            break; // no forward progress (overflow / degenerate) — stop safely
        }

        let readable = mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD) == 0;
        let is_heap = mbi.Type == MEM_PRIVATE;
        if mbi.State == MEM_COMMIT && is_heap && readable && region_size >= 0x10 {
            stats.0 += 1;
            stats.1 += region_size as u64;
            // The whole region is committed+readable (one uniform VirtualQuery region),
            // so plain reads at any 8-aligned offset are in-bounds. `*const usize` =
            // read a 64-bit pointer-sized word; that's the width of both a vtable
            // pointer and the M pointer we're matching.
            let words = region_size / 8;
            let p = region_base as *const usize;
            for i in 0..words {
                // Non-volatile read: we're scanning a snapshot; a torn read at worst
                // fails the compare. Plain `.read()` lets the optimizer keep this hot
                // loop tight (idiom: `read_volatile` would be needed only if the value
                // could change under us in a way we must observe — it can't here).
                let v0 = p.add(i).read();
                if v0 == expected_vtable {
                    let cand = region_base + i * 8;
                    // Ensure [cand+8] is still inside this region before reading it.
                    if cand + 16 <= next {
                        let v8 = (cand + 8) as *const usize;
                        if v8.read() == m {
                            hits.push(cand);
                        }
                    }
                }
            }
        }
        addr = next;
    }
    hits
}

/// Read-only menu-time probe: resolve connMgr from the known algorithm, then hex-dump
/// the ctx holder (M, 128 bytes) and the ctx object (512 bytes). Kill switch:
/// env `OPENFUT_CTX_DUMP` — armed only when it equals "1" (unset/"0" = disabled).
/// Read once at install time; if disarmed we don't even spawn the thread.
pub fn install_ctx_dump() {
    let armed = std::env::var("OPENFUT_CTX_DUMP")
        .map(|v| v == "1")
        .unwrap_or(false);
    if !armed {
        crate::write_log("CTXDUMP: disabled (set OPENFUT_CTX_DUMP=1 to arm)\n");
        return;
    }
    std::thread::spawn(|| unsafe {
        let base = GetModuleHandleA(core::ptr::null());
        if base.is_null() {
            crate::write_log("CTXDUMP: main exe not found\n");
            return;
        }
        let base = base as usize;
        let g_slot = base + 0xacd02c0; // VA 0x14acd02c0
        let expected_vtable = base + 0x80200b8; // connMgr vtable (static, in .rdata)
        crate::write_log(
            "CTXDUMP: armed; polling until connMgr is resolvable at the menu (read-only)\n",
        );

        // Poll (~3 min max) until the whole chain resolves. connMgr only appears once
        // the online subsystem is up (≈ main menu), so a successful resolve IS the
        // "we're at the menu" signal — more robust than a blind fixed delay.
        for attempt in 0..360u32 {
            std::thread::sleep(std::time::Duration::from_millis(500));

            // Step 1: G. Null-check every link; log which step failed, never deref null.
            let Some(g) = read_ptr(g_slot).filter(|&x| x != 0) else {
                if attempt % 20 == 0 {
                    crate::write_log("CTXDUMP: waiting (step 1: G null/unreadable)\n");
                }
                continue;
            };
            // Step 2: M (ctx holder).
            let Some(m) = read_ptr(g + 0x360).filter(|&x| x != 0) else {
                if attempt % 20 == 0 {
                    crate::write_log(&format!("CTXDUMP: waiting (step 2: M null; G={g:#x})\n"));
                }
                continue;
            };
            // Step 3: expected ctx via the global path (informational cross-check).
            let expected_ctx = read_ptr(m + 0x778).unwrap_or(0);
            // Step 4: heap-scan for connMgr.
            let mut stats = (0u64, 0u64);
            let t0 = std::time::Instant::now();
            let cands = scan_conn_mgr(m, expected_vtable, &mut stats);
            let scan_ms = t0.elapsed().as_millis();
            if cands.is_empty() {
                if attempt % 10 == 0 {
                    crate::write_log(&format!(
                        "CTXDUMP: waiting (step 4: 0 connMgr candidates; G={g:#x} M={m:#x} \
                         expected_ctx={expected_ctx:#x}; scanned {} regions / {} MB in {scan_ms}ms)\n",
                        stats.0,
                        stats.1 / (1024 * 1024),
                    ));
                }
                continue;
            }

            // Resolved. Latch so we dump exactly once.
            if CTX_DUMP_DONE.swap(true, Ordering::Relaxed) {
                return;
            }
            crate::write_log(&format!(
                "CTXDUMP: RESOLVED  G={g:#x}  M(=[G+0x360])={m:#x}  expected_ctx(=[M+0x778])={expected_ctx:#x}\n\
                 CTXDUMP: scan found {} candidate(s) in {} regions / {} MB in {scan_ms}ms\n",
                cands.len(),
                stats.0,
                stats.1 / (1024 * 1024),
            ));

            // Log each candidate; pick the first with vtable[0] in .text AND a
            // pointer-shaped dispatcher at [P+0xc38] (the last run's false positive had
            // ASCII bytes there). All candidates share the same vtable by construction,
            // so [P+0xc38] is the real disambiguator.
            let mut chosen = cands[0];
            for &p in &cands {
                let vt = read_ptr(p).unwrap_or(0);
                let vt0 = read_ptr(vt).unwrap_or(0);
                let disp = read_ptr(p + 0xc38).unwrap_or(0);
                let vt0_ok = in_text(base, vt0);
                let disp_ok = disp >= 0x10000;
                crate::write_log(&format!(
                    "CTXDUMP:   candidate P={p:#x}  [P+0]={vt:#x}  vtable[0]={vt0:#x} ({})  \
                     [P+8]={:#x}  [P+0xc38]={disp:#x} ({})\n",
                    if vt0_ok { "in .text" } else { "NOT .text" },
                    read_ptr(p + 8).unwrap_or(0),
                    if disp_ok { "ptr-shaped" } else { "junk/ASCII" },
                ));
                if vt0_ok && disp_ok && chosen == cands[0] {
                    chosen = p;
                }
            }
            let conn_mgr = chosen;
            crate::write_log(&format!(
                "CTXDUMP: connMgr = {conn_mgr:#x}  [P+0]={:#x} [P+8]={:#x} [P+0xc38]={:#x}\n",
                read_ptr(conn_mgr).unwrap_or(0),
                read_ptr(conn_mgr + 8).unwrap_or(0),
                read_ptr(conn_mgr + 0xc38).unwrap_or(0),
            ));

            // Dump 1: M — the ctx holder at [connMgr+8] (== M by construction). 128 bytes.
            let m_holder = read_ptr(conn_mgr + 8).unwrap_or(0);
            match read_bytes(m_holder, 128) {
                Some(b) if !b.is_empty() => {
                    if b.len() < 128 {
                        crate::write_log(&format!(
                            "CTXDUMP: (M dump truncated to {} bytes at region end)\n",
                            b.len()
                        ));
                    }
                    hex_dump("M (ctx holder)", m_holder, &b);
                }
                _ => crate::write_log(&format!("CTXDUMP: M @{m_holder:#x} unreadable\n")),
            }

            // Dump 2: ctx = [M+0x778]. If null, that's the diagnosis (holder exists,
            // ctx not yet allocated) — log and skip.
            let ctx = read_ptr(m_holder + 0x778).unwrap_or(0);
            if ctx == 0 {
                crate::write_log(&format!(
                    "CTXDUMP: ctx (=[M+0x778]) is NULL at menu (holder set up, ctx object not \
                     allocated) — skipping ctx dump\n"
                ));
            } else {
                match read_bytes(ctx, 512) {
                    Some(b) if !b.is_empty() => {
                        if b.len() < 512 {
                            crate::write_log(&format!(
                                "CTXDUMP: (ctx dump truncated to {} bytes at region end)\n",
                                b.len()
                            ));
                        }
                        hex_dump("ctx", ctx, &b);
                    }
                    _ => crate::write_log(&format!("CTXDUMP: ctx @{ctx:#x} unreadable\n")),
                }
            }

            crate::write_log("CTXDUMP: complete (one-shot; will not fire again)\n");
            return;
        }
        crate::write_log(
            "CTXDUMP: gave up after ~3 min — connMgr never resolved (still pre-menu?)\n",
        );
    });
}

struct Target {
    /// DLL name (nul-terminated) or ignored when `main_exe` is true.
    module: &'static [u8],
    /// Offset from the module base (RVA). For main_exe, VA − 0x140000000.
    rva: usize,
    label: &'static str,
    /// True → resolve against the main executable (FIFA23.exe) base.
    main_exe: bool,
}

/// Probe targets. Addresses recovered by RE (see docs/connection-gate-findings.md).
///
/// Dig-2 gate: FIFA's game-side Nucleus-connect layer requests the auth code, but both
/// paths null-check the Nucleus session context `[NucleusManager+0x778]` and bail when
/// it's null. These probes tell us *where FIFA is parked*:
/// - `nucleusConnectREST` (+0x2861910): the state that would send GetAuthCode. Returns 0
///   (no request) when `[mgr+0x778]` is null. If this NEVER fires, FIFA never reached it.
/// - `nucleusConnectTrusted` (+0x5078370): sibling connect path. Returns HRESULT
///   0x80060000 ("not ready") when the context is null — its return value is diagnostic.
/// - `connect-state.tick` (+0x507d660): the login state-machine handler that calls
///   nucleusConnectTrusted. If it ticks, FIFA entered the connect state; if not, it's
///   parked earlier.
/// - `OnlineStatus.deser` (+0x278a4d0): confirms our pushed OnlineStatusEvent still
///   arrives during the test (control signal).
const TARGETS: &[Target] = &[
    // Run 4: settle "connect state entered-but-stalled" vs "never entered". If the ctor
    // fires but nothing else, the connect states are created at init but never used; if
    // GetByIdx / any vtable step fires, the online subsystem is iterating them.
    Target {
        module: b"\0",
        rva: 0x5078d20,
        label: "connectState.ctor",
        main_exe: true,
    },
    Target {
        module: b"\0",
        rva: 0x4f46570,
        label: "ctrl.GetConnState",
        main_exe: true,
    },
    Target {
        module: b"\0",
        rva: 0x507cd60,
        label: "connState.m_a8",
        main_exe: true,
    },
    Target {
        module: b"\0",
        rva: 0x507cf90,
        label: "connState.m_b0",
        main_exe: true,
    },
    Target {
        module: b"\0",
        rva: 0x507d660,
        label: "connState.tick_b8",
        main_exe: true,
    },
    Target {
        module: b"\0",
        rva: 0x507d760,
        label: "connState.m_c0",
        main_exe: true,
    },
    Target {
        module: b"\0",
        rva: 0x2861910,
        label: "nucleusConnectREST",
        main_exe: true,
    },
    Target {
        module: b"\0",
        rva: 0x278a4d0,
        label: "OnlineStatus.deser",
        main_exe: true,
    },
];

const N: usize = 8; // must equal TARGETS.len()

static ADDRS: [AtomicUsize; N] = [const { AtomicUsize::new(0) }; N];
static mut ORIG: [[u8; 14]; N] = [[0u8; 14]; N];
/// Per-slot call counter, used to cap logging so a per-frame handler (e.g. a state
/// tick) can't flood the log. We still call through the real function every time.
static CALLS: [AtomicUsize; N] = [const { AtomicUsize::new(0) }; N];
const LOG_CAP: usize = 24;

type ProbeFn = unsafe extern "system" fn(usize, usize, usize, usize) -> usize;
const PROBE_FNS: [ProbeFn; N] = [p0, p1, p2, p3, p4, p5, p6, p7];

unsafe fn write_jmp(addr: *mut u8, dest: u64) {
    let mut old: u32 = 0;
    VirtualProtect(addr as _, 14, PAGE_EXECUTE_READWRITE, &mut old);
    // FF 25 00 00 00 00  JMP [rip+0]  ; then absolute dest
    addr.write(0xFF);
    addr.add(1).write(0x25);
    (addr.add(2) as *mut u32).write(0);
    (addr.add(6) as *mut u64).write(dest);
    VirtualProtect(addr as _, 14, old, &mut old);
}

unsafe fn restore(slot: usize) {
    let addr = ADDRS[slot].load(Ordering::Relaxed) as *mut u8;
    let mut old: u32 = 0;
    VirtualProtect(addr as _, 14, PAGE_EXECUTE_READWRITE, &mut old);
    core::ptr::copy_nonoverlapping((&raw const ORIG[slot]) as *const u8, addr, 14);
    VirtualProtect(addr as _, 14, old, &mut old);
}

unsafe fn generic(slot: usize, a: usize, b: usize, c: usize, d: usize) -> usize {
    let label = TARGETS[slot].label;
    let addr = ADDRS[slot].load(Ordering::Relaxed) as *mut u8;
    // Cap logging per slot so a per-frame handler can't flood the log; still call
    // through every time. Log the first LOG_CAP calls (entry + return), then just the
    // running count once at the cap so we know it kept firing.
    let n = CALLS[slot].fetch_add(1, Ordering::Relaxed);
    let log = n < LOG_CAP;
    // Unhook, (maybe) log entry, call the real function, re-hook, (maybe) log return.
    restore(slot);
    if log {
        crate::write_log(&format!(
            "PROBE {label} #{n} enter rcx={a:#x} rdx={b:#x} r8={c:#x} r9={d:#x}\n"
        ));
    }
    let f: ProbeFn = core::mem::transmute(addr);
    let r = f(a, b, c, d);
    write_jmp(addr, PROBE_FNS[slot] as u64);
    if log {
        crate::write_log(&format!("PROBE {label} #{n} ret={r:#x}\n"));
    } else if n == LOG_CAP {
        crate::write_log(&format!(
            "PROBE {label} (capped; still firing past {LOG_CAP})\n"
        ));
    }
    r
}

unsafe extern "system" fn p0(a: usize, b: usize, c: usize, d: usize) -> usize {
    generic(0, a, b, c, d)
}
unsafe extern "system" fn p1(a: usize, b: usize, c: usize, d: usize) -> usize {
    generic(1, a, b, c, d)
}
unsafe extern "system" fn p2(a: usize, b: usize, c: usize, d: usize) -> usize {
    generic(2, a, b, c, d)
}
unsafe extern "system" fn p3(a: usize, b: usize, c: usize, d: usize) -> usize {
    generic(3, a, b, c, d)
}
unsafe extern "system" fn p4(a: usize, b: usize, c: usize, d: usize) -> usize {
    generic(4, a, b, c, d)
}
unsafe extern "system" fn p5(a: usize, b: usize, c: usize, d: usize) -> usize {
    generic(5, a, b, c, d)
}
unsafe extern "system" fn p6(a: usize, b: usize, c: usize, d: usize) -> usize {
    generic(6, a, b, c, d)
}
unsafe extern "system" fn p7(a: usize, b: usize, c: usize, d: usize) -> usize {
    generic(7, a, b, c, d)
}

/// Spawn a background thread that waits for anadius64.dll to load, then installs
/// all probes. anadius may not be present when our DllMain runs, so we defer
/// off the loader lock and poll for it (up to ~30s) before installing.
pub fn install_probes_deferred() {
    std::thread::spawn(|| unsafe {
        for _ in 0..60 {
            if !GetModuleHandleA(b"anadius64.dll\0".as_ptr()).is_null() {
                break;
            }
            std::thread::sleep(std::time::Duration::from_millis(500));
        }
        install_probes();
        install_listener_probe();
        install_state_sampler();
        install_ctx_dump(); // ENABLED 2026-07-03: READ-ONLY menu-time ctx dump (env
                            // OPENFUT_CTX_DUMP=1). Resolves connMgr and hex-dumps M + ctx. No game calls.
                            // install_force_connect();  // DISABLED 2026-07-03: re-enabling it CRASHED FIFA at
                            // ~15s (EXCEPTION_ACCESS_VIOLATION, RIP 0x15d5e8dd7 in FIFA's packed/anti-tamper
                            // region, all registers garbage). Once state 2 makes the Nucleus ctx live,
                            // nucleusConnectREST's `ctx->vtable[0x40]` send path runs into protected code that
                            // does not tolerate being called from our background thread. GetAuthCode must be
                            // triggered on the GAME thread (via a detour), not a bg-thread forcing call.
        install_force_netconn_pump(); // RE-ENABLED 2026-07-03 (sub-phase B prereq): pump
                                      // NetConn toward '+onl' and capture the pump thread id. Gated by env
                                      // OPENFUT_NETCONN_PUMP=1 — completely inert unless set. This is the known-good
                                      // pump path (never crashed); the FUT-tick pump below stays OFF (it crashes the VM).
                                      // install_force_fut_tick();  // DISABLED 2026-07-03 for the ctx-dump build: it
                                      // WRITES the go-online latch and drives FifaOnline toward state 2, which
                                      // deterministically CRASHES the anti-tamper VM before the menu — so leaving it on
                                      // would prevent this menu-time probe from ever observing. Re-enable only if we
                                      // deliberately want the (crash-prone) state-2 path.
    });
}

/// Install all probe detours. Modules must already be loaded (call late in
/// DllMain, after anadius64.dll is present).
pub unsafe fn install_probes() {
    for (i, t) in TARGETS.iter().enumerate() {
        let base = if t.main_exe {
            GetModuleHandleA(core::ptr::null())
        } else {
            GetModuleHandleA(t.module.as_ptr())
        };
        if base.is_null() {
            crate::write_log(&format!("PROBE {}: module not loaded, skipped\n", t.label));
            continue;
        }
        let addr = (base as usize + t.rva) as *mut u8;
        core::ptr::copy_nonoverlapping(addr, (&raw mut ORIG[i]) as *mut u8, 14);
        ADDRS[i].store(addr as usize, Ordering::Relaxed);
        write_jmp(addr, PROBE_FNS[i] as u64);
        crate::write_log(&format!(
            "PROBE {} installed @ {:#x}\n",
            t.label, addr as usize
        ));
    }
}

#[cfg(test)]
mod netconn_tests {
    use super::*;

    #[test]
    fn thread_id_accessor_roundtrips() {
        // Fresh process: the pump hasn't fired, so the captured id starts at 0.
        assert_eq!(netconn_thread_id(), 0);
        // Simulate the first capture and confirm the accessor reads the same atomic.
        NETCONN_TID.store(4321, Ordering::Relaxed);
        assert_eq!(netconn_thread_id(), 4321);
    }
}