fix(seasons): derive the FUT web-file base from openfut.cfg, not a lab IP

`STAGING_FUT_BASE` hardcoded `http://10.10.0.120:8110/fut/` into the hook
binary, so the base-supply rewriter only worked on one machine and could not be
merged.

The prefix now comes from the same `openfut.cfg` / `openfut-common` source of
truth as every redirect target: `fut_content_base()` builds
`http://<host>:<fut_content_port>/fut/` from the configured host.
`OpenFutPorts` gains `fut_content` with a named default
(`default_ports::FUT_CONTENT = 8110`) and an optional `fut_content_port=` key,
matching how every other OpenFUT port is already handled. A cfg written before
the key existed still parses and takes the default — failing it would disarm the
network redirect too.

Arming fails SAFE: an absent or unusable config arms nothing and the rewriter
leaves every url exactly as the client built it, rather than pointing it at a
guessed host. This also adds the `openfut-common` dependency to the hook on this
branch; main already has it.

Proof: the cross-built artifact no longer contains the string 10.10.0.120
(previously compiled in), openfut-common is green at 16 tests including the new
config-derived-base and backward-compatibility cases, and the launcher builds.

Cargo.lock

@@ -2293,6 +2293,7 @@ dependencies = [
  "eframe",
  "egui",
  "openfut-common",
+ "parking_lot",
  "serde",
  "serde_json",
  "tokio",

openfut-common/src/lib.rs

@@ -53,6 +53,12 @@ pub mod default_ports {
     pub const BLAZE_REDIRECTOR: u16 = 42127;
     /// OpenFUT FIFA 17 Blaze main listener.
     pub const BLAZE_MAIN: u16 = 42130;
+    /// OpenFUT FUT web-file (CDN) content server. Unlike the others this is not
+    /// an EA redirect target: the client never dials it directly, because its
+    /// `RS4::ServerSettings` CDN base arrives EMPTY in the emulator. The hook
+    /// supplies the missing `<base>/fut/` prefix, and the base is built from the
+    /// configured server host plus this port.
+    pub const FUT_CONTENT: u16 = 8110;
 }
 
 /// OpenFUT destination ports. Each field is where an intercepted EA source port
@@ -66,6 +72,9 @@ pub struct OpenFutPorts {
     pub blaze_redirector: u16,
     /// Destination for EA :42127 traffic (Blaze main).
     pub blaze_main: u16,
+    /// FUT web-file content server. Not a redirect destination — see
+    /// [`default_ports::FUT_CONTENT`].
+    pub fut_content: u16,
 }
 
 impl Default for OpenFutPorts {
@@ -74,6 +83,7 @@ impl Default for OpenFutPorts {
             https: default_ports::HTTPS,
             blaze_redirector: default_ports::BLAZE_REDIRECTOR,
             blaze_main: default_ports::BLAZE_MAIN,
+            fut_content: default_ports::FUT_CONTENT,
         }
     }
 }
@@ -209,6 +219,7 @@ impl ServerConfig {
                 "https_port" => ports.https = parse_port(value)?,
                 "blaze_redirector_port" => ports.blaze_redirector = parse_port(value)?,
                 "blaze_main_port" => ports.blaze_main = parse_port(value)?,
+                "fut_content_port" => ports.fut_content = parse_port(value)?,
                 other => {
                     return Err(ConfigError::MalformedConfig(format!(
                         "line {}: unknown key '{other}'",
@@ -225,8 +236,27 @@ impl ServerConfig {
     /// Serialize to the structured `openfut.cfg` format.
     pub fn to_cfg_string(&self) -> String {
         format!(
-            "host={}\nhttps_port={}\nblaze_redirector_port={}\nblaze_main_port={}\n",
-            self.host, self.ports.https, self.ports.blaze_redirector, self.ports.blaze_main
+            "host={}\nhttps_port={}\nblaze_redirector_port={}\nblaze_main_port={}\nfut_content_port={}\n",
+            self.host,
+            self.ports.https,
+            self.ports.blaze_redirector,
+            self.ports.blaze_main,
+            self.ports.fut_content
+        )
+    }
+
+    /// Base URL the FUT web-file (CDN) prefix is built from, e.g.
+    /// `http://10.10.0.120:8110/fut/`.
+    ///
+    /// The client's `RS4::ServerSettings` CDN base arrives EMPTY in the emulator,
+    /// so FUT web-file urls reach the download entry point as bare relative paths
+    /// and fail. The hook supplies this prefix. Built from the SAME configured
+    /// host as every other redirect, so a lab address is never compiled in.
+    pub fn fut_content_base(&self) -> String {
+        format!(
+            "http://{}:{}/fut/",
+            self.host.trim(),
+            self.ports.fut_content
         )
     }
 
@@ -414,12 +444,36 @@ mod tests {
                 https: 8443,
                 blaze_redirector: 10041,
                 blaze_main: 42127,
+                fut_content: 8110,
             },
         };
         let s = c.to_cfg_string();
         assert_eq!(ServerConfig::parse(&s).unwrap(), c);
     }
 
+    /// The FUT web-file prefix follows the CONFIGURED server, so no lab address
+    /// is ever compiled into the hook.
+    #[test]
+    fn fut_content_base_follows_the_configured_host() {
+        let c = ServerConfig::parse("host=192.168.1.50\n").unwrap();
+        assert_eq!(c.fut_content_base(), "http://192.168.1.50:8110/fut/");
+
+        let c = ServerConfig::parse("host=fut.mylan.home\nfut_content_port=9110\n").unwrap();
+        assert_eq!(c.fut_content_base(), "http://fut.mylan.home:9110/fut/");
+    }
+
+    /// A cfg written before `fut_content_port` existed must still parse, taking
+    /// the default rather than failing the whole config (which would disarm the
+    /// network redirect too).
+    #[test]
+    fn cfg_without_content_port_takes_the_default() {
+        let c = ServerConfig::parse(
+            "host=10.0.0.5\nhttps_port=8443\nblaze_redirector_port=42127\nblaze_main_port=42130\n",
+        )
+        .unwrap();
+        assert_eq!(c.ports.fut_content, default_ports::FUT_CONTENT);
+    }
+
     #[test]
     fn configured_ipv4_becomes_correct_sockaddr() {
         // Resolve an IPv4 literal and confirm the sin_addr value.

openfut-hook/Cargo.lock

@@ -2,10 +2,15 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "openfut-common"
+version = "0.1.0"
+
 [[package]]
 name = "openfut-hook"
 version = "0.1.0"
 dependencies = [
+ "openfut-common",
  "windows-sys",
 ]
 

openfut-hook/Cargo.toml

@@ -39,6 +39,10 @@ windows-sys = { version = "0.59", features = [
     "Win32_System_Diagnostics_Debug",
     "Win32_System_Kernel",
 ] }
+# Single source of truth for the OpenFUT redirect config (openfut.cfg schema,
+# EA-port -> OpenFUT-port map, WinSock byte-order helpers). Shared with the
+# launcher so the hook and openfut.cfg agree by construction.
+openfut-common = { path = "../openfut-common" }
 
 [profile.release]
 opt-level = "s"

openfut-hook/src/fifa17.rs

@@ -87,6 +87,7 @@ unsafe extern "system" fn worker(_: *mut core::ffi::c_void) -> u32 {
     crate::sbc_dispatch::install();
     crate::sbc_request_trace::install();
     crate::store_entry::install();
+    crate::season_trace::install();
     0
 }
 

openfut-hook/src/lib.rs

@@ -28,6 +28,8 @@ mod sbc_hook;
 mod sbc_request_trace;
 #[cfg(feature = "fifa17")]
 mod sbc_trace;
+#[cfg(feature = "fifa17")]
+mod season_trace;
 mod ssl_patch;
 #[cfg(feature = "fifa17")]
 mod store_entry;

openfut-hook/src/sbc_dispatch.rs

@@ -443,6 +443,10 @@ unsafe extern "system" fn event_wrapper(
         }
         _ => {}
     }
+    // Piggyback the store pre-warm on this game-thread hub event: it loads the
+    // purchase groups once, before the store screen is shown, so the store's native
+    // screen-show tab bind sees a populated group list (see `store_entry`).
+    crate::store_entry::maybe_prewarm_groups();
     let original: EventDispatchFn = core::mem::transmute(EVENT_TRAMPOLINE.load(Ordering::Acquire));
     let result = original(controller, event, payload);
     EVENT_EXITS.fetch_add(1, Ordering::Release);

openfut-hook/src/season_trace.rs

@@ -0,0 +1,793 @@
+//! Passive, behavior-preserving diagnostic traces for FIFA 17's offline-season
+//! entry flow.
+//!
+//! RE (2026-08-19, live memory) placed the "problem communicating with the FIFA
+//! Ultimate Team servers" modal in the `futOfflineSeasonEntry` ActionScript's
+//! season-load path. A first trace on the load completion `FUN_1800578e0`
+//! (`0x578e0`) armed but NEVER fired on an entry attempt — so the modal is raised
+//! before that callback runs. These traces log the actual CardsDLL season-native
+//! call sequence (which functions the entry screen reaches, and in what order) so
+//! we can see exactly where the flow stops/fails. Every trace is read-only: it
+//! logs, then calls the original through a trampoline; it never alters control
+//! flow. Targets are chosen so their copied prologues are position-independent
+//! (no rip-relative / rel32 in the copied bytes).
+
+use core::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::OnceLock;
+
+use windows_sys::Win32::System::Diagnostics::Debug::FlushInstructionCache;
+use windows_sys::Win32::System::Diagnostics::Debug::{
+    AddVectoredExceptionHandler, EXCEPTION_POINTERS,
+};
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
+use windows_sys::Win32::System::Memory::{
+    VirtualAlloc, VirtualProtect, MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READ,
+    PAGE_EXECUTE_READWRITE, PAGE_READWRITE,
+};
+use windows_sys::Win32::System::Threading::GetCurrentProcess;
+
+use crate::sbc_trace::{
+    absolute_jump, allocate_trampoline, readable_range, target_va, validate_cards_build,
+};
+use crate::write_log;
+
+static REPORTS: AtomicUsize = AtomicUsize::new(0);
+/// One-shot guard for the staging-only CACHE_PACKNAMES_FAILED -> SUCCESS bypass.
+static BYPASS_DONE: AtomicBool = AtomicBool::new(false);
+
+unsafe fn rd_i32(addr: usize) -> Option<i32> {
+    readable_range(addr, 4).then(|| core::ptr::read_volatile(addr as *const i32))
+}
+unsafe fn rd_u8(addr: usize) -> Option<u8> {
+    readable_range(addr, 1).then(|| core::ptr::read_volatile(addr as *const u8))
+}
+/// Read a NUL-terminated string safely (bounded, only reads mapped bytes).
+unsafe fn rd_cstr(addr: usize, max: usize) -> String {
+    if addr == 0 || !readable_range(addr, 1) {
+        return String::from("<unreadable>");
+    }
+    let mut out = Vec::new();
+    let mut i = 0;
+    while i < max && readable_range(addr + i, 1) {
+        let b = core::ptr::read_volatile((addr + i) as *const u8);
+        if b == 0 {
+            break;
+        }
+        out.push(b);
+        i += 1;
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+/// Generic passive detour: overwrite the first `copy_len` bytes of `target` (which
+/// MUST be whole, position-independent instructions) with an absolute jump to
+/// `wrapper`; the wrapper calls the trampoline (copied prologue + jump back).
+unsafe fn install_detour(
+    base: usize,
+    rva: usize,
+    name: &str,
+    copy_len: usize,
+    signature: &[u8],
+    wrapper: usize,
+    trampoline_slot: &AtomicUsize,
+) -> bool {
+    let Some(target) = target_va(base, rva) else {
+        write_log(&format!("SEASON_TRACE: {name}: VA overflow\n"));
+        return false;
+    };
+    if !readable_range(target, copy_len)
+        || core::slice::from_raw_parts(target as *const u8, copy_len) != signature
+    {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: prologue signature mismatch at {target:#x}; skip\n"
+        ));
+        return false;
+    }
+    let Some(trampoline) = allocate_trampoline(target, copy_len) else {
+        write_log(&format!("SEASON_TRACE: {name}: trampoline alloc failed\n"));
+        return false;
+    };
+    trampoline_slot.store(trampoline, Ordering::Release);
+    let mut patch = [0x90u8; 24];
+    let jump = absolute_jump(wrapper);
+    patch[..jump.len()].copy_from_slice(&jump);
+    let mut old = 0u32;
+    if VirtualProtect(target as _, copy_len, PAGE_EXECUTE_READWRITE, &mut old) == 0 {
+        write_log(&format!("SEASON_TRACE: {name}: VirtualProtect failed\n"));
+        return false;
+    }
+    core::ptr::copy_nonoverlapping(patch.as_ptr(), target as *mut u8, copy_len);
+    let flushed = FlushInstructionCache(GetCurrentProcess(), target as _, copy_len) != 0;
+    let mut ignored = 0u32;
+    VirtualProtect(target as _, copy_len, old, &mut ignored);
+    if flushed {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: installed at {target:#x} (tramp {trampoline:#x})\n"
+        ));
+        true
+    } else {
+        write_log(&format!("SEASON_TRACE: {name}: flush failed\n"));
+        false
+    }
+}
+
+fn log_call(name: &str, rcx: usize, rdx: usize, r8: usize) {
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        write_log(&format!(
+            "SEASON_CALL: {name} rcx={rcx:#x} rdx={rdx:#x} r8={r8:#x}\n"
+        ));
+    }
+}
+
+/// Declare a passive 4-register-arg call trace. The wrapper is entered via the
+/// abs-jump patched over the target prologue (original args in rcx/rdx/r8/r9,
+/// caller's return address on the stack), logs, then tail-calls the original via
+/// the trampoline. A 4-arg/usize-return signature safely covers these season
+/// natives (<=4 integer args, void/int returns).
+macro_rules! season_call_trace {
+    ($wrap:ident, $tramp:ident, $name:literal) => {
+        static $tramp: AtomicUsize = AtomicUsize::new(0);
+        unsafe extern "system" fn $wrap(rcx: usize, rdx: usize, r8: usize, r9: usize) -> usize {
+            log_call($name, rcx, rdx, r8);
+            let t = $tramp.load(Ordering::Acquire);
+            if t == 0 {
+                return 0;
+            }
+            let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+                core::mem::transmute(t);
+            original(rcx, rdx, r8, r9)
+        }
+    };
+}
+
+season_call_trace!(
+    load_current_native_wrapper,
+    LOAD_CURRENT_NATIVE_TRAMP,
+    "LoadCurrentOfflineSeason_native"
+);
+season_call_trace!(
+    start_season_native_wrapper,
+    START_SEASON_NATIVE_TRAMP,
+    "StartSeason_native"
+);
+season_call_trace!(
+    get_info_native_wrapper,
+    GET_INFO_NATIVE_TRAMP,
+    "GetOfflineSeasonInfo_native"
+);
+// Real LoadOfflineSeasons native (FUN_18004ee10) — what _LoadCurrentSeason
+// actually calls; hands the callback name to the manager's async slot 0x80.
+season_call_trace!(
+    load_offline_real_wrapper,
+    LOAD_OFFLINE_REAL_TRAMP,
+    "LoadOfflineSeasons_native(0x4ee10)"
+);
+// Async LoadOfflineSeasons impl (mgr slot 0x80, FUN_180057560): reads the season
+// count and invokes the LoadSeasons_Complete AS callback.
+season_call_trace!(
+    load_offline_async_wrapper,
+    LOAD_OFFLINE_ASYNC_TRAMP,
+    "LoadOfflineSeasons_asyncimpl(0x57560)"
+);
+
+// LoadCurrentOfflineSeason IMPL (manager slot 0x20): registers the load callbacks
+// and starts the async op. param_1=manager, param_2=state byte, param_3=seasonId
+// string ptr. Logs those, then calls the original.
+static LOAD_CURRENT_IMPL_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn load_current_impl_wrapper(
+    param_1: usize,
+    param_2: usize,
+    param_3: usize,
+    param_4: usize,
+) -> usize {
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        // param_3 -> C string season id (best-effort read of first bytes).
+        let sid = if param_3 != 0 && readable_range(param_3, 8) {
+            let p = *(param_3 as *const usize);
+            if p != 0 && readable_range(p, 8) {
+                *(p as *const u64)
+            } else {
+                0
+            }
+        } else {
+            0
+        };
+        write_log(&format!(
+            "SEASON_CALL: LoadCurrentOfflineSeason_impl mgr={param_1:#x} stateByte={param_2:#x} sidPtr={param_3:#x} sidHead={sid:#x}\n"
+        ));
+    }
+    let t = LOAD_CURRENT_IMPL_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(param_1, param_2, param_3, param_4)
+}
+
+// Completion callback FUN_1800578e0 (0x578e0). Kept from the first pass to confirm
+// whether it ever fires; logs the result fields it branches on.
+static COMPLETION_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn completion_wrapper(
+    ctx: usize,
+    result: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        let status = rd_i32(result + 0x1c);
+        let state = rd_u8(result + 0x68);
+        let season_id = rd_i32(result + 0x5c);
+        write_log(&format!(
+            "SEASON_LOAD_COMPLETE: ctx={ctx:#x} result={result:#x} status(+0x1c)={} state(+0x68)={} seasonId(+0x5c)={}\n",
+            status.map(|x| x.to_string()).unwrap_or_else(|| "??".into()),
+            state.map(|x| x.to_string()).unwrap_or_else(|| "??".into()),
+            season_id.map(|x| x.to_string()).unwrap_or_else(|| "??".into()),
+        ));
+    }
+    let t = COMPLETION_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(ctx, result, r8, r9)
+}
+
+// GetUsersOfflineDivision native FUN_18004eb50 (registration FUN_18004e3f0 proved
+// this binding — it is NOT LoadOfflineSeasons). Called from _InitializeScreen for
+// the division display, sync. Its prologue holds a rip-relative `MOV RCX,[rip+disp]`,
+// so it needs the relocating installer below.
+season_call_trace!(
+    get_users_division_wrapper,
+    GET_USERS_DIVISION_TRAMP,
+    "GetUsersOfflineDivision_native(0x4eb50)"
+);
+
+/// Find a free page within ~±1.5 GiB of `base`, so a rip-relative disp32 into
+/// CardsDLL data still fits after we relocate a copied prologue into it.
+unsafe fn alloc_near(base: usize, size: usize) -> Option<usize> {
+    const GRAN: usize = 0x10000;
+    let mut step = GRAN;
+    while step < 0x6000_0000 {
+        for signed in [step as isize, -(step as isize)] {
+            let cand = base.wrapping_add(signed as usize) & !(GRAN - 1);
+            if cand == 0 {
+                continue;
+            }
+            let p = VirtualAlloc(cand as _, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+            if !p.is_null() {
+                return Some(p as usize);
+            }
+        }
+        step += GRAN;
+    }
+    None
+}
+
+/// Passive detour for a target whose copied prologue contains a single
+/// rip-relative operand (disp32 at `disp_off`, instruction ending at `insn_end`,
+/// both within the copied bytes). The trampoline is allocated near `base` and the
+/// disp32 is relocated so it resolves to the same absolute address. Read-only.
+#[allow(clippy::too_many_arguments)]
+unsafe fn install_detour_reloc(
+    base: usize,
+    rva: usize,
+    name: &str,
+    copy_len: usize,
+    signature: &[u8],
+    disp_off: usize,
+    insn_end: usize,
+    wrapper: usize,
+    trampoline_slot: &AtomicUsize,
+) -> bool {
+    let Some(target) = target_va(base, rva) else {
+        write_log(&format!("SEASON_TRACE: {name}: VA overflow\n"));
+        return false;
+    };
+    if !readable_range(target, copy_len)
+        || core::slice::from_raw_parts(target as *const u8, copy_len) != signature
+    {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: prologue signature mismatch at {target:#x}; skip\n"
+        ));
+        return false;
+    }
+    let jump = absolute_jump(wrapper);
+    let tramp_len = copy_len + jump.len();
+    let Some(tramp) = alloc_near(base, tramp_len) else {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: near trampoline alloc failed\n"
+        ));
+        return false;
+    };
+    core::ptr::copy_nonoverlapping(target as *const u8, tramp as *mut u8, copy_len);
+    // Relocate the rip-relative disp32 to keep the same absolute target.
+    let orig_disp = core::ptr::read_unaligned((target + disp_off) as *const i32) as i64;
+    let abs_target = target as i64 + insn_end as i64 + orig_disp;
+    let new_disp = abs_target - (tramp as i64 + insn_end as i64);
+    if new_disp < i32::MIN as i64 || new_disp > i32::MAX as i64 {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: reloc out of range ({new_disp:#x})\n"
+        ));
+        return false;
+    }
+    core::ptr::write_unaligned((tramp + disp_off) as *mut i32, new_disp as i32);
+    let back = absolute_jump(target + copy_len);
+    core::ptr::copy_nonoverlapping(back.as_ptr(), (tramp + copy_len) as *mut u8, back.len());
+    let mut old = 0u32;
+    if VirtualProtect(tramp as _, tramp_len, PAGE_EXECUTE_READ, &mut old) == 0 {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: trampoline protect failed\n"
+        ));
+        return false;
+    }
+    FlushInstructionCache(GetCurrentProcess(), tramp as _, tramp_len);
+    trampoline_slot.store(tramp, Ordering::Release);
+    let mut patch = [0x90u8; 24];
+    patch[..jump.len()].copy_from_slice(&jump);
+    let mut prot = 0u32;
+    if VirtualProtect(target as _, copy_len, PAGE_EXECUTE_READWRITE, &mut prot) == 0 {
+        write_log(&format!("SEASON_TRACE: {name}: VirtualProtect failed\n"));
+        return false;
+    }
+    core::ptr::copy_nonoverlapping(patch.as_ptr(), target as *mut u8, copy_len);
+    let flushed = FlushInstructionCache(GetCurrentProcess(), target as _, copy_len) != 0;
+    let mut ignored = 0u32;
+    VirtualProtect(target as _, copy_len, prot, &mut ignored);
+    if flushed {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: installed(reloc) at {target:#x} (tramp {tramp:#x})\n"
+        ));
+        true
+    } else {
+        write_log(&format!("SEASON_TRACE: {name}: flush failed\n"));
+        false
+    }
+}
+
+// FutCompetitionServiceImpl::LoadOfflineSeasons FINAL completion (FUN_1800ffe90):
+// delivers the result to the AS callback LoadSeasons_Complete via
+// FUN_18019fb30->slot0x20(vm,"_global",cbref, "SUCCESS" | errString). param_1 = the
+// completion ctx (cbref at +0x18), param_2 = result obj (byte0=ok flag; +8 = error
+// string ptr when byte0==0). Logs the EXACT status string delivered. Passive.
+static FINAL_COMPLETION_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn final_completion_wrapper(
+    ctx: usize,
+    result: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    // Read the delivered status: byte0==0 => failure with an error string at +8.
+    let flag = rd_u8(result);
+    let errstr = if flag == Some(0) {
+        let p = if readable_range(result + 8, 8) {
+            core::ptr::read_volatile((result + 8) as *const usize)
+        } else {
+            0
+        };
+        rd_cstr(p, 96)
+    } else {
+        String::new()
+    };
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        let cbref = if readable_range(ctx + 0x18, 8) {
+            core::ptr::read_volatile((ctx + 0x18) as *const usize)
+        } else {
+            0
+        };
+        let kind = match flag {
+            Some(0) => "ERROR",
+            Some(_) => "SUCCESS",
+            None => "??",
+        };
+        let shown = if flag == Some(0) {
+            errstr.as_str()
+        } else {
+            "SUCCESS"
+        };
+        write_log(&format!(
+            "SEASONS_LOAD_CALLBACK: final kind={kind} result={shown:?} flag={flag:?} ctx={ctx:#x} cbref={cbref:#x}\n"
+        ));
+    }
+    // Base-supply experiment: the CACHE_PACKNAMES failure is expected to be fixed
+    // by the WEBFILE base-supply (the real file now downloads), so the guarded
+    // success-forcing bypass is DISABLED — a recurring CACHE_PACKNAMES here means
+    // the base-supply did not take effect and MUST NOT be masked.
+    if flag == Some(0)
+        && errstr.contains("CACHE_PACKNAMES")
+        && !BYPASS_DONE.swap(true, Ordering::AcqRel)
+    {
+        write_log("SEASONS_BYPASS: DISABLED (base-supply active); CACHE_PACKNAMES not masked\n");
+    }
+    let t = FINAL_COMPLETION_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(ctx, result, r8, r9)
+}
+
+// LoadOfflineSeasons STAGE-1 async completion (FUN_180106240): fails with
+// "CACHE_PACKNAMES_FAILED" when result==0 or *(i32)(result+0x1c)!=0; else chains
+// the next async stage. Logs whether the first async stage succeeded. Passive.
+static STAGE1_COMPLETION_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn stage1_completion_wrapper(
+    param1: usize,
+    result: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        if result == 0 {
+            write_log("SEASONS_STAGE1: result=NULL -> CACHE_PACKNAMES_FAILED\n");
+        } else {
+            let status = rd_i32(result + 0x1c);
+            let verdict = if status == Some(0) {
+                "ok(chain next)"
+            } else {
+                "CACHE_PACKNAMES_FAILED"
+            };
+            write_log(&format!(
+                "SEASONS_STAGE1: result={result:#x} status(+0x1c)={} -> {verdict}\n",
+                status.map(|x| x.to_string()).unwrap_or_else(|| "??".into()),
+            ));
+        }
+    }
+    let t = STAGE1_COMPLETION_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(param1, result, r8, r9)
+}
+
+// WEBFILE_DL download start FUN_18017ff90(url, ctx): param_1 (rcx) is the C-string
+// URL of the pack-names / cards-tournament-list web file. Its prologue has a
+// rip-relative `MOV R8,[DAT_1802e6580]`, so it uses the relocating installer
+// (disp32 at copied offset 7, instruction end 11).
+//
+// BASE-SUPPLY: the client's RS4::ServerSettings CDN base (DAT_1802e6408+0x30) is
+// EMPTY in the emulator — FUN_180124270 only sets it when the OSDK getter
+// slot0x3f8 is non-empty, and it has no default (unlike the API base). So every
+// FUT WEBFILE url arrives here as a BARE relative path and 999s (client
+// sentinel). We supply the missing intended `<CDN>/fut/` prefix so the REAL file
+// downloads and parses. This is a data-supply, NOT a success-forcing bypass;
+// absolute urls (containing "://", e.g. the "http://sbc/..." tile route) pass
+// through untouched.
+//
+// The prefix comes from `openfut.cfg` via `openfut-common`, the same single
+// source of truth as every redirect target, so no lab address is compiled in.
+// Unset (config missing/unusable) means NO rewrite: a url is left exactly as the
+// client built it rather than pointed at a guessed host.
+static FUT_CONTENT_BASE: OnceLock<String> = OnceLock::new();
+
+/// Arm the FUT web-file prefix from the resolved configuration. Idempotent: the
+/// first call wins.
+pub(crate) fn set_fut_content_base(base: String) {
+    let _ = FUT_CONTENT_BASE.set(base);
+}
+
+static URL_CAPTURE_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn url_capture_wrapper(
+    rcx: usize,
+    rdx: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    let orig = rd_cstr(rcx, 256);
+    let mut arg_rcx = rcx;
+    // Owned buffer that stays alive across the original() call below. The caller
+    // frees its own url buffer immediately after FUN_18017ff90 returns, so the
+    // client copies the url synchronously during the call — a local buffer is
+    // sufficient and nothing is leaked.
+    let mut full: Vec<u8> = Vec::new();
+    if let Some(base) = FUT_CONTENT_BASE.get() {
+        if !orig.is_empty() && !orig.contains("://") {
+            full.extend_from_slice(base.as_bytes());
+            full.extend_from_slice(orig.trim_start_matches('/').as_bytes());
+            full.push(0); // NUL terminator for the C-string
+            arg_rcx = full.as_ptr() as usize;
+        }
+    }
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        if arg_rcx != rcx {
+            write_log(&format!(
+                "SEASONS_WEBFILE_URL: orig={orig:?} rewritten={:?}\n",
+                rd_cstr(arg_rcx, 256)
+            ));
+        } else {
+            write_log(&format!("SEASONS_WEBFILE_URL: url={orig:?} (unchanged)\n"));
+        }
+    }
+    let t = URL_CAPTURE_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    let ret = original(arg_rcx, rdx, r8, r9);
+    drop(full); // ensure the url buffer outlives the download-start call
+    ret
+}
+
+// ───────────────────────── crash locator (VEH) ──────────────────────────────
+// A vectored exception handler that logs the faulting code/address/module for
+// fatal exceptions, then lets the crash proceed (EXCEPTION_CONTINUE_SEARCH). It
+// pinpoints the StartSeason crash: whether it is a CardsDLL season-data
+// null-deref (fixable by supplying matches/opponents) or an engine/other fault.
+static CARDS_BASE: AtomicUsize = AtomicUsize::new(0);
+static CARDS_SIZE: AtomicUsize = AtomicUsize::new(0);
+static CRASH_LOGS: AtomicUsize = AtomicUsize::new(0);
+const EXCEPTION_CONTINUE_SEARCH: i32 = 0;
+
+/// OptionalHeader.SizeOfImage from the module's PE headers (fallback 64 MiB).
+unsafe fn cards_image_size(base: usize) -> usize {
+    if !readable_range(base + 0x3c, 4) {
+        return 0x0400_0000;
+    }
+    let e_lfanew = core::ptr::read_volatile((base + 0x3c) as *const u32) as usize;
+    let so_off = base + e_lfanew + 0x50; // NT header + OptionalHeader.SizeOfImage
+    if !readable_range(so_off, 4) {
+        return 0x0400_0000;
+    }
+    core::ptr::read_volatile(so_off as *const u32) as usize
+}
+
+unsafe extern "system" fn crash_logger(info: *mut EXCEPTION_POINTERS) -> i32 {
+    if info.is_null() {
+        return EXCEPTION_CONTINUE_SEARCH;
+    }
+    let rec = (*info).ExceptionRecord;
+    if rec.is_null() {
+        return EXCEPTION_CONTINUE_SEARCH;
+    }
+    let code = (*rec).ExceptionCode as u32;
+    // Only fatal codes; skip the many benign first-chance SEH exceptions.
+    let interesting = matches!(
+        code,
+        0xC000_0005 // access violation
+            | 0xC000_001D // illegal instruction
+            | 0xC000_0094 // integer divide by zero
+            | 0xC000_00FD // stack overflow
+            | 0xC000_0025 // noncontinuable exception
+    );
+    if !interesting || CRASH_LOGS.fetch_add(1, Ordering::Relaxed) >= 8 {
+        return EXCEPTION_CONTINUE_SEARCH;
+    }
+    let addr = (*rec).ExceptionAddress as usize;
+    let base = CARDS_BASE.load(Ordering::Acquire);
+    let size = CARDS_SIZE.load(Ordering::Acquire);
+    let module = if base != 0 && addr >= base && addr < base + size {
+        format!("CardsDLL+{:#x}", addr - base)
+    } else {
+        "other".to_string()
+    };
+    let (kind, fault) = if code == 0xC000_0005 && (*rec).NumberParameters >= 2 {
+        let op = (*rec).ExceptionInformation[0];
+        let fa = (*rec).ExceptionInformation[1];
+        let k = match op {
+            0 => "read",
+            1 => "write",
+            8 => "exec",
+            _ => "?",
+        };
+        (k, fa)
+    } else {
+        ("", 0usize)
+    };
+    write_log(&format!(
+        "SEASON_CRASH: code={code:#010x} at={addr:#x} module={module} access={kind} fault_addr={fault:#x}\n"
+    ));
+    EXCEPTION_CONTINUE_SEARCH
+}
+
+unsafe fn worker() {
+    let mut base = 0usize;
+    for _ in 0..600u32 {
+        base = GetModuleHandleA(c"CardsDLL_Win64_retail.dll".as_ptr().cast()) as usize;
+        if base != 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(500));
+    }
+    if base == 0 || !validate_cards_build(base) {
+        write_log("SEASON_TRACE: CardsDLL unavailable/invalid; season trace inactive\n");
+        return;
+    }
+    CARDS_BASE.store(base, Ordering::Release);
+    CARDS_SIZE.store(cards_image_size(base), Ordering::Release);
+    AddVectoredExceptionHandler(1, Some(crash_logger));
+    write_log("SEASON_TRACE: crash logger (VEH) armed\n");
+    // (rva, name, copy_len, signature, wrapper, trampoline slot)
+    install_detour(
+        base,
+        0x4eb70,
+        "LoadCurrentOfflineSeason_native",
+        15,
+        &[
+            0x40, 0x57, 0x48, 0x83, 0xec, 0x60, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff,
+            0xff,
+        ],
+        load_current_native_wrapper as *const () as usize,
+        &LOAD_CURRENT_NATIVE_TRAMP,
+    );
+    install_detour(
+        base,
+        0x4f340,
+        "StartSeason_native",
+        15,
+        &[
+            0x40, 0x57, 0x48, 0x83, 0xec, 0x60, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff,
+            0xff,
+        ],
+        start_season_native_wrapper as *const () as usize,
+        &START_SEASON_NATIVE_TRAMP,
+    );
+    install_detour(
+        base,
+        0x4e850,
+        "GetOfflineSeasonInfo_native",
+        15,
+        &[
+            0x48, 0x89, 0x5c, 0x24, 0x08, 0x48, 0x89, 0x6c, 0x24, 0x10, 0x48, 0x89, 0x74, 0x24,
+            0x18,
+        ],
+        get_info_native_wrapper as *const () as usize,
+        &GET_INFO_NATIVE_TRAMP,
+    );
+    install_detour(
+        base,
+        0x57230,
+        "LoadCurrentOfflineSeason_impl",
+        19,
+        &[
+            0x48, 0x8b, 0xc4, 0x57, 0x48, 0x81, 0xec, 0x80, 0x00, 0x00, 0x00, 0x48, 0xc7, 0x40,
+            0x98, 0xfe, 0xff, 0xff, 0xff,
+        ],
+        load_current_impl_wrapper as *const () as usize,
+        &LOAD_CURRENT_IMPL_TRAMP,
+    );
+    install_detour(
+        base,
+        0x578e0,
+        "LoadCurrentOfflineSeason_completion",
+        16,
+        &[
+            0x48, 0x8b, 0xc4, 0x57, 0x48, 0x83, 0xec, 0x70, 0x48, 0xc7, 0x40, 0xd0, 0xfe, 0xff,
+            0xff, 0xff,
+        ],
+        completion_wrapper as *const () as usize,
+        &COMPLETION_TRAMP,
+    );
+    install_detour_reloc(
+        base,
+        0x4eb50,
+        "GetUsersOfflineDivision_native",
+        14,
+        &[
+            0x48, 0x83, 0xec, 0x28, 0x48, 0x8b, 0x0d, 0x75, 0x18, 0x29, 0x00, 0x48, 0x8b, 0x01,
+        ],
+        7,
+        11,
+        get_users_division_wrapper as *const () as usize,
+        &GET_USERS_DIVISION_TRAMP,
+    );
+    install_detour(
+        base,
+        0x4ee10,
+        "LoadOfflineSeasons_native",
+        15,
+        &[
+            0x40, 0x57, 0x48, 0x83, 0xec, 0x60, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff,
+            0xff,
+        ],
+        load_offline_real_wrapper as *const () as usize,
+        &LOAD_OFFLINE_REAL_TRAMP,
+    );
+    install_detour(
+        base,
+        0x57560,
+        "LoadOfflineSeasons_asyncimpl",
+        17,
+        &[
+            0x40, 0x55, 0x56, 0x57, 0x48, 0x83, 0xec, 0x30, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe,
+            0xff, 0xff, 0xff,
+        ],
+        load_offline_async_wrapper as *const () as usize,
+        &LOAD_OFFLINE_ASYNC_TRAMP,
+    );
+    install_detour(
+        base,
+        0xffe90,
+        "LoadOfflineSeasons_final_completion",
+        16,
+        &[
+            0x48, 0x89, 0x5c, 0x24, 0x08, 0x57, 0x48, 0x83, 0xec, 0x30, 0x80, 0x3a, 0x00, 0x48,
+            0x8b, 0xda,
+        ],
+        final_completion_wrapper as *const () as usize,
+        &FINAL_COMPLETION_TRAMP,
+    );
+    install_detour(
+        base,
+        0x106240,
+        "LoadOfflineSeasons_stage1_completion",
+        15,
+        &[
+            0x48, 0x8b, 0xc4, 0x55, 0x48, 0x8d, 0x68, 0xa1, 0x48, 0x81, 0xec, 0xc0, 0x00, 0x00,
+            0x00,
+        ],
+        stage1_completion_wrapper as *const () as usize,
+        &STAGE1_COMPLETION_TRAMP,
+    );
+    install_detour_reloc(
+        base,
+        0x17ff90,
+        "start_webfile_dl_url",
+        14,
+        &[
+            0x48, 0x83, 0xec, 0x38, 0x4c, 0x8b, 0x05, 0xe5, 0x65, 0x16, 0x00, 0x4c, 0x8b, 0xd1,
+        ],
+        7,
+        11,
+        url_capture_wrapper as *const () as usize,
+        &URL_CAPTURE_TRAMP,
+    );
+    write_log("SEASON_TRACE: all season-native traces armed\n");
+}
+
+/// Arm the passive season-flow diagnostics on a deferred thread (CardsDLL is not
+/// yet loaded at DllMain time). Read-only: never changes game behavior.
+pub(crate) fn install() {
+    arm_fut_content_base();
+    write_log("SEASON_TRACE: requested; deferred signature validation starting\n");
+    std::thread::spawn(|| unsafe { worker() });
+}
+
+/// Resolve the FUT web-file prefix from `openfut.cfg` next to the game exe, via
+/// the shared `openfut-common` parser — the same single source of truth the
+/// network redirect uses, so the lab address is never compiled in.
+///
+/// Fails SAFE: an absent or unusable config arms nothing, and the url rewriter
+/// then leaves every url exactly as the client built it.
+fn arm_fut_content_base() {
+    let path = match std::env::current_exe()
+        .ok()
+        .and_then(|p| p.parent().map(|d| d.join("openfut.cfg")))
+    {
+        Some(p) => p,
+        None => {
+            write_log("SEASONS_WEBFILE_BASE: cannot locate openfut.cfg — no url rewrite\n");
+            return;
+        }
+    };
+    let contents = match std::fs::read_to_string(&path) {
+        Ok(c) => c,
+        Err(e) => {
+            write_log(&format!(
+                "SEASONS_WEBFILE_BASE: {} unreadable ({e}) — no url rewrite\n",
+                path.display()
+            ));
+            return;
+        }
+    };
+    match openfut_common::ServerConfig::parse(&contents) {
+        Ok(cfg) => {
+            let base = cfg.fut_content_base();
+            write_log(&format!("SEASONS_WEBFILE_BASE: armed {base}\n"));
+            set_fut_content_base(base);
+        }
+        Err(e) => write_log(&format!(
+            "SEASONS_WEBFILE_BASE: openfut.cfg unusable ({e}) — no url rewrite\n"
+        )),
+    }
+}

openfut-hook/src/store_entry.rs

@@ -1,16 +1,9 @@
-//! FIFA 17 store tab-bar bind repair.
+//! FIFA 17 store tab-bar repair — pre-warm the purchase groups before screen-show.
 //!
-//! # What this repairs
+//! # Confirmed root cause (live, 2026-08-19)
 //!
-//! On the FIRST store entry of a session the category tab bar is missing: the
-//! store draws a single category with no tabs. Leaving and re-entering the store
-//! shows the bar correctly. Nothing about the server response differs between the
-//! two entries — the difference is purely *when* the purchase groups exist.
-//!
-//! # Mechanism (reversed from the pinned CardsDLL)
-//!
-//! `FUN_18007e5e0(ctx, panel)` is the native tab binder, invoked by the screen
-//! framework at screen-show. It is a fully unrolled six-slot loop; each slot gates
+//! `FUN_18007e5e0(ctx, panel)` is the native tab binder the screen framework
+//! invokes at store screen-show. It is an unrolled six-slot loop; each slot gates
 //! on one hard-coded category token and either publishes that group's id as
 //! `PANEL_ID` for the slot, or hides the slot:
 //!
@@ -21,60 +14,63 @@
 //!     (*(panel_vtbl+0xa0))(panel, slot);                      // hide slot
 //! ```
 //!
-//! slot -> token, in the order the binder tests them:
+//! slot -> token, in bind order: `mypacks, bronze, silver, gold, special, points`.
+//! The gate `FUN_180014df0` resolves the token through `FUN_180014380`, which scans
+//! the loaded purchase groups (stride `0x108`) comparing the token at `group+0x70`.
+//! So a tab appears iff a purchase group carrying that token is loaded AT BIND TIME.
 //!
-//! | slot | token     | note                                                     |
-//! |------|-----------|----------------------------------------------------------|
-//! | 0    | `mypacks` |                                                          |
-//! | 1    | `bronze`  |                                                          |
-//! | 2    | `silver`  |                                                          |
-//! | 3    | `gold`    |                                                          |
-//! | 4    | `special` |                                                          |
-//! | 5    | `points`  | extra gate: `(*(store_vtbl+0x30))(store)` must be false  |
+//! The bind detour below measured the ground truth on the retail client:
 //!
-//! The gate `FUN_180014df0(_, idx)` maps the index to one of those token strings
-//! and calls `FUN_180014380`, which linearly scans the loaded purchase groups
-//! (stride `0x108`) comparing the token at `group+0x70`. So a tab appears if and
-//! only if a purchase group carrying that exact token is loaded *at bind time*.
-//! Our server emits `mypacks`/`bronze`/`silver`/`gold` as `displayGroup.value`, so
-//! four tabs are expected.
+//! ```text
+//! STORE_TABS: bind generation=2 mask=0x00 ...        <- empty at screen-show
+//! STORE_TABS: rebound generation=2 mask=0x0e (...)   <- groups present ~instantly after
+//! ```
 //!
-//! On a cold session the store screen shows BEFORE its own
-//! `GET store/purchasegroup/all` response arrives, so every gate fails, all six
-//! slots take the hide path, and the binder is never invoked again for that
-//! screen. Re-entry works only because the groups are cached by then.
+//! `mask=0x00` at screen-show confirms the container is empty when the framework
+//! binds, so all six slots hide and no tab bar is built. The store's own
+//! `GET store/purchasegroup/all` only returns *after* screen-show, so re-entry works
+//! (groups cached) but first entry does not. (`0x0e` = bronze|silver|gold; bit 0
+//! `mypacks` is clear because an empty My Packs serves no `mypacks` group.)
 //!
-//! # The repair
+//! # What did NOT work, and why this module changed
 //!
-//! Re-invoke the binder ONCE, with the same `(ctx, panel)` the framework used, at
-//! the first render after the groups have arrived. That reproduces exactly the
-//! re-entry ordering on the first entry. The binder is safe to repeat: it only
-//! publishes `PANEL_ID` or hides per slot, reads the group list from a process
-//! singleton, and finishes by tail-calling `panel->vtbl[0xd0](panel, true)` — the
-//! provider commit that makes the movie rebuild its bar.
+//! A previous version re-invoked the binder at the next render, once the groups had
+//! arrived (`rebound ... mask=0x0e` above). The movie built NO tab bar from that
+//! late bind: the Scaleform movie only honours the framework's OWN bind at
+//! screen-show, not a later re-publish/commit. That approach is abandoned.
 //!
-//! # Why it is fail-closed
+//! # This module: make the container non-empty BEFORE the first bind
 //!
-//! * The rebind fires only when the framework's own bind observed an EMPTY gate
-//!   mask (every tab hidden) and at least one token now resolves. A store that
-//!   already bound tabs is never touched.
-//! * At most one rebind per bind generation, claimed with a compare-exchange, so a
-//!   re-entrant render can never loop.
-//! * `(ctx, panel)` are only ever the pointers the framework itself passed; we
-//!   never synthesise them, and a generation with no captured pair is skipped.
-//! * The gate probe is the game's own `FUN_180014df0`. Its `rcx` is provably dead
-//!   (it is forwarded to `FUN_180014380`, which discards it and fetches the
-//!   container from a singleton), so probing with a null `this` is exactly what
-//!   the native code does.
-//! * Image plus all three function signatures are verified before any write and
-//!   re-verified under thread suspension; one wrong byte aborts with no write and
-//!   no call.
+//! The only publish the movie honours is the framework's bind at screen-show, and
+//! re-entry proves that bind builds the bar correctly when the container is already
+//! full. So the fix is to load the purchase groups BEFORE the store screen is shown.
+//!
+//! `FUN_180017870(storefront)` issues the store's own `GET store/purchasegroup/all`.
+//! Firing it from the FUT hub event pump (a real game thread, well before the store
+//! screen exists) gives the response time to arrive and populate the container, so
+//! the first screen-show bind sees a full list and binds the tabs natively — exactly
+//! the re-entry path, on first entry.
+//!
+//! The bind detour is retained purely as the SENSOR: the first-entry bind mask is
+//! the safe, definitive measurement of whether the pre-warm populated the container
+//! in time. `mask != 0` at first bind ⇒ pre-warm worked and the tabs bind natively;
+//! `mask == 0` (with `storefront_seen=1` in the pre-warm log) ⇒ a hub-time request
+//! cannot land in time and the remaining route is the extracted `StoreFront.apt`.
+//!
+//! # Fail-closed
+//!
+//! * Pre-warm fires at most once per process, claimed atomically, and only once the
+//!   storefront singleton is non-null; the storefront pointer is read through a
+//!   guarded load and the request function's signature is validated before the call.
+//! * The bind detour only reads (captures pointers, probes the game's own gate with
+//!   a provably-dead `this`) and never mutates store state.
+//! * Image plus every function signature are verified before any write and again
+//!   under thread suspension; one wrong byte aborts with no write and no call.
 //!
 //! # Promotion
 //!
-//! Like the SBC dispatch repair, this is a PROMOTED feature: armed by the build,
-//! never by an environment variable (see [`REPAIR_PROMOTED`]). Rollback is a
-//! `version.dll` file swap, not an env kill-switch.
+//! PROMOTED: armed by the build, never by an environment variable (see
+//! [`REPAIR_PROMOTED`]). Rollback is a `version.dll` file swap.
 
 use core::ffi::c_void;
 use core::sync::atomic::{AtomicBool, AtomicU32, AtomicU64, AtomicUsize, Ordering};
@@ -89,24 +85,26 @@ use windows_sys::Win32::System::Memory::{
 use windows_sys::Win32::System::Threading::{GetCurrentProcess, GetCurrentThreadId};
 
 /// Native tab binder `FUN_18007e5e0(ctx, panel)`, invoked by the screen framework
-/// at screen-show. Detoured to capture its arguments and the gate mask it saw.
+/// at screen-show. Detoured as the read-only sensor: captures the gate mask it saw.
 const BIND_RVA: usize = 0x7e5e0;
-/// Store render `FUN_18007dab0(screen)`, called by the screen dispatcher for event
-/// `0x753f` — i.e. once the data needed to draw the category has arrived. Detoured
-/// as the rebind trigger, on the same thread the dispatcher and screen-show use.
-const RENDER_RVA: usize = 0x7dab0;
 /// Category gate `FUN_180014df0(dead_this, idx) -> bool`: maps `idx` to one of the
 /// six hard-coded tokens and reports whether a loaded purchase group carries it.
 const HAS_CATEGORY_RVA: usize = 0x14df0;
+/// `FUN_180017870(storefront)` issues `GET store/purchasegroup/all` — the exact call
+/// the store screen makes at entry (from `0x18007f25e`). Fired early to pre-warm.
+const REQUEST_GROUPS_RVA: usize = 0x17870;
+/// `*(base + STOREFRONT_GLOBAL_RVA)` is the storefront the store code passes to its
+/// request/lookup helpers (loaded at `0x18007f25e`, right before the pack-list GET).
+const STOREFRONT_GLOBAL_RVA: usize = 0x2de0d0;
 
 /// Gate indices in slot order: `mypacks, bronze, silver, gold, special, points`.
 /// Taken from the binder's unrolled call sequence, not from the index order of
 /// `FUN_180014580`'s jump table (which is deliberately different).
 const GATE_INDICES: [u32; 6] = [0, 2, 3, 4, 5, 1];
 
-/// Whole-instruction prologue length relocated into each trampoline; also the
-/// number of bytes overwritten by an entry detour. Both prologues below are 15
-/// bytes, a clean boundary covering the 14-byte absolute jump.
+/// Whole-instruction prologue length relocated into the trampoline; also the number
+/// of bytes overwritten by the entry detour. 15 bytes, a clean boundary covering the
+/// 14-byte absolute jump.
 const COPY_LEN: usize = 15;
 const ABS_JUMP_LEN: usize = 14;
 
@@ -115,25 +113,26 @@ const ABS_JUMP_LEN: usize = 14;
 const BIND_SIGNATURE: [u8; COPY_LEN] = [
     0x48, 0x89, 0x5c, 0x24, 0x08, 0x48, 0x89, 0x6c, 0x24, 0x10, 0x48, 0x89, 0x74, 0x24, 0x18,
 ];
-/// First 15 bytes of `FUN_18007dab0`: `push rdi; sub rsp,0x40; movq [rsp+0x30],-2`.
-const RENDER_SIGNATURE: [u8; COPY_LEN] = [
-    0x40, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0xc7, 0x44, 0x24, 0x30, 0xfe, 0xff, 0xff, 0xff,
-];
 /// First 15 bytes of `FUN_180014df0`. Validated before we ever call it, so the gate
 /// probe only runs on the exact build it was reversed against.
 const HAS_CATEGORY_SIGNATURE: [u8; 15] = [
     0x40, 0x53, 0x48, 0x83, 0xec, 0x20, 0x33, 0xdb, 0x44, 0x8b, 0xc3, 0x85, 0xd2, 0x74, 0x35,
 ];
+/// First 18 bytes of `FUN_180017870`. Validated before we ever call it, so the
+/// pre-warm only fires the genuine request on the exact build it was reversed against.
+const REQUEST_GROUPS_SIGNATURE: [u8; 18] = [
+    0x40, 0x57, 0x48, 0x81, 0xec, 0x90, 0x00, 0x00, 0x00, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff,
+    0xff, 0xff,
+];
 
 type BindFn = unsafe extern "system" fn(*mut c_void, *mut c_void) -> *mut c_void;
-type RenderFn = unsafe extern "system" fn(*mut c_void) -> *mut c_void;
 type HasCategoryFn = unsafe extern "system" fn(*mut c_void, u32) -> u8;
+type RequestGroupsFn = unsafe extern "system" fn(*mut c_void) -> usize;
 
-/// The tab-bind repair is PROMOTED: armed by the build, never by an environment
+/// The tab-bar repair is PROMOTED: armed by the build, never by an environment
 /// variable, so every launch path (Steam, the launcher, a bare `umu-run`) behaves
 /// identically. Promotion does not weaken any check — the signature gate, the image
-/// validation, the thread quiesce and the empty-mask precondition all remain in the
-/// runtime evidence path.
+/// validation and the thread quiesce all remain in the runtime evidence path.
 pub(crate) const REPAIR_PROMOTED: bool = true;
 
 /// Compile-time contract: the repair stays build-armed. Regressing it to an env gate
@@ -143,45 +142,33 @@ const _: () = assert!(REPAIR_PROMOTED);
 
 static REPAIR_ENABLED: AtomicBool = AtomicBool::new(false);
 static BIND_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
-static RENDER_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
 static STORE_BASE: AtomicUsize = AtomicUsize::new(0);
-/// `(ctx, panel)` as the framework passed them to the most recent bind.
-static BIND_CTX: AtomicUsize = AtomicUsize::new(0);
-static BIND_PANEL: AtomicUsize = AtomicUsize::new(0);
-/// Monotonic bind generation; `0` means "no bind observed yet".
-static BIND_GEN: AtomicU64 = AtomicU64::new(0);
-/// Generation whose rebind has already been claimed.
-static REBOUND_GEN: AtomicU64 = AtomicU64::new(0);
 static BIND_ENTRIES: AtomicU64 = AtomicU64::new(0);
-static RENDER_ENTRIES: AtomicU64 = AtomicU64::new(0);
-static REBINDS: AtomicU64 = AtomicU64::new(0);
-/// Gate mask the framework's bind observed (bit N = slot N bound).
+/// Gate mask the framework's most recent bind observed (bit N = slot N would bind).
 static LAST_BIND_MASK: AtomicU32 = AtomicU32::new(0);
-/// Gate mask at the moment of the rebind.
-static LAST_REBIND_MASK: AtomicU32 = AtomicU32::new(0);
 static LAST_THREAD: AtomicUsize = AtomicUsize::new(0);
+/// Set once the pre-warm request has been fired (or is provably unnecessary).
+static PREWARM_DONE: AtomicBool = AtomicBool::new(false);
+static PREWARM_ATTEMPTS: AtomicU64 = AtomicU64::new(0);
+/// Highest storefront pointer observed at hub time (0 = never non-null yet). Logged
+/// so a failed pre-warm can be attributed to "storefront not up at hub" vs "fired
+/// but the response did not land before screen-show".
+static PREWARM_STOREFRONT_SEEN: AtomicUsize = AtomicUsize::new(0);
 
-/// Pure rebind decision, isolated for host tests.
+/// Pure pre-warm decision, isolated for host tests.
 ///
-/// Rebind exactly when the framework's own bind hid every slot (`bind_mask == 0`)
-/// but at least one token resolves now, for a generation we have both pointers for
-/// and have not already rebound.
-fn should_rebind(
-    gen: u64,
-    rebound_gen: u64,
-    bind_mask: u8,
-    now_mask: u8,
-    ctx: usize,
-    panel: usize,
-) -> bool {
-    gen != 0 && rebound_gen != gen && ctx != 0 && panel != 0 && bind_mask == 0 && now_mask != 0
+/// Fire exactly once, and only once the storefront singleton is non-null; before
+/// that, keep waiting (a null storefront early at the hub is expected).
+fn should_prewarm(already_done: bool, storefront: usize) -> bool {
+    !already_done && storefront != 0
 }
 
 /// Probe all six category tokens with the game's own gate and return a slot mask.
 ///
 /// `FUN_180014df0` forwards its `this` to `FUN_180014380`, which discards it and
 /// fetches the group container from a singleton, so a null `this` is exactly what
-/// the native code effectively passes.
+/// the native code effectively passes. Called only from the bind detour, where the
+/// store subsystem is provably live.
 unsafe fn gate_mask() -> u8 {
     let base = STORE_BASE.load(Ordering::Acquire);
     if base == 0 {
@@ -200,6 +187,53 @@ unsafe fn gate_mask() -> u8 {
     mask
 }
 
+/// Ask the game to load the purchase groups now, on the caller's (game) thread.
+///
+/// Called from the FUT event dispatcher so it runs on a real game thread well before
+/// the store screen is ever shown — the same thread the store screen itself would use
+/// for this call at entry. Fail-closed: base/signature/storefront all validated, at
+/// most one request per process.
+pub(crate) unsafe fn maybe_prewarm_groups() {
+    if PREWARM_DONE.load(Ordering::Acquire) || !REPAIR_ENABLED.load(Ordering::Acquire) {
+        return;
+    }
+    let base = STORE_BASE.load(Ordering::Acquire);
+    if base == 0 || !crate::sbc_trace::valid_cards_image(base) {
+        return;
+    }
+    let Some(storefront) = base
+        .checked_add(STOREFRONT_GLOBAL_RVA)
+        .and_then(|slot| crate::sbc_trace::guarded_usize(slot))
+    else {
+        return;
+    };
+    if storefront != 0 {
+        PREWARM_STOREFRONT_SEEN.store(storefront, Ordering::Release);
+    }
+    if !should_prewarm(false, storefront) {
+        // Storefront not up yet at the hub: keep waiting, do not consume the attempt.
+        return;
+    }
+    let Some(request) = base.checked_add(REQUEST_GROUPS_RVA) else {
+        return;
+    };
+    if !crate::sbc_trace::executable_range_in_image(base, request, REQUEST_GROUPS_SIGNATURE.len())
+        || core::slice::from_raw_parts(request as *const u8, REQUEST_GROUPS_SIGNATURE.len())
+            != REQUEST_GROUPS_SIGNATURE
+    {
+        return;
+    }
+    // Claim the single attempt before issuing it, so a re-entrant event can never
+    // fire a second request.
+    PREWARM_DONE.store(true, Ordering::Release);
+    PREWARM_ATTEMPTS.fetch_add(1, Ordering::Relaxed);
+    let request_fn: RequestGroupsFn = core::mem::transmute(request);
+    request_fn(storefront as *mut c_void);
+    crate::write_log(&format!(
+        "STORE_TABS: pre-warmed purchase groups at hub (storefront={storefront:#x})\n"
+    ));
+}
+
 unsafe fn restore_entry<const N: usize>(target: usize, original: &[u8; N]) -> bool {
     let mut old = 0u32;
     if VirtualProtect(target as _, N, PAGE_EXECUTE_READWRITE, &mut old) == 0 {
@@ -232,65 +266,18 @@ unsafe fn write_entry<const N: usize>(
     }
 }
 
-/// Detour target for the native tab binder. Records the arguments and the gate mask
-/// the framework's bind is about to act on, then runs the original unchanged.
+/// Detour target for the native tab binder. Read-only sensor: records the gate mask
+/// the framework's bind is about to act on, then runs the original unchanged. This is
+/// the definitive measurement of whether the pre-warm populated the container in time.
 unsafe extern "system" fn bind_wrapper(ctx: *mut c_void, panel: *mut c_void) -> *mut c_void {
     let mask = gate_mask();
-    BIND_CTX.store(ctx as usize, Ordering::Release);
-    BIND_PANEL.store(panel as usize, Ordering::Release);
     LAST_BIND_MASK.store(mask as u32, Ordering::Release);
     LAST_THREAD.store(GetCurrentThreadId() as usize, Ordering::Relaxed);
-    let generation = BIND_ENTRIES.fetch_add(1, Ordering::AcqRel) + 1;
-    BIND_GEN.store(generation, Ordering::Release);
+    BIND_ENTRIES.fetch_add(1, Ordering::AcqRel);
     let original: BindFn = core::mem::transmute(BIND_TRAMPOLINE.load(Ordering::Acquire));
     original(ctx, panel)
 }
 
-/// Re-invoke the binder once for the current generation, if the framework's bind
-/// hid every slot and the groups have since arrived.
-unsafe fn maybe_rebind() {
-    if !REPAIR_ENABLED.load(Ordering::Acquire) {
-        return;
-    }
-    let trampoline = BIND_TRAMPOLINE.load(Ordering::Acquire);
-    if trampoline == 0 {
-        return;
-    }
-    let generation = BIND_GEN.load(Ordering::Acquire);
-    let rebound = REBOUND_GEN.load(Ordering::Acquire);
-    let ctx = BIND_CTX.load(Ordering::Acquire);
-    let panel = BIND_PANEL.load(Ordering::Acquire);
-    let bind_mask = LAST_BIND_MASK.load(Ordering::Acquire) as u8;
-    let now_mask = gate_mask();
-    if !should_rebind(generation, rebound, bind_mask, now_mask, ctx, panel) {
-        return;
-    }
-    // Claim this generation before acting, so a re-entrant render cannot rebind twice.
-    if REBOUND_GEN
-        .compare_exchange(rebound, generation, Ordering::AcqRel, Ordering::Acquire)
-        .is_err()
-    {
-        return;
-    }
-    LAST_REBIND_MASK.store(now_mask as u32, Ordering::Release);
-    REBINDS.fetch_add(1, Ordering::Relaxed);
-    let original: BindFn = core::mem::transmute(trampoline);
-    original(ctx as *mut c_void, panel as *mut c_void);
-    crate::write_log(&format!(
-        "STORE_TABS: rebound generation={generation} mask={now_mask:#04x} (bind saw 0x00)\n"
-    ));
-}
-
-/// Detour target for the store render. Runs the original first, then repairs the tab
-/// bind if this is the first render since an empty bind.
-unsafe extern "system" fn render_wrapper(screen: *mut c_void) -> *mut c_void {
-    RENDER_ENTRIES.fetch_add(1, Ordering::Relaxed);
-    let original: RenderFn = core::mem::transmute(RENDER_TRAMPOLINE.load(Ordering::Acquire));
-    let result = original(screen);
-    maybe_rebind();
-    result
-}
-
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 enum InstallOutcome {
     Installed,
@@ -304,23 +291,28 @@ unsafe fn install_hook(base: usize) -> InstallOutcome {
     let Some(bind) = crate::sbc_trace::target_va(base, BIND_RVA) else {
         return InstallOutcome::CleanFailure;
     };
-    let Some(render) = crate::sbc_trace::target_va(base, RENDER_RVA) else {
-        return InstallOutcome::CleanFailure;
-    };
     let Some(gate) = crate::sbc_trace::target_va(base, HAS_CATEGORY_RVA) else {
         return InstallOutcome::CleanFailure;
     };
-    // Fingerprint the image and ALL THREE functions: the two we detour and the one we
-    // call. A single mismatched byte aborts cleanly with no write and no call.
+    let Some(request) = crate::sbc_trace::target_va(base, REQUEST_GROUPS_RVA) else {
+        return InstallOutcome::CleanFailure;
+    };
+    // Fingerprint the image and ALL THREE functions: the one we detour and the two we
+    // call (gate probe, group request). A single mismatched byte aborts cleanly with
+    // no write and no call.
     if !crate::sbc_trace::valid_cards_image(base)
         || !crate::sbc_trace::executable_range_in_image(base, bind, BIND_SIGNATURE.len())
-        || !crate::sbc_trace::executable_range_in_image(base, render, RENDER_SIGNATURE.len())
         || !crate::sbc_trace::executable_range_in_image(base, gate, HAS_CATEGORY_SIGNATURE.len())
+        || !crate::sbc_trace::executable_range_in_image(
+            base,
+            request,
+            REQUEST_GROUPS_SIGNATURE.len(),
+        )
         || core::slice::from_raw_parts(bind as *const u8, BIND_SIGNATURE.len()) != BIND_SIGNATURE
-        || core::slice::from_raw_parts(render as *const u8, RENDER_SIGNATURE.len())
-            != RENDER_SIGNATURE
         || core::slice::from_raw_parts(gate as *const u8, HAS_CATEGORY_SIGNATURE.len())
             != HAS_CATEGORY_SIGNATURE
+        || core::slice::from_raw_parts(request as *const u8, REQUEST_GROUPS_SIGNATURE.len())
+            != REQUEST_GROUPS_SIGNATURE
     {
         return InstallOutcome::CleanFailure;
     }
@@ -334,32 +326,22 @@ unsafe fn install_hook(base: usize) -> InstallOutcome {
     {
         return InstallOutcome::CleanFailure;
     }
-    let Some(bind_trampoline) = crate::sbc_trace::allocate_trampoline(bind, COPY_LEN) else {
+    let Some(trampoline) = crate::sbc_trace::allocate_trampoline(bind, COPY_LEN) else {
         return InstallOutcome::CleanFailure;
     };
-    let Some(render_trampoline) = crate::sbc_trace::allocate_trampoline(render, COPY_LEN) else {
-        VirtualFree(bind_trampoline as _, 0, MEM_RELEASE);
-        return InstallOutcome::CleanFailure;
-    };
-    BIND_TRAMPOLINE.store(bind_trampoline, Ordering::Release);
-    RENDER_TRAMPOLINE.store(render_trampoline, Ordering::Release);
+    BIND_TRAMPOLINE.store(trampoline, Ordering::Release);
     STORE_BASE.store(base, Ordering::Release);
 
-    let release_trampolines = || {
-        VirtualFree(bind_trampoline as _, 0, MEM_RELEASE);
-        VirtualFree(render_trampoline as _, 0, MEM_RELEASE);
-        BIND_TRAMPOLINE.store(0, Ordering::Release);
-        RENDER_TRAMPOLINE.store(0, Ordering::Release);
-    };
-
     let Some(_gate_lock) = crate::sbc_trace::acquire_patch_installer_gate() else {
-        release_trampolines();
+        VirtualFree(trampoline as _, 0, MEM_RELEASE);
+        BIND_TRAMPOLINE.store(0, Ordering::Release);
         return InstallOutcome::CleanFailure;
     };
-    let mut peers = match crate::sbc_trace::suspend_peers(bind, render) {
+    let mut peers = match crate::sbc_trace::suspend_peers(bind, bind) {
         Ok(peers) => peers,
         Err(crate::sbc_trace::QuiesceFailure::Acquire) => {
-            release_trampolines();
+            VirtualFree(trampoline as _, 0, MEM_RELEASE);
+            BIND_TRAMPOLINE.store(0, Ordering::Release);
             return InstallOutcome::CleanFailure;
         }
         Err(crate::sbc_trace::QuiesceFailure::Resume) => {
@@ -367,26 +349,12 @@ unsafe fn install_hook(base: usize) -> InstallOutcome {
         }
     };
     let final_valid = crate::sbc_trace::valid_cards_image(base)
-        && core::slice::from_raw_parts(bind as *const u8, BIND_SIGNATURE.len()) == BIND_SIGNATURE
-        && core::slice::from_raw_parts(render as *const u8, RENDER_SIGNATURE.len())
-            == RENDER_SIGNATURE;
+        && core::slice::from_raw_parts(bind as *const u8, BIND_SIGNATURE.len()) == BIND_SIGNATURE;
     let transaction = if !final_valid {
         InstallOutcome::CleanFailure
     } else {
         match write_entry(bind, bind_wrapper as *const () as usize, &BIND_SIGNATURE) {
-            Ok(()) => {
-                match write_entry(render, render_wrapper as *const () as usize, &RENDER_SIGNATURE) {
-                    Ok(()) => InstallOutcome::Installed,
-                    // Second detour failed: undo the first so the image is left pristine.
-                    Err(_) => {
-                        if restore_entry(bind, &BIND_SIGNATURE) {
-                            InstallOutcome::CleanFailure
-                        } else {
-                            InstallOutcome::DegradedHookActive
-                        }
-                    }
-                }
-            }
+            Ok(()) => InstallOutcome::Installed,
             Err(true) => InstallOutcome::CleanFailure,
             Err(false) => InstallOutcome::DegradedHookActive,
         }
@@ -403,7 +371,8 @@ unsafe fn install_hook(base: usize) -> InstallOutcome {
         InstallOutcome::DegradedProcessState
     };
     if outcome == InstallOutcome::CleanFailure {
-        release_trampolines();
+        VirtualFree(trampoline as _, 0, MEM_RELEASE);
+        BIND_TRAMPOLINE.store(0, Ordering::Release);
     }
     outcome
 }
@@ -426,7 +395,7 @@ unsafe fn worker() {
     drop(_pending);
     match outcome {
         InstallOutcome::Installed => {
-            crate::write_log("STORE_TABS: tab-bind repair installed (promoted)\n")
+            crate::write_log("STORE_TABS: bind sensor + pre-warm installed (promoted)\n")
         }
         InstallOutcome::CleanFailure => {
             crate::write_log("STORE_TABS: clean install failure; inactive\n");
@@ -453,12 +422,11 @@ unsafe fn worker() {
         let binds = BIND_ENTRIES.load(Ordering::Acquire);
         if binds != binds_seen {
             crate::write_log(&format!(
-                "STORE_TABS: bind generation={} mask={:#04x} rebinds={} rebind_mask={:#04x} renders={} tid={}\n",
+                "STORE_TABS: bind generation={} mask={:#04x} prewarm_fired={} storefront_seen={:#x} tid={}\n",
                 binds,
                 LAST_BIND_MASK.load(Ordering::Acquire),
-                REBINDS.load(Ordering::Acquire),
-                LAST_REBIND_MASK.load(Ordering::Acquire),
-                RENDER_ENTRIES.load(Ordering::Acquire),
+                PREWARM_ATTEMPTS.load(Ordering::Acquire),
+                PREWARM_STOREFRONT_SEEN.load(Ordering::Acquire),
                 LAST_THREAD.load(Ordering::Relaxed),
             ));
             binds_seen = binds;
@@ -471,7 +439,9 @@ unsafe fn worker() {
 pub(crate) fn install() {
     // Promoted: armed by the build. No environment variable participates.
     REPAIR_ENABLED.store(REPAIR_PROMOTED, Ordering::Release);
-    crate::write_log("STORE_TABS: tab-bind repair ARMED (promoted); strict signature gate\n");
+    crate::write_log(
+        "STORE_TABS: bind sensor + pre-warm ARMED (promoted); strict signature gate\n",
+    );
     std::thread::spawn(|| unsafe { worker() });
 }
 
@@ -487,44 +457,29 @@ mod tests {
     }
 
     #[test]
-    fn rebinds_when_an_empty_bind_is_followed_by_loaded_groups() {
-        // bronze|silver|gold|mypacks present after the response lands.
-        assert!(should_rebind(1, 0, 0x00, 0x0f, 0x1000, 0x2000));
+    fn prewarms_once_the_storefront_is_up() {
+        assert!(should_prewarm(false, 0x1000));
     }
 
     #[test]
-    fn never_rebinds_a_store_that_already_bound_tabs() {
-        assert!(!should_rebind(1, 0, 0x0f, 0x0f, 0x1000, 0x2000));
+    fn waits_while_the_storefront_is_still_null() {
+        assert!(!should_prewarm(false, 0));
     }
 
     #[test]
-    fn never_rebinds_while_groups_are_still_absent() {
-        assert!(!should_rebind(1, 0, 0x00, 0x00, 0x1000, 0x2000));
+    fn never_prewarms_twice() {
+        assert!(!should_prewarm(true, 0x1000));
     }
 
     #[test]
-    fn rebinds_at_most_once_per_generation() {
-        assert!(!should_rebind(1, 1, 0x00, 0x0f, 0x1000, 0x2000));
-        // A later screen-show is a new generation and is eligible again.
-        assert!(should_rebind(2, 1, 0x00, 0x0f, 0x1000, 0x2000));
-    }
-
-    #[test]
-    fn never_rebinds_without_captured_framework_pointers() {
-        assert!(!should_rebind(1, 0, 0x00, 0x0f, 0, 0x2000));
-        assert!(!should_rebind(1, 0, 0x00, 0x0f, 0x1000, 0));
-    }
-
-    #[test]
-    fn never_rebinds_before_any_bind_is_observed() {
-        assert!(!should_rebind(0, 0, 0x00, 0x0f, 0x1000, 0x2000));
-    }
-
-    #[test]
-    fn detour_signatures_are_long_enough_for_the_absolute_jump() {
+    fn detour_signature_is_long_enough_for_the_absolute_jump() {
         assert!(BIND_SIGNATURE.len() >= ABS_JUMP_LEN);
-        assert!(RENDER_SIGNATURE.len() >= ABS_JUMP_LEN);
         assert_eq!(COPY_LEN, BIND_SIGNATURE.len());
-        assert_eq!(COPY_LEN, RENDER_SIGNATURE.len());
+    }
+
+    #[test]
+    fn request_signature_covers_the_validated_prologue() {
+        // 18 bytes: `push rdi; sub rsp,0x90; movq [rsp+0x20],-2`.
+        assert_eq!(REQUEST_GROUPS_SIGNATURE.len(), 18);
     }
 }

src/config.rs

@@ -314,6 +314,7 @@ impl LauncherConfig {
                 https: self.openfut_https_port,
                 blaze_redirector: self.openfut_blaze_redirector_port,
                 blaze_main: self.openfut_blaze_main_port,
+                fut_content: openfut_common::default_ports::FUT_CONTENT,
             },
         }
     }